regen v9_10

2014-10-23 01:09:00 +00:00
parent be8193f39c
commit f3ddf32fcc
30 changed files with 363 additions and 175 deletions
@@ -52,7 +52,7 @@
 <dt><span class="sect2"><a href="Bv9ARM.ch09.html#relnotes_security">Security Fixes</a></span></dt>
 <dt><span class="sect2"><a href="Bv9ARM.ch09.html#relnotes_features">New Features</a></span></dt>
 <dt><span class="sect2"><a href="Bv9ARM.ch09.html#relnotes_changes">Feature Changes</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch09.html#relnotes_features">Bug Fixes</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch09.html#relnotes_bugs">Bug Fixes</a></span></dt>
 <dt><span class="sect2"><a href="Bv9ARM.ch09.html#relnotes_thanks">Thank You</a></span></dt>
 </dl></dd>
 <dt><span class="sect1"><a href="Bv9ARM.ch09.html#id2606667">Acknowledgments</a></span></dt>
@@ -67,13 +67,13 @@
 </dl></dd>
 <dt><span class="sect1"><a href="Bv9ARM.ch09.html#bind9.library">BIND 9 DNS Library Support</a></span></dt>
 <dd><dl>
-<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2611822">Prerequisite</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2611832">Compilation</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2611857">Installation</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2611956">Known Defects/Restrictions</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2612033">The dns.conf File</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2612059">Sample Applications</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2613305">Library References</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2612037">Prerequisite</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2612046">Compilation</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2612071">Installation</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2612307">Known Defects/Restrictions</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2612384">The dns.conf File</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2612410">Sample Applications</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2613520">Library References</a></span></dt>
 </dl></dd>
 </dl>
 </div>
@@ -112,12 +112,106 @@
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
 <a name="relnotes_changes"></a>Feature Changes</h3></div></div></div>
-<div class="itemizedlist"><ul type="disc"><li><p>None</p></li></ul></div>
+<div class="itemizedlist"><ul type="disc">
+<li><p>
+	  ACLs containing <span><strong class="command">geoip asnum</strong></span> elements were
+	  not correctly matched unless the full organization name was
+	  specified in the ACL (as in
+	  <span><strong class="command">geoip asnum "AS1234 Example, Inc.";</strong></span>).
+	  They can now match against the AS number alone (as in
+	  <span><strong class="command">geoip asnum "AS1234";</strong></span>).
+        </p></li>
+<li><p>
+          When using native PKCS#11 cryptography (i.e.,
+          <span><strong class="command">configure --enable-native-pkcs11</strong></span>) HSM PINs
+          of up to 256 characters can now be used.
+        </p></li>
+<li><p>
+          NXDOMAIN responses to queries of type DS are now cached separately
+          from those for other types. This helps when using "grafted" zones
+          of type forward, for which the parent zone does not contain a
+          delegation, such as local top-level domains.  Previously a query
+          of type DS for such a zone could cause the zone apex to be cached
+          as NXDOMAIN, blocking all subsequent queries.  (Note: This
+          change is only helpful when DNSSEC validation is not enabled.
+          "Grafted" zones without a delegation in the parent are not a
+          recommended configuration.)
+        </p></li>
+<li><p>
+          NOTIFY messages that are sent because a zone has been updated
+          are now given priority above NOTIFY messages that were scheduled
+          when the server started up. This should mitigate delays in zone
+          propagation when servers are restarted frequently.
+        </p></li>
+<li><p>
+          Errors reported when running <span><strong class="command">rndc addzone</strong></span>
+          (e.g., when a zone file cannot be loaded) have been clarified
+          to make it easier to diagnose problems.
+        </p></li>
+</ul></div>
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="relnotes_features"></a>Bug Fixes</h3></div></div></div>
-<div class="itemizedlist"><ul type="disc"><li><p>None</p></li></ul></div>
+<a name="relnotes_bugs"></a>Bug Fixes</h3></div></div></div>
+<div class="itemizedlist"><ul type="disc">
+<li><p>
+	  <span><strong class="command">dig</strong></span>, <span><strong class="command">host</strong></span> and
+	  <span><strong class="command">nslookup</strong></span> aborted when encountering
+	  a name which, after appending search list elements,
+	  exceeded 255 bytes. Such names are now skipped, but
+	  processing of other names will continue. [RT #36892]
+        </p></li>
+<li><p>
+	  The error message generated when
+	  <span><strong class="command">named-checkzone</strong></span> or
+	  <span><strong class="command">named-checkconf -z</strong></span> encounters a
+	  <code class="option">$TTL</code> directive without a value has
+	  been clarified. [RT #37138]
+        </p></li>
+<li><p>
+	  Semicolon characters (;) included in TXT records were
+	  incorrectly escaped with a backslash when the record was
+	  displayed as text. This is actually only necessary when there
+	  are no quotation marks. [RT #37159]
+        </p></li>
+<li><p>
+	  When files opened for writing by <span><strong class="command">named</strong></span>,
+	  such as zone journal files, were referenced more than once
+	  in <code class="filename">named.conf</code>, it could lead to file
+	  corruption as multiple threads wrote to the same file. This
+	  is now detected when loading <code class="filename">named.conf</code>
+	  and reported as an error. [RT #37172]
+        </p></li>
+<li><p>
+          <span><strong class="command">dnssec-keygen -S</strong></span> failed to generate successor
+          keys for some algorithm types (including ECDSA and GOST) due to
+          a difference in the content of private key files. This has been
+          corrected. [RT #37183]
+        </p></li>
+<li><p>
+          UPDATE messages that arrived too soon after
+          an <span><strong class="command">rndc thaw</strong></span> could be lost. [RT #37233]
+        </p></li>
+<li><p>
+          Forwarding of UPDATE messages did not work when they were
+          signed with SIG(0); they resulted in a BADSIG response code.
+          [RT #37216]
+        </p></li>
+<li><p>
+          When checking for updates to trust anchors listed in
+          <code class="option">managed-keys</code>, <span><strong class="command">named</strong></span>
+          now revalidates keys based on the current set of
+          active trust anchors, without relying on any cached
+          record of previous validation. [RT #37506]
+        </p></li>
+<li><p>
+	  Large-system tuning
+	  (<span><strong class="command">configure --with-tuning=large</strong></span>) caused
+	  problems on some platforms by setting a socket receive
+	  buffer size that was too large.  This is now detected and
+	  corrected at run time. [RT #37187]
+        </p></li>
+</ul></div>
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
@@ -711,7 +805,7 @@
 </ul></div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2611822"></a>Prerequisite</h3></div></div></div>
+<a name="id2612037"></a>Prerequisite</h3></div></div></div>
 <p>GNU make is required to build the export libraries (other
  part of BIND 9 can still be built with other types of make). In
  the reminder of this document, "make" means GNU make. Note that
@@ -720,7 +814,7 @@
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2611832"></a>Compilation</h3></div></div></div>
+<a name="id2612046"></a>Compilation</h3></div></div></div>
 <pre class="screen">
 $ <strong class="userinput"><code>./configure --enable-exportlib <em class="replaceable"><code>[other flags]</code></em></code></strong>
 $ <strong class="userinput"><code>make</code></strong>
@@ -735,7 +829,7 @@ $ <strong class="userinput"><code>make</code></strong>
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2611857"></a>Installation</h3></div></div></div>
+<a name="id2612071"></a>Installation</h3></div></div></div>
 <pre class="screen">
 $ <strong class="userinput"><code>cd lib/export</code></strong>
 $ <strong class="userinput"><code>make install</code></strong>
@@ -757,7 +851,7 @@ $ <strong class="userinput"><code>make install</code></strong>
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2611956"></a>Known Defects/Restrictions</h3></div></div></div>
+<a name="id2612307"></a>Known Defects/Restrictions</h3></div></div></div>
 <div class="itemizedlist"><ul type="disc">
 <li><p>Currently, win32 is not supported for the export
      library. (Normal BIND 9 application can be built as
@@ -797,7 +891,7 @@ $ <strong class="userinput"><code>make</code></strong>
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2612033"></a>The dns.conf File</h3></div></div></div>
+<a name="id2612384"></a>The dns.conf File</h3></div></div></div>
 <p>The IRS library supports an "advanced" configuration file
  related to the DNS library for configuration parameters that
  would be beyond the capability of the
@@ -815,14 +909,14 @@ $ <strong class="userinput"><code>make</code></strong>
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2612059"></a>Sample Applications</h3></div></div></div>
+<a name="id2612410"></a>Sample Applications</h3></div></div></div>
 <p>Some sample application programs using this API are
  provided for reference. The following is a brief description of
  these applications.
  </p>
 <div class="sect3" lang="en">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2612068"></a>sample: a simple stub resolver utility</h4></div></div></div>
+<a name="id2612419"></a>sample: a simple stub resolver utility</h4></div></div></div>
 <p>
  It sends a query of a given name (of a given optional RR type) to a
  specified recursive server, and prints the result as a list of
@@ -886,7 +980,7 @@ $ <strong class="userinput"><code>make</code></strong>
 </div>
 <div class="sect3" lang="en">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2612227"></a>sample-async: a simple stub resolver, working asynchronously</h4></div></div></div>
+<a name="id2612851"></a>sample-async: a simple stub resolver, working asynchronously</h4></div></div></div>
 <p>
  Similar to "sample", but accepts a list
  of (query) domain names as a separate file and resolves the names
@@ -927,7 +1021,7 @@ $ <strong class="userinput"><code>make</code></strong>
 </div>
 <div class="sect3" lang="en">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2612280"></a>sample-request: a simple DNS transaction client</h4></div></div></div>
+<a name="id2612904"></a>sample-request: a simple DNS transaction client</h4></div></div></div>
 <p>
  It sends a query to a specified server, and
  prints the response with minimal processing. It doesn't act as a
@@ -968,7 +1062,7 @@ $ <strong class="userinput"><code>make</code></strong>
 </div>
 <div class="sect3" lang="en">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2612344"></a>sample-gai: getaddrinfo() and getnameinfo() test code</h4></div></div></div>
+<a name="id2612968"></a>sample-gai: getaddrinfo() and getnameinfo() test code</h4></div></div></div>
 <p>
  This is a test program
  to check getaddrinfo() and getnameinfo() behavior. It takes a
@@ -985,7 +1079,7 @@ $ <strong class="userinput"><code>make</code></strong>
 </div>
 <div class="sect3" lang="en">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2612359"></a>sample-update: a simple dynamic update client program</h4></div></div></div>
+<a name="id2612983"></a>sample-update: a simple dynamic update client program</h4></div></div></div>
 <p>
  It accepts a single update command as a
  command-line argument, sends an update request message to the
@@ -1080,7 +1174,7 @@ $ <strong class="userinput"><code>sample-update -a sample-update -k Kxxx.+nnn+mm
 </div>
 <div class="sect3" lang="en">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2613173"></a>nsprobe: domain/name server checker in terms of RFC 4074</h4></div></div></div>
+<a name="id2613456"></a>nsprobe: domain/name server checker in terms of RFC 4074</h4></div></div></div>
 <p>
  It checks a set
  of domains to see the name servers of the domains behave
@@ -1137,7 +1231,7 @@ $ <strong class="userinput"><code>sample-update -a sample-update -k Kxxx.+nnn+mm
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2613305"></a>Library References</h3></div></div></div>
+<a name="id2613520"></a>Library References</h3></div></div></div>
 <p>As of this writing, there is no formal "manual" of the
  libraries, except this document, header files (some of them
  provide pretty detailed explanations), and sample application
@@ -247,7 +247,7 @@
 <dt><span class="sect2"><a href="Bv9ARM.ch09.html#relnotes_security">Security Fixes</a></span></dt>
 <dt><span class="sect2"><a href="Bv9ARM.ch09.html#relnotes_features">New Features</a></span></dt>
 <dt><span class="sect2"><a href="Bv9ARM.ch09.html#relnotes_changes">Feature Changes</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch09.html#relnotes_features">Bug Fixes</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch09.html#relnotes_bugs">Bug Fixes</a></span></dt>
 <dt><span class="sect2"><a href="Bv9ARM.ch09.html#relnotes_thanks">Thank You</a></span></dt>
 </dl></dd>
 <dt><span class="sect1"><a href="Bv9ARM.ch09.html#id2606667">Acknowledgments</a></span></dt>
@@ -262,13 +262,13 @@
 </dl></dd>
 <dt><span class="sect1"><a href="Bv9ARM.ch09.html#bind9.library">BIND 9 DNS Library Support</a></span></dt>
 <dd><dl>
-<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2611822">Prerequisite</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2611832">Compilation</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2611857">Installation</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2611956">Known Defects/Restrictions</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2612033">The dns.conf File</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2612059">Sample Applications</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2613305">Library References</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2612037">Prerequisite</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2612046">Compilation</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2612071">Installation</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2612307">Known Defects/Restrictions</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2612384">The dns.conf File</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2612410">Sample Applications</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2613520">Library References</a></span></dt>
 </dl></dd>
 </dl></dd>
 <dt><span class="reference"><a href="Bv9ARM.ch10.html">I. Manual pages</a></span></dt>
@@ -50,20 +50,20 @@
 <div class="cmdsynopsis"><p><code class="command">arpaname</code>  {<em class="replaceable"><code>ipaddress </code></em>...}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2622986"></a><h2>DESCRIPTION</h2>
+<a name="id2623337"></a><h2>DESCRIPTION</h2>
 <p>
      <span><strong class="command">arpaname</strong></span> translates IP addresses (IPv4 and
      IPv6) to the corresponding IN-ADDR.ARPA or IP6.ARPA names.
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2623001"></a><h2>SEE ALSO</h2>
+<a name="id2664380"></a><h2>SEE ALSO</h2>
 <p>
      <em class="citetitle">BIND 9 Administrator Reference Manual</em>.
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2664589"></a><h2>AUTHOR</h2>
+<a name="id2664394"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
    </p>
 </div>
@@ -51,7 +51,7 @@
 <div class="cmdsynopsis"><p><code class="command">ddns-confgen</code>  [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-h</code>] [<code class="option">-k <em class="replaceable"><code>keyname</code></em></code>] [<code class="option">-q</code>] [<code class="option">-r <em class="replaceable"><code>randomfile</code></em></code>] [ -s <em class="replaceable"><code>name</code></em>  |   -z <em class="replaceable"><code>zone</code></em> ]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2661418"></a><h2>DESCRIPTION</h2>
+<a name="id2662588"></a><h2>DESCRIPTION</h2>
 <p>
      <span><strong class="command">tsig-keygen</strong></span> and <span><strong class="command">ddns-confgen</strong></span>
      are invocation methods for a utility that generates keys for use
@@ -87,7 +87,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2661931"></a><h2>OPTIONS</h2>
+<a name="id2662692"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
 <dd><p>
@@ -159,7 +159,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2662148"></a><h2>SEE ALSO</h2>
+<a name="id2663932"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">nsupdate</span>(1)</span>,
      <span class="citerefentry"><span class="refentrytitle">named.conf</span>(5)</span>,
      <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
@@ -167,7 +167,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2662186"></a><h2>AUTHOR</h2>
+<a name="id2664312"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
    </p>
 </div>
@@ -53,7 +53,7 @@
 <div class="cmdsynopsis"><p><code class="command">delv</code>  [queryopt...] [query...]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2614965"></a><h2>DESCRIPTION</h2>
+<a name="id2615794"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">delv</strong></span>
      (Domain Entity Lookup &amp; Validation) is a tool for sending
      DNS queries and validating the results, using the the same internal
@@ -96,7 +96,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2615037"></a><h2>SIMPLE USAGE</h2>
+<a name="id2615934"></a><h2>SIMPLE USAGE</h2>
 <p>
      A typical invocation of <span><strong class="command">delv</strong></span> looks like:
      </p>
@@ -151,7 +151,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2615578"></a><h2>OPTIONS</h2>
+<a name="id2616202"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-a <em class="replaceable"><code>anchor-file</code></em></span></dt>
 <dd>
@@ -285,7 +285,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2671014"></a><h2>QUERY OPTIONS</h2>
+<a name="id2671297"></a><h2>QUERY OPTIONS</h2>
 <p><span><strong class="command">delv</strong></span>
      provides a number of query options which affect the way results are
      displayed, and in some cases the way lookups are performed.
@@ -465,12 +465,12 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2671598"></a><h2>FILES</h2>
+<a name="id2671813"></a><h2>FILES</h2>
 <p><code class="filename">/etc/bind.keys</code></p>
 <p><code class="filename">/etc/resolv.conf</code></p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2671618"></a><h2>SEE ALSO</h2>
+<a name="id2671832"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">dig</span>(1)</span>,
      <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
      <em class="citetitle">RFC4034</em>,
@@ -52,7 +52,7 @@
 <div class="cmdsynopsis"><p><code class="command">dig</code>  [global-queryopt...] [query...]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2613090"></a><h2>DESCRIPTION</h2>
+<a name="id2613918"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dig</strong></span>
      (domain information groper) is a flexible tool
      for interrogating DNS name servers.  It performs DNS lookups and
@@ -99,7 +99,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2613533"></a><h2>SIMPLE USAGE</h2>
+<a name="id2614021"></a><h2>SIMPLE USAGE</h2>
 <p>
      A typical invocation of <span><strong class="command">dig</strong></span> looks like:
      </p>
@@ -152,7 +152,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2613659"></a><h2>OPTIONS</h2>
+<a name="id2614147"></a><h2>OPTIONS</h2>
 <p>
      The <code class="option">-b</code> option sets the source IP address of the query
      to <em class="parameter"><code>address</code></em>.  This must be a valid
@@ -260,7 +260,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2666102"></a><h2>QUERY OPTIONS</h2>
+<a name="id2666248"></a><h2>QUERY OPTIONS</h2>
 <p><span><strong class="command">dig</strong></span>
      provides a number of query options which affect
      the way in which lookups are made and the results displayed.  Some of
@@ -646,7 +646,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2667415"></a><h2>MULTIPLE QUERIES</h2>
+<a name="id2667356"></a><h2>MULTIPLE QUERIES</h2>
 <p>
      The BIND 9 implementation of <span><strong class="command">dig </strong></span>
      supports
@@ -692,7 +692,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2667500"></a><h2>IDN SUPPORT</h2>
+<a name="id2667442"></a><h2>IDN SUPPORT</h2>
 <p>
      If <span><strong class="command">dig</strong></span> has been built with IDN (internationalized
      domain name) support, it can accept and display non-ASCII domain names.
@@ -706,14 +706,14 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2667529"></a><h2>FILES</h2>
+<a name="id2667539"></a><h2>FILES</h2>
 <p><code class="filename">/etc/resolv.conf</code>
    </p>
 <p><code class="filename">${HOME}/.digrc</code>
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2667550"></a><h2>SEE ALSO</h2>
+<a name="id2667560"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">host</span>(1)</span>,
      <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
      <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
@@ -721,7 +721,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2667588"></a><h2>BUGS</h2>
+<a name="id2667666"></a><h2>BUGS</h2>
 <p>
      There are probably too many query options.
    </p>
@@ -51,7 +51,7 @@
 <div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code>  [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-f <em class="replaceable"><code>file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>dig path</code></em></code>] [<code class="option">-D <em class="replaceable"><code>dsfromkey path</code></em></code>] {zone}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2616126"></a><h2>DESCRIPTION</h2>
+<a name="id2617024"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dnssec-checkds</strong></span>
      verifies the correctness of Delegation Signer (DS) or DNSSEC
      Lookaside Validation (DLV) resource records for keys in a specified
@@ -59,7 +59,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2616140"></a><h2>OPTIONS</h2>
+<a name="id2617037"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-f <em class="replaceable"><code>file</code></em></span></dt>
 <dd><p>
@@ -88,14 +88,14 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2616243"></a><h2>SEE ALSO</h2>
+<a name="id2617140"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">dnssec-dsfromkey</span>(8)</span>,
      <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
      <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2616277"></a><h2>AUTHOR</h2>
+<a name="id2617174"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
    </p>
 </div>
@@ -50,7 +50,7 @@
 <div class="cmdsynopsis"><p><code class="command">dnssec-coverage</code>  [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-l <em class="replaceable"><code>length</code></em></code>] [<code class="option">-f <em class="replaceable"><code>file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>DNSKEY TTL</code></em></code>] [<code class="option">-m <em class="replaceable"><code>max TTL</code></em></code>] [<code class="option">-r <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-c <em class="replaceable"><code>compilezone path</code></em></code>] [<code class="option">-k</code>] [<code class="option">-z</code>] [zone]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2616420"></a><h2>DESCRIPTION</h2>
+<a name="id2617317"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dnssec-coverage</strong></span>
      verifies that the DNSSEC keys for a given zone or a set of zones
      have timing metadata set properly to ensure no future lapses in DNSSEC
@@ -78,7 +78,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2616446"></a><h2>OPTIONS</h2>
+<a name="id2617344"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
 <dd><p>
@@ -192,7 +192,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2617302"></a><h2>SEE ALSO</h2>
+<a name="id2617721"></a><h2>SEE ALSO</h2>
 <p>
      <span class="citerefentry"><span class="refentrytitle">dnssec-checkds</span>(8)</span>,
      <span class="citerefentry"><span class="refentrytitle">dnssec-dsfromkey</span>(8)</span>,
@@ -201,7 +201,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2617346"></a><h2>AUTHOR</h2>
+<a name="id2617765"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
    </p>
 </div>
@@ -52,14 +52,14 @@
 <div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code>  [<code class="option">-h</code>] [<code class="option">-V</code>]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2618283"></a><h2>DESCRIPTION</h2>
+<a name="id2618225"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dnssec-dsfromkey</strong></span>
      outputs the Delegation Signer (DS) resource record (RR), as defined in
      RFC 3658 and RFC 4509, for the given key(s).
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2618297"></a><h2>OPTIONS</h2>
+<a name="id2618443"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-1</span></dt>
 <dd><p>
@@ -144,7 +144,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2618560"></a><h2>EXAMPLE</h2>
+<a name="id2615156"></a><h2>EXAMPLE</h2>
 <p>
      To build the SHA-256 DS RR from the
      <strong class="userinput"><code>Kexample.com.+003+26160</code></strong>
@@ -159,7 +159,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2618596"></a><h2>FILES</h2>
+<a name="id2618742"></a><h2>FILES</h2>
 <p>
      The keyfile can be designed by the key identification
      <code class="filename">Knnnn.+aaa+iiiii</code> or the full file name
@@ -173,13 +173,13 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2618637"></a><h2>CAVEAT</h2>
+<a name="id2618852"></a><h2>CAVEAT</h2>
 <p>
      A keyfile error can give a "file not found" even if the file exists.
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2619671"></a><h2>SEE ALSO</h2>
+<a name="id2618861"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
      <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
      <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
@@ -189,7 +189,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2619710"></a><h2>AUTHOR</h2>
+<a name="id2618901"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
    </p>
 </div>
@@ -51,7 +51,7 @@
 <div class="cmdsynopsis"><p><code class="command">dnssec-importkey</code>  {<code class="option">-f <em class="replaceable"><code>filename</code></em></code>} [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-h</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] [<code class="option">dnsname</code>]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2618987"></a><h2>DESCRIPTION</h2>
+<a name="id2619065"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dnssec-importkey</strong></span>
      reads a public DNSKEY record and generates a pair of
      .key/.private files.  The DNSKEY record may be read from an
@@ -71,7 +71,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2619015"></a><h2>OPTIONS</h2>
+<a name="id2619093"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-f <em class="replaceable"><code>filename</code></em></span></dt>
 <dd>
@@ -114,7 +114,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2619153"></a><h2>TIMING OPTIONS</h2>
+<a name="id2619230"></a><h2>TIMING OPTIONS</h2>
 <p>
      Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
      If the argument begins with a '+' or '-', it is interpreted as
@@ -142,7 +142,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2619746"></a><h2>FILES</h2>
+<a name="id2619277"></a><h2>FILES</h2>
 <p>
      A keyfile can be designed by the key identification
      <code class="filename">Knnnn.+aaa+iiiii</code> or the full file name
@@ -151,7 +151,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2619771"></a><h2>SEE ALSO</h2>
+<a name="id2619303"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
      <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
      <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
@@ -159,7 +159,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2619804"></a><h2>AUTHOR</h2>
+<a name="id2619404"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
    </p>
 </div>
@@ -50,7 +50,7 @@
 <div class="cmdsynopsis"><p><code class="command">dnssec-keyfromlabel</code>  {-l <em class="replaceable"><code>label</code></em>} [<code class="option">-3</code>] [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-G</code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-k</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-S <em class="replaceable"><code>key</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] [<code class="option">-y</code>] {name}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2620136"></a><h2>DESCRIPTION</h2>
+<a name="id2619873"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dnssec-keyfromlabel</strong></span>
      generates a key pair of files that referencing a key object stored
      in a cryptographic hardware service module (HSM).  The private key
@@ -66,7 +66,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2620298"></a><h2>OPTIONS</h2>
+<a name="id2619898"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
 <dd>
@@ -243,7 +243,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2672922"></a><h2>TIMING OPTIONS</h2>
+<a name="id2671908"></a><h2>TIMING OPTIONS</h2>
 <p>
      Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
      If the argument begins with a '+' or '-', it is interpreted as
@@ -315,7 +315,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2673112"></a><h2>GENERATED KEY FILES</h2>
+<a name="id2672166"></a><h2>GENERATED KEY FILES</h2>
 <p>
      When <span><strong class="command">dnssec-keyfromlabel</strong></span> completes
      successfully,
@@ -354,7 +354,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2673342"></a><h2>SEE ALSO</h2>
+<a name="id2672260"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
      <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
      <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
@@ -363,7 +363,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2673380"></a><h2>AUTHOR</h2>
+<a name="id2672297"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
    </p>
 </div>
@@ -50,7 +50,7 @@
 <div class="cmdsynopsis"><p><code class="command">dnssec-keygen</code>  [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-b <em class="replaceable"><code>keysize</code></em></code>] [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>] [<code class="option">-3</code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-C</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-G</code>] [<code class="option">-g <em class="replaceable"><code>generator</code></em></code>] [<code class="option">-h</code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-k</code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-q</code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-S <em class="replaceable"><code>key</code></em></code>] [<code class="option">-s <em class="replaceable"><code>strength</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] [<code class="option">-z</code>] {name}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2621589"></a><h2>DESCRIPTION</h2>
+<a name="id2621462"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dnssec-keygen</strong></span>
      generates keys for DNSSEC (Secure DNS), as defined in RFC 2535
      and RFC 4034.  It can also generate keys for use with
@@ -64,7 +64,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2621609"></a><h2>OPTIONS</h2>
+<a name="id2621482"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
 <dd>
@@ -285,7 +285,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2673834"></a><h2>TIMING OPTIONS</h2>
+<a name="id2672956"></a><h2>TIMING OPTIONS</h2>
 <p>
      Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
      If the argument begins with a '+' or '-', it is interpreted as
@@ -359,7 +359,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2674024"></a><h2>GENERATED KEYS</h2>
+<a name="id2673078"></a><h2>GENERATED KEYS</h2>
 <p>
      When <span><strong class="command">dnssec-keygen</strong></span> completes
      successfully,
@@ -405,7 +405,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2674132"></a><h2>EXAMPLE</h2>
+<a name="id2673254"></a><h2>EXAMPLE</h2>
 <p>
      To generate a 768-bit DSA key for the domain
      <strong class="userinput"><code>example.com</code></strong>, the following command would be
@@ -426,7 +426,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2674257"></a><h2>SEE ALSO</h2>
+<a name="id2673310"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
      <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
      <em class="citetitle">RFC 2539</em>,
@@ -435,7 +435,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2674288"></a><h2>AUTHOR</h2>
+<a name="id2673410"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
    </p>
 </div>
@@ -50,7 +50,7 @@
 <div class="cmdsynopsis"><p><code class="command">dnssec-revoke</code>  [<code class="option">-hr</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-f</code>] [<code class="option">-R</code>] {keyfile}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2622523"></a><h2>DESCRIPTION</h2>
+<a name="id2621850"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dnssec-revoke</strong></span>
      reads a DNSSEC key file, sets the REVOKED bit on the key as defined
      in RFC 5011, and creates a new pair of key files containing the
@@ -58,7 +58,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2622537"></a><h2>OPTIONS</h2>
+<a name="id2621864"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-h</span></dt>
 <dd><p>
@@ -109,14 +109,14 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2623562"></a><h2>SEE ALSO</h2>
+<a name="id2622070"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
      <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
      <em class="citetitle">RFC 5011</em>.
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2623587"></a><h2>AUTHOR</h2>
+<a name="id2622094"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
    </p>
 </div>
@@ -50,7 +50,7 @@
 <div class="cmdsynopsis"><p><code class="command">dnssec-settime</code>  [<code class="option">-f</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-h</code>] [<code class="option">-V</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] {keyfile}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2625404"></a><h2>DESCRIPTION</h2>
+<a name="id2622205"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dnssec-settime</strong></span>
      reads a DNSSEC private key file and sets the key timing metadata
      as specified by the <code class="option">-P</code>, <code class="option">-A</code>,
@@ -76,7 +76,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2625463"></a><h2>OPTIONS</h2>
+<a name="id2622264"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-f</span></dt>
 <dd><p>
@@ -131,7 +131,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2635842"></a><h2>TIMING OPTIONS</h2>
+<a name="id2623700"></a><h2>TIMING OPTIONS</h2>
 <p>
      Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
      If the argument begins with a '+' or '-', it is interpreted as
@@ -210,7 +210,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2636117"></a><h2>PRINTING OPTIONS</h2>
+<a name="id2636400"></a><h2>PRINTING OPTIONS</h2>
 <p>
      <span><strong class="command">dnssec-settime</strong></span> can also be used to print the
      timing metadata associated with a key.
@@ -236,7 +236,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2642750"></a><h2>SEE ALSO</h2>
+<a name="id2636480"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
      <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
      <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
@@ -244,7 +244,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2642784"></a><h2>AUTHOR</h2>
+<a name="id2636513"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
    </p>
 </div>
@@ -50,7 +50,7 @@
 <div class="cmdsynopsis"><p><code class="command">dnssec-signzone</code>  [<code class="option">-a</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-d <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-D</code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-e <em class="replaceable"><code>end-time</code></em></code>] [<code class="option">-f <em class="replaceable"><code>output-file</code></em></code>] [<code class="option">-g</code>] [<code class="option">-h</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-k <em class="replaceable"><code>key</code></em></code>] [<code class="option">-L <em class="replaceable"><code>serial</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-M <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-I <em class="replaceable"><code>input-format</code></em></code>] [<code class="option">-j <em class="replaceable"><code>jitter</code></em></code>] [<code class="option">-N <em class="replaceable"><code>soa-serial-format</code></em></code>] [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>] [<code class="option">-O <em class="replaceable"><code>output-format</code></em></code>] [<code class="option">-P</code>] [<code class="option">-p</code>] [<code class="option">-R</code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-S</code>] [<code class="option">-s <em class="replaceable"><code>start-time</code></em></code>] [<code class="option">-T <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-t</code>] [<code class="option">-u</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] [<code class="option">-X <em class="replaceable"><code>extended end-time</code></em></code>] [<code class="option">-x</code>] [<code class="option">-z</code>] [<code class="option">-3 <em class="replaceable"><code>salt</code></em></code>] [<code class="option">-H <em class="replaceable"><code>iterations</code></em></code>] [<code class="option">-A</code>] {zonefile} [key...]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2642065"></a><h2>DESCRIPTION</h2>
+<a name="id2642142"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dnssec-signzone</strong></span>
      signs a zone.  It generates
      NSEC and RRSIG records and produces a signed version of the
@@ -61,7 +61,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2642084"></a><h2>OPTIONS</h2>
+<a name="id2642162"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-a</span></dt>
 <dd><p>
@@ -509,7 +509,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2675624"></a><h2>EXAMPLE</h2>
+<a name="id2674814"></a><h2>EXAMPLE</h2>
 <p>
      The following command signs the <strong class="userinput"><code>example.com</code></strong>
      zone with the DSA key generated by <span><strong class="command">dnssec-keygen</strong></span>
@@ -539,14 +539,14 @@ db.example.com.signed
 %</pre>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2675703"></a><h2>SEE ALSO</h2>
+<a name="id2674962"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
      <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
      <em class="citetitle">RFC 4033</em>, <em class="citetitle">RFC 4641</em>.
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2675731"></a><h2>AUTHOR</h2>
+<a name="id2674989"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
    </p>
 </div>
@@ -50,7 +50,7 @@
 <div class="cmdsynopsis"><p><code class="command">dnssec-verify</code>  [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-I <em class="replaceable"><code>input-format</code></em></code>] [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] [<code class="option">-x</code>] [<code class="option">-z</code>] {zonefile}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2642848"></a><h2>DESCRIPTION</h2>
+<a name="id2636030"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dnssec-verify</strong></span>
      verifies that a zone is fully signed for each algorithm found
      in the DNSKEY RRset for the zone, and that the NSEC / NSEC3
@@ -58,7 +58,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2642861"></a><h2>OPTIONS</h2>
+<a name="id2636044"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
 <dd><p>
@@ -138,7 +138,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2643045"></a><h2>SEE ALSO</h2>
+<a name="id2642645"></a><h2>SEE ALSO</h2>
 <p>
      <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
      <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
@@ -146,7 +146,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2643070"></a><h2>AUTHOR</h2>
+<a name="id2642670"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
    </p>
 </div>
@@ -50,7 +50,7 @@
 <div class="cmdsynopsis"><p><code class="command">genrandom</code>  [<code class="option">-n <em class="replaceable"><code>number</code></em></code>] {<em class="replaceable"><code>size</code></em>} {<em class="replaceable"><code>filename</code></em>}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2665301"></a><h2>DESCRIPTION</h2>
+<a name="id2624009"></a><h2>DESCRIPTION</h2>
 <p>
      <span><strong class="command">genrandom</strong></span>
      generates a file or a set of files containing a specified quantity
@@ -59,7 +59,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2665316"></a><h2>ARGUMENTS</h2>
+<a name="id2624024"></a><h2>ARGUMENTS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-n <em class="replaceable"><code>number</code></em></span></dt>
 <dd><p>
@@ -77,14 +77,14 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2665377"></a><h2>SEE ALSO</h2>
+<a name="id2665454"></a><h2>SEE ALSO</h2>
 <p>
      <span class="citerefentry"><span class="refentrytitle">rand</span>(3)</span>,
      <span class="citerefentry"><span class="refentrytitle">arc4random</span>(3)</span>
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2665472"></a><h2>AUTHOR</h2>
+<a name="id2665481"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
    </p>
 </div>
@@ -50,7 +50,7 @@
 <div class="cmdsynopsis"><p><code class="command">host</code>  [<code class="option">-aCdlnrsTwv</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-N <em class="replaceable"><code>ndots</code></em></code>] [<code class="option">-R <em class="replaceable"><code>number</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-W <em class="replaceable"><code>wait</code></em></code>] [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-4</code>] [<code class="option">-6</code>] [<code class="option">-v</code>] [<code class="option">-V</code>] {name} [server]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2613940"></a><h2>DESCRIPTION</h2>
+<a name="id2614427"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">host</strong></span>
      is a simple utility for performing DNS lookups.
      It is normally used to convert names to IP addresses and vice versa.
@@ -206,7 +206,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2614535"></a><h2>IDN SUPPORT</h2>
+<a name="id2615022"></a><h2>IDN SUPPORT</h2>
 <p>
      If <span><strong class="command">host</strong></span> has been built with IDN (internationalized
      domain name) support, it can accept and display non-ASCII domain names. 
@@ -220,12 +220,12 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2616680"></a><h2>FILES</h2>
+<a name="id2615051"></a><h2>FILES</h2>
 <p><code class="filename">/etc/resolv.conf</code>
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2616694"></a><h2>SEE ALSO</h2>
+<a name="id2615065"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">dig</span>(1)</span>,
      <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>.
    </p>
@@ -50,7 +50,7 @@
 <div class="cmdsynopsis"><p><code class="command">isc-hmac-fixup</code>  {<em class="replaceable"><code>algorithm</code></em>} {<em class="replaceable"><code>secret</code></em>}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2623271"></a><h2>DESCRIPTION</h2>
+<a name="id2624373"></a><h2>DESCRIPTION</h2>
 <p>
      Versions of BIND 9 up to and including BIND 9.6 had a bug causing
      HMAC-SHA* TSIG keys which were longer than the digest length of the
@@ -76,7 +76,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2667672"></a><h2>SECURITY CONSIDERATIONS</h2>
+<a name="id2665565"></a><h2>SECURITY CONSIDERATIONS</h2>
 <p>
      Secrets that have been converted by <span><strong class="command">isc-hmac-fixup</strong></span>
      are shortened, but as this is how the HMAC protocol works in
@@ -87,14 +87,14 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2667688"></a><h2>SEE ALSO</h2>
+<a name="id2665581"></a><h2>SEE ALSO</h2>
 <p>
      <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
      <em class="citetitle">RFC 2104</em>.
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2667705"></a><h2>AUTHOR</h2>
+<a name="id2665598"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
    </p>
 </div>
@@ -50,7 +50,7 @@
 <div class="cmdsynopsis"><p><code class="command">named-checkconf</code>  [<code class="option">-h</code>] [<code class="option">-v</code>] [<code class="option">-j</code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] {filename} [<code class="option">-p</code>] [<code class="option">-x</code>] [<code class="option">-z</code>]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2643238"></a><h2>DESCRIPTION</h2>
+<a name="id2643111"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">named-checkconf</strong></span>
      checks the syntax, but not the semantics, of a
      <span><strong class="command">named</strong></span> configuration file.  The file is parsed
@@ -70,7 +70,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2643308"></a><h2>OPTIONS</h2>
+<a name="id2643250"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-h</span></dt>
 <dd><p>
@@ -119,21 +119,21 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2643601"></a><h2>RETURN VALUES</h2>
+<a name="id2643474"></a><h2>RETURN VALUES</h2>
 <p><span><strong class="command">named-checkconf</strong></span>
      returns an exit status of 1 if
      errors were detected and 0 otherwise.
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2643614"></a><h2>SEE ALSO</h2>
+<a name="id2643488"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
      <span class="citerefentry"><span class="refentrytitle">named-checkzone</span>(8)</span>,
      <em class="citetitle">BIND 9 Administrator Reference Manual</em>.
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2643644"></a><h2>AUTHOR</h2>
+<a name="id2643517"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
    </p>
 </div>
@@ -51,7 +51,7 @@
 <div class="cmdsynopsis"><p><code class="command">named-compilezone</code>  [<code class="option">-d</code>] [<code class="option">-j</code>] [<code class="option">-q</code>] [<code class="option">-v</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-C <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-f <em class="replaceable"><code>format</code></em></code>] [<code class="option">-F <em class="replaceable"><code>format</code></em></code>] [<code class="option">-J <em class="replaceable"><code>filename</code></em></code>] [<code class="option">-i <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-k <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-m <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-n <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-l <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-L <em class="replaceable"><code>serial</code></em></code>] [<code class="option">-r <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-s <em class="replaceable"><code>style</code></em></code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-T <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-w <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-D</code>] [<code class="option">-W <em class="replaceable"><code>mode</code></em></code>] {<code class="option">-o <em class="replaceable"><code>filename</code></em></code>} {zonename} {filename}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2678990"></a><h2>DESCRIPTION</h2>
+<a name="id2675860"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">named-checkzone</strong></span>
      checks the syntax and integrity of a zone file.  It performs the
      same checks as <span><strong class="command">named</strong></span> does when loading a
@@ -71,7 +71,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2679041"></a><h2>OPTIONS</h2>
+<a name="id2675910"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-d</span></dt>
 <dd><p>
@@ -305,14 +305,14 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2680010"></a><h2>RETURN VALUES</h2>
+<a name="id2676948"></a><h2>RETURN VALUES</h2>
 <p><span><strong class="command">named-checkzone</strong></span>
      returns an exit status of 1 if
      errors were detected and 0 otherwise.
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2680024"></a><h2>SEE ALSO</h2>
+<a name="id2676962"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
      <span class="citerefentry"><span class="refentrytitle">named-checkconf</span>(8)</span>,
      <em class="citetitle">RFC 1035</em>,
@@ -320,7 +320,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2680057"></a><h2>AUTHOR</h2>
+<a name="id2676995"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
    </p>
 </div>
@@ -50,7 +50,7 @@
 <div class="cmdsynopsis"><p><code class="command">named-journalprint</code>  {<em class="replaceable"><code>journal</code></em>}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2620602"></a><h2>DESCRIPTION</h2>
+<a name="id2621704"></a><h2>DESCRIPTION</h2>
 <p>
      <span><strong class="command">named-journalprint</strong></span>
      prints the contents of a zone journal file in a human-readable
@@ -76,7 +76,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2651573"></a><h2>SEE ALSO</h2>
+<a name="id2645848"></a><h2>SEE ALSO</h2>
 <p>
      <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
      <span class="citerefentry"><span class="refentrytitle">nsupdate</span>(8)</span>,
@@ -84,7 +84,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2651604"></a><h2>AUTHOR</h2>
+<a name="id2645879"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
    </p>
 </div>
@@ -50,7 +50,7 @@
 <div class="cmdsynopsis"><p><code class="command">named-rrchecker</code>  [<code class="option">-h</code>] [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>] [<code class="option">-p</code>] [<code class="option">-u</code>] [<code class="option">-C</code>] [<code class="option">-T</code>] [<code class="option">-P</code>]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2652759"></a><h2>DESCRIPTION</h2>
+<a name="id2622458"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">named-rrchecker</strong></span>
     read a individual DNS resource record from standard input and checks if it
     is syntactically correct.
@@ -78,7 +78,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2652816"></a><h2>SEE ALSO</h2>
+<a name="id2646135"></a><h2>SEE ALSO</h2>
 <p>
      <em class="citetitle">RFC 1034</em>,
      <em class="citetitle">RFC 1035</em>,
@@ -50,7 +50,7 @@
 <div class="cmdsynopsis"><p><code class="command">named</code>  [<code class="option">-4</code>] [<code class="option">-6</code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>debug-level</code></em></code>] [<code class="option">-D <em class="replaceable"><code>string</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine-name</code></em></code>] [<code class="option">-f</code>] [<code class="option">-g</code>] [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-n <em class="replaceable"><code>#cpus</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-s</code>] [<code class="option">-S <em class="replaceable"><code>#max-socks</code></em></code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-U <em class="replaceable"><code>#listeners</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>] [<code class="option">-v</code>] [<code class="option">-V</code>] [<code class="option">-x <em class="replaceable"><code>cache-file</code></em></code>]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2646605"></a><h2>DESCRIPTION</h2>
+<a name="id2644908"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">named</strong></span>
      is a Domain Name System (DNS) server,
      part of the BIND 9 distribution from ISC.  For more
@@ -65,7 +65,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2646636"></a><h2>OPTIONS</h2>
+<a name="id2644939"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-4</span></dt>
 <dd><p>
@@ -276,7 +276,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2680156"></a><h2>SIGNALS</h2>
+<a name="id2677162"></a><h2>SIGNALS</h2>
 <p>
      In routine operation, signals should not be used to control
      the nameserver; <span><strong class="command">rndc</strong></span> should be used
@@ -297,7 +297,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2680206"></a><h2>CONFIGURATION</h2>
+<a name="id2677212"></a><h2>CONFIGURATION</h2>
 <p>
      The <span><strong class="command">named</strong></span> configuration file is too complex
      to describe in detail here.  A complete description is provided
@@ -314,7 +314,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2680256"></a><h2>FILES</h2>
+<a name="id2677261"></a><h2>FILES</h2>
 <div class="variablelist"><dl>
 <dt><span class="term"><code class="filename">/etc/named.conf</code></span></dt>
 <dd><p>
@@ -327,7 +327,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2680368"></a><h2>SEE ALSO</h2>
+<a name="id2677305"></a><h2>SEE ALSO</h2>
 <p><em class="citetitle">RFC 1033</em>,
      <em class="citetitle">RFC 1034</em>,
      <em class="citetitle">RFC 1035</em>,
@@ -340,7 +340,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2680438"></a><h2>AUTHOR</h2>
+<a name="id2677376"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
    </p>
 </div>
@@ -48,7 +48,7 @@
 <div class="cmdsynopsis"><p><code class="command">nsec3hash</code>  {<em class="replaceable"><code>salt</code></em>} {<em class="replaceable"><code>algorithm</code></em>} {<em class="replaceable"><code>iterations</code></em>} {<em class="replaceable"><code>domain</code></em>}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2667750"></a><h2>DESCRIPTION</h2>
+<a name="id2667760"></a><h2>DESCRIPTION</h2>
 <p>
      <span><strong class="command">nsec3hash</strong></span> generates an NSEC3 hash based on
      a set of NSEC3 parameters.  This can be used to check the validity
@@ -56,7 +56,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2667765"></a><h2>ARGUMENTS</h2>
+<a name="id2667774"></a><h2>ARGUMENTS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">salt</span></dt>
 <dd><p>
@@ -80,14 +80,14 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2667827"></a><h2>SEE ALSO</h2>
+<a name="id2667836"></a><h2>SEE ALSO</h2>
 <p>
      <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
      <em class="citetitle">RFC 5155</em>.
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2667844"></a><h2>AUTHOR</h2>
+<a name="id2667853"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
    </p>
 </div>
@@ -50,7 +50,7 @@
 <div class="cmdsynopsis"><p><code class="command">nsupdate</code>  [<code class="option">-d</code>] [<code class="option">-D</code>] [[<code class="option">-g</code>] |  [<code class="option">-o</code>] |  [<code class="option">-l</code>] |  [<code class="option">-y <em class="replaceable"><code>[<span class="optional">hmac:</span>]keyname:secret</code></em></code>] |  [<code class="option">-k <em class="replaceable"><code>keyfile</code></em></code>]] [<code class="option">-t <em class="replaceable"><code>timeout</code></em></code>] [<code class="option">-u <em class="replaceable"><code>udptimeout</code></em></code>] [<code class="option">-r <em class="replaceable"><code>udpretries</code></em></code>] [<code class="option">-R <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-v</code>] [<code class="option">-T</code>] [<code class="option">-P</code>] [<code class="option">-V</code>] [filename]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2653244"></a><h2>DESCRIPTION</h2>
+<a name="id2652913"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">nsupdate</strong></span>
      is used to submit Dynamic DNS Update requests as defined in RFC 2136
      to a name server.
@@ -236,7 +236,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2683027"></a><h2>INPUT FORMAT</h2>
+<a name="id2677507"></a><h2>INPUT FORMAT</h2>
 <p><span><strong class="command">nsupdate</strong></span>
      reads input from
      <em class="parameter"><code>filename</code></em>
@@ -538,7 +538,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2684080"></a><h2>EXAMPLES</h2>
+<a name="id2678628"></a><h2>EXAMPLES</h2>
 <p>
      The examples below show how
      <span><strong class="command">nsupdate</strong></span>
@@ -592,7 +592,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2684198"></a><h2>FILES</h2>
+<a name="id2678746"></a><h2>FILES</h2>
 <div class="variablelist"><dl>
 <dt><span class="term"><code class="constant">/etc/resolv.conf</code></span></dt>
 <dd><p>
@@ -615,7 +615,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2684281"></a><h2>SEE ALSO</h2>
+<a name="id2678829"></a><h2>SEE ALSO</h2>
 <p>
      <em class="citetitle">RFC 2136</em>,
      <em class="citetitle">RFC 3007</em>,
@@ -630,7 +630,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2684339"></a><h2>BUGS</h2>
+<a name="id2678887"></a><h2>BUGS</h2>
 <p>
      The TSIG key is redundantly stored in two separate files.
      This is a consequence of nsupdate using the DST library
@@ -50,7 +50,7 @@
 <div class="cmdsynopsis"><p><code class="command">rndc-confgen</code>  [<code class="option">-a</code>] [<code class="option">-A <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-b <em class="replaceable"><code>keysize</code></em></code>] [<code class="option">-c <em class="replaceable"><code>keyfile</code></em></code>] [<code class="option">-h</code>] [<code class="option">-k <em class="replaceable"><code>keyname</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-r <em class="replaceable"><code>randomfile</code></em></code>] [<code class="option">-s <em class="replaceable"><code>address</code></em></code>] [<code class="option">-t <em class="replaceable"><code>chrootdir</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2660101"></a><h2>DESCRIPTION</h2>
+<a name="id2660384"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">rndc-confgen</strong></span>
      generates configuration files
      for <span><strong class="command">rndc</strong></span>.  It can be used as a
@@ -66,7 +66,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2660304"></a><h2>OPTIONS</h2>
+<a name="id2661815"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-a</span></dt>
 <dd>
@@ -180,7 +180,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2664052"></a><h2>EXAMPLES</h2>
+<a name="id2662218"></a><h2>EXAMPLES</h2>
 <p>
      To allow <span><strong class="command">rndc</strong></span> to be used with
      no manual configuration, run
@@ -197,7 +197,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2664518"></a><h2>SEE ALSO</h2>
+<a name="id2665142"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>,
      <span class="citerefentry"><span class="refentrytitle">rndc.conf</span>(5)</span>,
      <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
@@ -205,7 +205,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2664556"></a><h2>AUTHOR</h2>
+<a name="id2665180"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
    </p>
 </div>
@@ -50,7 +50,7 @@
 <div class="cmdsynopsis"><p><code class="command">rndc.conf</code> </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2622086"></a><h2>DESCRIPTION</h2>
+<a name="id2623051"></a><h2>DESCRIPTION</h2>
 <p><code class="filename">rndc.conf</code> is the configuration file
      for <span><strong class="command">rndc</strong></span>, the BIND 9 name server control
      utility.  This file has a similar structure and syntax to
@@ -136,7 +136,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2655435"></a><h2>EXAMPLE</h2>
+<a name="id2654899"></a><h2>EXAMPLE</h2>
 <pre class="programlisting">
      options {
        default-server  localhost;
@@ -210,7 +210,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2659516"></a><h2>NAME SERVER CONFIGURATION</h2>
+<a name="id2659048"></a><h2>NAME SERVER CONFIGURATION</h2>
 <p>
      The name server must be configured to accept rndc connections and
      to recognize the key specified in the <code class="filename">rndc.conf</code>
@@ -220,7 +220,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2659542"></a><h2>SEE ALSO</h2>
+<a name="id2659074"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>,
      <span class="citerefentry"><span class="refentrytitle">rndc-confgen</span>(8)</span>,
      <span class="citerefentry"><span class="refentrytitle">mmencode</span>(1)</span>,
@@ -228,7 +228,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2659580"></a><h2>AUTHOR</h2>
+<a name="id2659112"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
    </p>
 </div>
@@ -50,7 +50,7 @@
 <div class="cmdsynopsis"><p><code class="command">rndc</code>  [<code class="option">-b <em class="replaceable"><code>source-address</code></em></code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-k <em class="replaceable"><code>key-file</code></em></code>] [<code class="option">-s <em class="replaceable"><code>server</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-q</code>] [<code class="option">-V</code>] [<code class="option">-y <em class="replaceable"><code>key_id</code></em></code>] {command}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2654554"></a><h2>DESCRIPTION</h2>
+<a name="id2653813"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">rndc</strong></span>
      controls the operation of a name
      server.  It supersedes the <span><strong class="command">ndc</strong></span> utility
@@ -81,7 +81,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2654604"></a><h2>OPTIONS</h2>
+<a name="id2653863"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-b <em class="replaceable"><code>source-address</code></em></span></dt>
 <dd><p>
@@ -152,7 +152,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2655099"></a><h2>COMMANDS</h2>
+<a name="id2661458"></a><h2>COMMANDS</h2>
 <p>
      A list of commands supported by <span><strong class="command">rndc</strong></span> can
      be seen by running <span><strong class="command">rndc</strong></span> without arguments.
@@ -537,7 +537,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2687006"></a><h2>LIMITATIONS</h2>
+<a name="id2687426"></a><h2>LIMITATIONS</h2>
 <p>
      There is currently no way to provide the shared secret for a
      <code class="option">key_id</code> without using the configuration file.
@@ -547,7 +547,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2687025"></a><h2>SEE ALSO</h2>
+<a name="id2687444"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">rndc.conf</span>(5)</span>,
      <span class="citerefentry"><span class="refentrytitle">rndc-confgen</span>(8)</span>,
      <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
@@ -557,7 +557,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2687080"></a><h2>AUTHOR</h2>
+<a name="id2687499"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
    </p>
 </div>
@@ -26,14 +26,14 @@
 <dl>
 <dt><span class="preface"><a href="#id2542024"> </a></span></dt>
 <dd><dl>
-<dt><span class="sect1"><a href="#id2542012">Release Notes for BIND Version 9.10.1</a></span></dt>
+<dt><span class="sect1"><a href="#id2542008">Release Notes for BIND Version 9.10.1</a></span></dt>
 <dd><dl>
 <dt><span class="sect2"><a href="#relnotes_intro">Introduction</a></span></dt>
 <dt><span class="sect2"><a href="#relnotes_download">Download</a></span></dt>
 <dt><span class="sect2"><a href="#relnotes_security">Security Fixes</a></span></dt>
 <dt><span class="sect2"><a href="#relnotes_features">New Features</a></span></dt>
 <dt><span class="sect2"><a href="#relnotes_changes">Feature Changes</a></span></dt>
-<dt><span class="sect2"><a href="#relnotes_features">Bug Fixes</a></span></dt>
+<dt><span class="sect2"><a href="#relnotes_bugs">Bug Fixes</a></span></dt>
 <dt><span class="sect2"><a href="#relnotes_thanks">Thank You</a></span></dt>
 </dl></dd>
 </dl></dd>
@@ -45,21 +45,21 @@
 <div class="toc">
 <p><b>Table of Contents</b></p>
 <dl>
-<dt><span class="sect1"><a href="#id2542012">Release Notes for BIND Version 9.10.1</a></span></dt>
+<dt><span class="sect1"><a href="#id2542008">Release Notes for BIND Version 9.10.1</a></span></dt>
 <dd><dl>
 <dt><span class="sect2"><a href="#relnotes_intro">Introduction</a></span></dt>
 <dt><span class="sect2"><a href="#relnotes_download">Download</a></span></dt>
 <dt><span class="sect2"><a href="#relnotes_security">Security Fixes</a></span></dt>
 <dt><span class="sect2"><a href="#relnotes_features">New Features</a></span></dt>
 <dt><span class="sect2"><a href="#relnotes_changes">Feature Changes</a></span></dt>
-<dt><span class="sect2"><a href="#relnotes_features">Bug Fixes</a></span></dt>
+<dt><span class="sect2"><a href="#relnotes_bugs">Bug Fixes</a></span></dt>
 <dt><span class="sect2"><a href="#relnotes_thanks">Thank You</a></span></dt>
 </dl></dd>
 </dl>
 </div>
 <div class="sect1" lang="en">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id2542012"></a>Release Notes for BIND Version 9.10.1</h2></div></div></div>
+<a name="id2542008"></a>Release Notes for BIND Version 9.10.1</h2></div></div></div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
 <a name="relnotes_intro"></a>Introduction</h3></div></div></div>
@@ -92,12 +92,106 @@
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
 <a name="relnotes_changes"></a>Feature Changes</h3></div></div></div>
-<div class="itemizedlist"><ul type="disc"><li><p>None</p></li></ul></div>
+<div class="itemizedlist"><ul type="disc">
+<li><p>
+	  ACLs containing <span><strong class="command">geoip asnum</strong></span> elements were
+	  not correctly matched unless the full organization name was
+	  specified in the ACL (as in
+	  <span><strong class="command">geoip asnum "AS1234 Example, Inc.";</strong></span>).
+	  They can now match against the AS number alone (as in
+	  <span><strong class="command">geoip asnum "AS1234";</strong></span>).
+        </p></li>
+<li><p>
+          When using native PKCS#11 cryptography (i.e.,
+          <span><strong class="command">configure --enable-native-pkcs11</strong></span>) HSM PINs
+          of up to 256 characters can now be used.
+        </p></li>
+<li><p>
+          NXDOMAIN responses to queries of type DS are now cached separately
+          from those for other types. This helps when using "grafted" zones
+          of type forward, for which the parent zone does not contain a
+          delegation, such as local top-level domains.  Previously a query
+          of type DS for such a zone could cause the zone apex to be cached
+          as NXDOMAIN, blocking all subsequent queries.  (Note: This
+          change is only helpful when DNSSEC validation is not enabled.
+          "Grafted" zones without a delegation in the parent are not a
+          recommended configuration.)
+        </p></li>
+<li><p>
+          NOTIFY messages that are sent because a zone has been updated
+          are now given priority above NOTIFY messages that were scheduled
+          when the server started up. This should mitigate delays in zone
+          propagation when servers are restarted frequently.
+        </p></li>
+<li><p>
+          Errors reported when running <span><strong class="command">rndc addzone</strong></span>
+          (e.g., when a zone file cannot be loaded) have been clarified
+          to make it easier to diagnose problems.
+        </p></li>
+</ul></div>
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="relnotes_features"></a>Bug Fixes</h3></div></div></div>
-<div class="itemizedlist"><ul type="disc"><li><p>None</p></li></ul></div>
+<a name="relnotes_bugs"></a>Bug Fixes</h3></div></div></div>
+<div class="itemizedlist"><ul type="disc">
+<li><p>
+	  <span><strong class="command">dig</strong></span>, <span><strong class="command">host</strong></span> and
+	  <span><strong class="command">nslookup</strong></span> aborted when encountering
+	  a name which, after appending search list elements,
+	  exceeded 255 bytes. Such names are now skipped, but
+	  processing of other names will continue. [RT #36892]
+        </p></li>
+<li><p>
+	  The error message generated when
+	  <span><strong class="command">named-checkzone</strong></span> or
+	  <span><strong class="command">named-checkconf -z</strong></span> encounters a
+	  <code class="option">$TTL</code> directive without a value has
+	  been clarified. [RT #37138]
+        </p></li>
+<li><p>
+	  Semicolon characters (;) included in TXT records were
+	  incorrectly escaped with a backslash when the record was
+	  displayed as text. This is actually only necessary when there
+	  are no quotation marks. [RT #37159]
+        </p></li>
+<li><p>
+	  When files opened for writing by <span><strong class="command">named</strong></span>,
+	  such as zone journal files, were referenced more than once
+	  in <code class="filename">named.conf</code>, it could lead to file
+	  corruption as multiple threads wrote to the same file. This
+	  is now detected when loading <code class="filename">named.conf</code>
+	  and reported as an error. [RT #37172]
+        </p></li>
+<li><p>
+          <span><strong class="command">dnssec-keygen -S</strong></span> failed to generate successor
+          keys for some algorithm types (including ECDSA and GOST) due to
+          a difference in the content of private key files. This has been
+          corrected. [RT #37183]
+        </p></li>
+<li><p>
+          UPDATE messages that arrived too soon after
+          an <span><strong class="command">rndc thaw</strong></span> could be lost. [RT #37233]
+        </p></li>
+<li><p>
+          Forwarding of UPDATE messages did not work when they were
+          signed with SIG(0); they resulted in a BADSIG response code.
+          [RT #37216]
+        </p></li>
+<li><p>
+          When checking for updates to trust anchors listed in
+          <code class="option">managed-keys</code>, <span><strong class="command">named</strong></span>
+          now revalidates keys based on the current set of
+          active trust anchors, without relying on any cached
+          record of previous validation. [RT #37506]
+        </p></li>
+<li><p>
+	  Large-system tuning
+	  (<span><strong class="command">configure --with-tuning=large</strong></span>) caused
+	  problems on some platforms by setting a socket receive
+	  buffer size that was too large.  This is now detected and
+	  corrected at run time. [RT #37187]
+        </p></li>
+</ul></div>
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">