diff --git a/CHANGES b/CHANGES
index 69760e0238..871cb3bf48 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+2534.	[func]		Check NAPTR records regular expressions and
+			replacement strings to ensure they are syntaxically
+			valid and consistant. [RT #18168]
+
 2533.	[doc]		ARM: document @ (at-sign). [RT #17144]
 
 2532.	[bug]		dig: check the question section of the response to
diff --git a/bin/tests/system/genzone.sh b/bin/tests/system/genzone.sh
index bea95e8a27..4d700fd322 100644
--- a/bin/tests/system/genzone.sh
+++ b/bin/tests/system/genzone.sh
@@ -15,7 +15,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: genzone.sh,v 1.8 2007/06/19 23:47:00 tbox Exp $
+# $Id: genzone.sh,v 1.9 2009/01/21 05:36:44 marka Exp $
 
 #
 # Set up a test zone
@@ -193,8 +193,8 @@ srv02			SRV 65535 65535 65535  old-slow-box
 
 ; type 35
 naptr01			NAPTR   0 0 "" "" "" . 
-naptr02			NAPTR   65535 65535 blurgh blorf blegh foo.
-naptr02			NAPTR   65535 65535 "blurgh" "blorf" "blegh" foo.
+naptr02			NAPTR   65535 65535 blurgh blorf blllbb foo.
+naptr02			NAPTR   65535 65535 "blurgh" "blorf" "blllbb" foo.
 
 ; type 36
 kx01			KX	10 kdc
diff --git a/bin/tests/system/notify/ns2/example1.db b/bin/tests/system/notify/ns2/example1.db
index f08169363a..c9db087ec3 100644
--- a/bin/tests/system/notify/ns2/example1.db
+++ b/bin/tests/system/notify/ns2/example1.db
@@ -13,7 +13,7 @@
 ; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 ; PERFORMANCE OF THIS SOFTWARE.
 
-; $Id: example1.db,v 1.12 2007/06/19 23:47:04 tbox Exp $
+; $Id: example1.db,v 1.13 2009/01/21 05:36:44 marka Exp $
 
 $ORIGIN .
 $TTL 300	; 5 minutes
@@ -93,7 +93,7 @@ mr02			MR	.
 mx01			MX	10 mail
 mx02			MX	10 .
 naptr01			NAPTR	0 0 "" "" "" .
-naptr02			NAPTR	65535 65535 "blurgh" "blorf" "blegh" foo.
+naptr02			NAPTR	65535 65535 "blurgh" "blorf" "blllbb" foo.
 nsap-ptr01		NSAP-PTR foo.
 			NSAP-PTR .
 nsap01			NSAP	0x47000580005a0000000001e133ffffff00016100
diff --git a/bin/tests/system/notify/ns2/example2.db b/bin/tests/system/notify/ns2/example2.db
index 93ae0405d0..6299917029 100644
--- a/bin/tests/system/notify/ns2/example2.db
+++ b/bin/tests/system/notify/ns2/example2.db
@@ -13,7 +13,7 @@
 ; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 ; PERFORMANCE OF THIS SOFTWARE.
 
-; $Id: example2.db,v 1.12 2007/06/19 23:47:04 tbox Exp $
+; $Id: example2.db,v 1.13 2009/01/21 05:36:44 marka Exp $
 
 $ORIGIN .
 $TTL 300	; 5 minutes
@@ -93,7 +93,7 @@ mr02			MR	.
 mx01			MX	10 mail
 mx02			MX	10 .
 naptr01			NAPTR	0 0 "" "" "" .
-naptr02			NAPTR	65535 65535 "blurgh" "blorf" "blegh" foo.
+naptr02			NAPTR	65535 65535 "blurgh" "blorf" "blllbb" foo.
 nsap-ptr01		NSAP-PTR foo.
 			NSAP-PTR .
 nsap01			NSAP	0x47000580005a0000000001e133ffffff00016100
diff --git a/bin/tests/system/notify/ns2/example3.db b/bin/tests/system/notify/ns2/example3.db
index 3afbaa62af..045862b3b6 100644
--- a/bin/tests/system/notify/ns2/example3.db
+++ b/bin/tests/system/notify/ns2/example3.db
@@ -13,7 +13,7 @@
 ; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 ; PERFORMANCE OF THIS SOFTWARE.
 
-; $Id: example3.db,v 1.12 2007/06/19 23:47:04 tbox Exp $
+; $Id: example3.db,v 1.13 2009/01/21 05:36:44 marka Exp $
 
 $ORIGIN .
 $TTL 300	; 5 minutes
@@ -93,7 +93,7 @@ mr02			MR	.
 mx01			MX	10 mail
 mx02			MX	10 .
 naptr01			NAPTR	0 0 "" "" "" .
-naptr02			NAPTR	65535 65535 "blurgh" "blorf" "blegh" foo.
+naptr02			NAPTR	65535 65535 "blurgh" "blorf" "blllbb" foo.
 nsap-ptr01		NSAP-PTR foo.
 			NSAP-PTR .
 nsap01			NSAP	0x47000580005a0000000001e133ffffff00016100
diff --git a/bin/tests/system/notify/ns2/example4.db b/bin/tests/system/notify/ns2/example4.db
index 8c18a37231..6aa5d65a30 100644
--- a/bin/tests/system/notify/ns2/example4.db
+++ b/bin/tests/system/notify/ns2/example4.db
@@ -13,7 +13,7 @@
 ; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 ; PERFORMANCE OF THIS SOFTWARE.
 
-; $Id: example4.db,v 1.12 2007/06/19 23:47:04 tbox Exp $
+; $Id: example4.db,v 1.13 2009/01/21 05:36:44 marka Exp $
 
 $ORIGIN .
 $TTL 300	; 5 minutes
@@ -93,7 +93,7 @@ mr02			MR	.
 mx01			MX	10 mail
 mx02			MX	10 .
 naptr01			NAPTR	0 0 "" "" "" .
-naptr02			NAPTR	65535 65535 "blurgh" "blorf" "blegh" foo.
+naptr02			NAPTR	65535 65535 "blurgh" "blorf" "blllbb" foo.
 nsap-ptr01		NSAP-PTR foo.
 			NSAP-PTR .
 nsap01			NSAP	0x47000580005a0000000001e133ffffff00016100
diff --git a/bin/tests/system/nsupdate/knowngood.ns1.after b/bin/tests/system/nsupdate/knowngood.ns1.after
index 32e1c8d307..4114159ece 100644
--- a/bin/tests/system/nsupdate/knowngood.ns1.after
+++ b/bin/tests/system/nsupdate/knowngood.ns1.after
@@ -52,7 +52,7 @@ mr02.example.nil.	3600	IN	MR	.
 mx01.example.nil.	3600	IN	MX	10 mail.example.nil.
 mx02.example.nil.	3600	IN	MX	10 .
 naptr01.example.nil.	3600	IN	NAPTR	0 0 "" "" "" .
-naptr02.example.nil.	3600	IN	NAPTR	65535 65535 "blurgh" "blorf" "blegh" foo.
+naptr02.example.nil.	3600	IN	NAPTR	65535 65535 "blurgh" "blorf" "blllbb" foo.
 ns1.example.nil.	300	IN	A	10.53.0.1
 ns2.example.nil.	300	IN	A	10.53.0.2
 nsap-ptr01.example.nil.	3600	IN	NSAP-PTR .
diff --git a/bin/tests/system/nsupdate/knowngood.ns1.before b/bin/tests/system/nsupdate/knowngood.ns1.before
index e108c2acf3..4a5e630d5a 100644
--- a/bin/tests/system/nsupdate/knowngood.ns1.before
+++ b/bin/tests/system/nsupdate/knowngood.ns1.before
@@ -52,7 +52,7 @@ mr02.example.nil.	3600	IN	MR	.
 mx01.example.nil.	3600	IN	MX	10 mail.example.nil.
 mx02.example.nil.	3600	IN	MX	10 .
 naptr01.example.nil.	3600	IN	NAPTR	0 0 "" "" "" .
-naptr02.example.nil.	3600	IN	NAPTR	65535 65535 "blurgh" "blorf" "blegh" foo.
+naptr02.example.nil.	3600	IN	NAPTR	65535 65535 "blurgh" "blorf" "blllbb" foo.
 ns1.example.nil.	300	IN	A	10.53.0.1
 ns2.example.nil.	300	IN	A	10.53.0.2
 nsap-ptr01.example.nil.	3600	IN	NSAP-PTR .
diff --git a/bin/tests/system/nsupdate/ns1/example1.db b/bin/tests/system/nsupdate/ns1/example1.db
index e8856fe29e..00a45e45f8 100644
--- a/bin/tests/system/nsupdate/ns1/example1.db
+++ b/bin/tests/system/nsupdate/ns1/example1.db
@@ -13,7 +13,7 @@
 ; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 ; PERFORMANCE OF THIS SOFTWARE.
 
-; $Id: example1.db,v 1.8 2007/06/19 23:47:04 tbox Exp $
+; $Id: example1.db,v 1.9 2009/01/21 05:36:45 marka Exp $
 
 $ORIGIN .
 $TTL 300	; 5 minutes
@@ -95,7 +95,7 @@ mr02			MR	.
 mx01			MX	10 mail
 mx02			MX	10 .
 naptr01			NAPTR	0 0 "" "" "" .
-naptr02			NAPTR	65535 65535 "blurgh" "blorf" "blegh" foo.
+naptr02			NAPTR	65535 65535 "blurgh" "blorf" "blllbb" foo.
 nsap-ptr01		NSAP-PTR foo.
 			NSAP-PTR .
 nsap01			NSAP	0x47000580005a0000000001e133ffffff00016100
diff --git a/bin/tests/system/relay/ns2/example1.db b/bin/tests/system/relay/ns2/example1.db
index ed0ffe9e29..39230cc631 100644
--- a/bin/tests/system/relay/ns2/example1.db
+++ b/bin/tests/system/relay/ns2/example1.db
@@ -13,7 +13,7 @@
 ; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 ; PERFORMANCE OF THIS SOFTWARE.
 
-; $Id: example1.db,v 1.7 2007/06/19 23:47:04 tbox Exp $
+; $Id: example1.db,v 1.8 2009/01/21 05:36:45 marka Exp $
 
 $ORIGIN .
 $TTL 300	; 5 minutes
@@ -93,7 +93,7 @@ mr02			MR	.
 mx01			MX	10 mail
 mx02			MX	10 .
 naptr01			NAPTR	0 0 "" "" "" .
-naptr02			NAPTR	65535 65535 "blurgh" "blorf" "blegh" foo.
+naptr02			NAPTR	65535 65535 "blurgh" "blorf" "blllbb" foo.
 nsap-ptr01		NSAP-PTR foo.
 			NSAP-PTR .
 nsap01			NSAP	0x47000580005a0000000001e133ffffff00016100
diff --git a/bin/tests/system/relay/ns2/example2.db b/bin/tests/system/relay/ns2/example2.db
index f607a83c91..310463ea0e 100644
--- a/bin/tests/system/relay/ns2/example2.db
+++ b/bin/tests/system/relay/ns2/example2.db
@@ -13,7 +13,7 @@
 ; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 ; PERFORMANCE OF THIS SOFTWARE.
 
-; $Id: example2.db,v 1.7 2007/06/19 23:47:04 tbox Exp $
+; $Id: example2.db,v 1.8 2009/01/21 05:36:45 marka Exp $
 
 $ORIGIN .
 $TTL 300	; 5 minutes
@@ -93,7 +93,7 @@ mr02			MR	.
 mx01			MX	10 mail
 mx02			MX	10 .
 naptr01			NAPTR	0 0 "" "" "" .
-naptr02			NAPTR	65535 65535 "blurgh" "blorf" "blegh" foo.
+naptr02			NAPTR	65535 65535 "blurgh" "blorf" "blllbb" foo.
 nsap-ptr01		NSAP-PTR foo.
 			NSAP-PTR .
 nsap01			NSAP	0x47000580005a0000000001e133ffffff00016100
diff --git a/bin/tests/system/relay/ns2/example3.db b/bin/tests/system/relay/ns2/example3.db
index a9907f95f2..ccb7ca789a 100644
--- a/bin/tests/system/relay/ns2/example3.db
+++ b/bin/tests/system/relay/ns2/example3.db
@@ -13,7 +13,7 @@
 ; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 ; PERFORMANCE OF THIS SOFTWARE.
 
-; $Id: example3.db,v 1.7 2007/06/19 23:47:04 tbox Exp $
+; $Id: example3.db,v 1.8 2009/01/21 05:36:45 marka Exp $
 
 $ORIGIN .
 $TTL 300	; 5 minutes
@@ -93,7 +93,7 @@ mr02			MR	.
 mx01			MX	10 mail
 mx02			MX	10 .
 naptr01			NAPTR	0 0 "" "" "" .
-naptr02			NAPTR	65535 65535 "blurgh" "blorf" "blegh" foo.
+naptr02			NAPTR	65535 65535 "blurgh" "blorf" "blllbb" foo.
 nsap-ptr01		NSAP-PTR foo.
 			NSAP-PTR .
 nsap01			NSAP	0x47000580005a0000000001e133ffffff00016100
diff --git a/bin/tests/system/relay/ns2/example4.db b/bin/tests/system/relay/ns2/example4.db
index 284098adee..aabd53c66f 100644
--- a/bin/tests/system/relay/ns2/example4.db
+++ b/bin/tests/system/relay/ns2/example4.db
@@ -13,7 +13,7 @@
 ; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 ; PERFORMANCE OF THIS SOFTWARE.
 
-; $Id: example4.db,v 1.7 2007/06/19 23:47:04 tbox Exp $
+; $Id: example4.db,v 1.8 2009/01/21 05:36:45 marka Exp $
 
 $ORIGIN .
 $TTL 300	; 5 minutes
@@ -93,7 +93,7 @@ mr02			MR	.
 mx01			MX	10 mail
 mx02			MX	10 .
 naptr01			NAPTR	0 0 "" "" "" .
-naptr02			NAPTR	65535 65535 "blurgh" "blorf" "blegh" foo.
+naptr02			NAPTR	65535 65535 "blurgh" "blorf" "blllbb" foo.
 nsap-ptr01		NSAP-PTR foo.
 			NSAP-PTR .
 nsap01			NSAP	0x47000580005a0000000001e133ffffff00016100
diff --git a/bin/tests/system/tsig/ns1/example.db b/bin/tests/system/tsig/ns1/example.db
index 1dd6522f5a..6b91bb00cb 100644
--- a/bin/tests/system/tsig/ns1/example.db
+++ b/bin/tests/system/tsig/ns1/example.db
@@ -12,7 +12,7 @@
 ; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 ; PERFORMANCE OF THIS SOFTWARE.
 
-; $Id: example.db,v 1.5 2007/06/19 23:47:06 tbox Exp $
+; $Id: example.db,v 1.6 2009/01/21 05:36:45 marka Exp $
 
 $ORIGIN .
 $TTL 300	; 5 minutes
@@ -94,7 +94,7 @@ mr02			MR	.
 mx01			MX	10 mail
 mx02			MX	10 .
 naptr01			NAPTR	0 0 "" "" "" .
-naptr02			NAPTR	65535 65535 "blurgh" "blorf" "blegh" foo.
+naptr02			NAPTR	65535 65535 "blurgh" "blorf" ":(.*):\\1:" foo.
 nsap-ptr01		NSAP-PTR foo.
 			NSAP-PTR .
 nsap01			NSAP	0x47000580005a0000000001e133ffffff00016100
diff --git a/bin/tests/system/xfer/dig1.good b/bin/tests/system/xfer/dig1.good
index b7f3f79108..37f5deb776 100644
--- a/bin/tests/system/xfer/dig1.good
+++ b/bin/tests/system/xfer/dig1.good
@@ -40,7 +40,7 @@ mr02.example.		3600	IN	MR	.
 mx01.example.		3600	IN	MX	10 mail.example.
 mx02.example.		3600	IN	MX	10 .
 naptr01.example.	3600	IN	NAPTR	0 0 "" "" "" .
-naptr02.example.	3600	IN	NAPTR	65535 65535 "blurgh" "blorf" "blegh" foo.
+naptr02.example.	3600	IN	NAPTR	65535 65535 "blurgh" "blorf" "blllbb" foo.
 ns2.example.		3600	IN	A	10.53.0.2
 ns3.example.		3600	IN	A	10.53.0.3
 nsap-ptr01.example.	3600	IN	NSAP-PTR .
diff --git a/bin/tests/system/xfer/dig2.good b/bin/tests/system/xfer/dig2.good
index 9f2cece63e..a0716674a5 100644
--- a/bin/tests/system/xfer/dig2.good
+++ b/bin/tests/system/xfer/dig2.good
@@ -40,7 +40,7 @@ mr02.example.		3600	IN	MR	.
 mx01.example.		3600	IN	MX	10 mail.example.
 mx02.example.		3600	IN	MX	10 .
 naptr01.example.	3600	IN	NAPTR	0 0 "" "" "" .
-naptr02.example.	3600	IN	NAPTR	65535 65535 "blurgh" "blorf" "blegh" foo.
+naptr02.example.	3600	IN	NAPTR	65535 65535 "blurgh" "blorf" "blllbb" foo.
 ns2.example.		3600	IN	A	10.53.0.2
 ns3.example.		3600	IN	A	10.53.0.3
 nsap-ptr01.example.	3600	IN	NSAP-PTR .
diff --git a/bin/tests/system/xferquota/ns2/example.db b/bin/tests/system/xferquota/ns2/example.db
index 8e5a7be709..f55752d6ba 100644
--- a/bin/tests/system/xferquota/ns2/example.db
+++ b/bin/tests/system/xferquota/ns2/example.db
@@ -13,7 +13,7 @@
 ; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 ; PERFORMANCE OF THIS SOFTWARE.
 
-; $Id: example.db,v 1.12 2007/06/19 23:47:07 tbox Exp $
+; $Id: example.db,v 1.13 2009/01/21 05:36:45 marka Exp $
 
 $ORIGIN .
 $TTL 300	; 5 minutes
@@ -95,7 +95,7 @@ mr02			MR	.
 mx01			MX	10 mail
 mx02			MX	10 .
 naptr01			NAPTR	0 0 "" "" "" .
-naptr02			NAPTR	65535 65535 "blurgh" "blorf" "blegh" foo.
+naptr02			NAPTR	65535 65535 "blurgh" "blorf" ":(.*):\\1:" foo.
 nsap-ptr01		NSAP-PTR foo.
 			NSAP-PTR .
 nsap01			NSAP	0x47000580005a0000000001e133ffffff00016100
diff --git a/config.h.in b/config.h.in
index 768a8e087b..56a0d8eb6d 100644
--- a/config.h.in
+++ b/config.h.in
@@ -16,7 +16,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: config.h.in,v 1.112 2009/01/19 01:39:50 marka Exp $ */
+/* $Id: config.h.in,v 1.114 2009/02/15 22:54:29 marka Exp $ */
 
 /*! \file */
 
@@ -217,6 +217,9 @@ int sigwait(const unsigned int *set, int *sig);
 /* Define to 1 if you have the <net/if6.h> header file. */
 #undef HAVE_NET_IF6_H
 
+/* Define to 1 if you have the <regex.h> header file. */
+#undef HAVE_REGEX_H
+
 /* Define to 1 if you have the `setlocale' function. */
 #undef HAVE_SETLOCALE
 
diff --git a/configure b/configure
index 6d987acbcf..afa19f10ee 100755
--- a/configure
+++ b/configure
@@ -14,7 +14,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 #
-# $Id: configure,v 1.450 2009/01/19 01:39:50 marka Exp $
+# $Id: configure,v 1.451 2009/01/21 05:37:55 marka Exp $
 #
 # Portions Copyright (C) 1996-2001  Nominum, Inc.
 #
@@ -29,7 +29,7 @@
 # WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
 # OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-# From configure.in Revision: 1.465 .
+# From configure.in Revision: 1.466 .
 # Guess values for system-dependent variables and create Makefiles.
 # Generated by GNU Autoconf 2.62.
 #
@@ -20775,7 +20775,8 @@ fi
 
 
 
-for ac_header in fcntl.h sys/time.h unistd.h sys/sockio.h sys/select.h sys/param.h sys/sysctl.h net/if6.h
+
+for ac_header in fcntl.h regex.h sys/time.h unistd.h sys/sockio.h sys/select.h sys/param.h sys/sysctl.h net/if6.h
 do
 as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`
 { $as_echo "$as_me:$LINENO: checking for $ac_header" >&5
diff --git a/configure.in b/configure.in
index 36d64ee42f..65054a5f51 100644
--- a/configure.in
+++ b/configure.in
@@ -18,7 +18,7 @@ AC_DIVERT_PUSH(1)dnl
 esyscmd([sed "s/^/# /" COPYRIGHT])dnl
 AC_DIVERT_POP()dnl
 
-AC_REVISION($Revision: 1.465 $)
+AC_REVISION($Revision: 1.466 $)
 
 AC_INIT(lib/dns/name.c)
 AC_PREREQ(2.59)
@@ -257,7 +257,7 @@ esac
 
 AC_HEADER_STDC
 
-AC_CHECK_HEADERS(fcntl.h sys/time.h unistd.h sys/sockio.h sys/select.h sys/param.h sys/sysctl.h net/if6.h,,,
+AC_CHECK_HEADERS(fcntl.h regex.h sys/time.h unistd.h sys/sockio.h sys/select.h sys/param.h sys/sysctl.h net/if6.h,,,
 [$ac_includes_default
 #ifdef HAVE_SYS_PARAM_H
 # include <sys/param.h>
diff --git a/lib/dns/rdata/in_1/naptr_35.c b/lib/dns/rdata/in_1/naptr_35.c
index 21ab44c40e..05aba61361 100644
--- a/lib/dns/rdata/in_1/naptr_35.c
+++ b/lib/dns/rdata/in_1/naptr_35.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: naptr_35.c,v 1.53 2008/02/15 23:46:51 tbox Exp $ */
+/* $Id: naptr_35.c,v 1.54 2009/01/21 05:36:45 marka Exp $ */
 
 /* Reviewed: Thu Mar 16 16:52:50 PST 2000 by bwelling */
 
@@ -25,12 +25,134 @@
 #define RDATA_IN_1_NAPTR_35_C
 
 #define RRTYPE_NAPTR_ATTRIBUTES (0)
+#ifdef HAVE_REGEX_H
+#include <regex.h>
+#endif
+
+/*
+ * Check the wire format of the Regexp field.
+ * Don't allow embeded NUL's.
+ */
+static inline isc_result_t
+txt_valid_regex(const unsigned char *txt) {
+#ifdef HAVE_REGEX_H
+	regex_t preg;
+	unsigned int regflags = REG_EXTENDED;
+	unsigned int nsub = 0;
+	char regex[256];
+	char *cp;
+#endif
+	isc_boolean_t flags = ISC_FALSE;
+	isc_boolean_t replace = ISC_FALSE;
+	unsigned char c;
+	unsigned char delim;
+	unsigned int len;
+
+	len = *txt++;
+	if (len == 0U)
+		return (ISC_R_SUCCESS);
+
+	delim = *txt++;
+	len--;
+
+	/*
+	 * Digits, backslash and flags can't be delimiters.
+	 */
+	switch (delim) {
+	case '0': case '1': case '2': case '3': case '4':
+	case '5': case '6': case '7': case '8': case '9':
+	case '\\': case 'i': case 0:
+		return (DNS_R_SYNTAX);
+	}
+
+#ifdef HAVE_REGEX_H
+	memset(&preg, 0, sizeof(preg));
+	cp = regex;
+#endif
+
+	while (len-- > 0) {
+		c = *txt++;
+		if (c == 0)
+			return (DNS_R_SYNTAX);
+		if (c == delim && !replace) {
+			replace = ISC_TRUE;
+			continue;
+		} else if (c == delim && !flags) {
+			flags = ISC_TRUE;
+			continue;
+		} else if (c == delim)
+			return (DNS_R_SYNTAX);
+		/*
+		 * Flags are not escaped.
+		 */
+		if (flags) {
+			switch (c) {
+			case 'i':
+#ifdef HAVE_REGEX_H
+				regflags |= REG_ICASE;
+#endif
+				continue;
+			default:
+				return (DNS_R_SYNTAX);
+			}
+		}
+#ifdef HAVE_REGEX_H
+		if (!replace)
+			*cp++ = c;
+#endif
+		if (c == '\\') {
+			if (len == 0)
+				return (DNS_R_SYNTAX);
+			c = *txt++;
+			if (c == 0)
+				return (DNS_R_SYNTAX);
+			len--;
+			if (replace)
+				switch (c) {
+				case '0': return (DNS_R_SYNTAX);
+#ifdef HAVE_REGEX_H
+				case '1': if (nsub < 1) nsub = 1; break;
+				case '2': if (nsub < 2) nsub = 2; break;
+				case '3': if (nsub < 3) nsub = 3; break;
+				case '4': if (nsub < 4) nsub = 4; break;
+				case '5': if (nsub < 5) nsub = 5; break;
+				case '6': if (nsub < 6) nsub = 6; break;
+				case '7': if (nsub < 7) nsub = 7; break;
+				case '8': if (nsub < 8) nsub = 8; break;
+				case '9': if (nsub < 9) nsub = 9; break;
+#endif
+				}
+#ifdef HAVE_REGEX_H
+			if (!replace)
+				*cp++ = c;
+#endif
+		}
+	}
+	if (!flags)
+		return (DNS_R_SYNTAX);
+#ifdef HAVE_REGEX_H
+	*cp = '\0';
+	if (regcomp(&preg, regex, regflags))
+		return (DNS_R_SYNTAX);
+	/*
+	 * Check that substitutions in the replacement string are consistant
+	 * with the regular expression.
+	 */
+	if (preg.re_nsub < nsub) {
+		regfree(&preg);
+		return (DNS_R_SYNTAX);
+	}
+	regfree(&preg);
+#endif
+	return (ISC_R_SUCCESS);
+}
 
 static inline isc_result_t
 fromtext_in_naptr(ARGS_FROMTEXT) {
 	isc_token_t token;
 	dns_name_t name;
 	isc_buffer_t buffer;
+	unsigned char *regex;
 
 	REQUIRE(type == 35);
 	REQUIRE(rdclass == 1);
@@ -74,9 +196,11 @@ fromtext_in_naptr(ARGS_FROMTEXT) {
 	/*
 	 * Regexp.
 	 */
+	regex = isc_buffer_used(target);
 	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_qstring,
 				      ISC_FALSE));
 	RETTOK(txt_fromtext(&token.value.as_textregion, target));
+	RETTOK(txt_valid_regex(regex));
 
 	/*
 	 * Replacement.
@@ -156,6 +280,7 @@ static inline isc_result_t
 fromwire_in_naptr(ARGS_FROMWIRE) {
 	dns_name_t name;
 	isc_region_t sr;
+	unsigned char *regex;
 
 	REQUIRE(type == 35);
 	REQUIRE(rdclass == 1);
@@ -189,7 +314,9 @@ fromwire_in_naptr(ARGS_FROMWIRE) {
 	/*
 	 * Regexp.
 	 */
+	regex = isc_buffer_used(target);
 	RETERR(txt_fromwire(source, target));
+	RETERR(txt_valid_regex(regex));
 
 	/*
 	 * Replacement.