diff --git a/bin/delv/delv.1 b/bin/delv/delv.1
index d4cde7334a..ae643c922b 100644
--- a/bin/delv/delv.1
+++ b/bin/delv/delv.1
@@ -63,7 +63,7 @@ is a tool for sending DNS queries and validating the results, using the same int
 \fBdelv\fR
 will send to a specified name server all queries needed to fetch and validate the requested data; this includes the original requested query, subsequent queries to follow CNAME or DNAME chains, and queries for DNSKEY, DS and DLV records to establish a chain of trust for DNSSEC validation\&. It does not perform iterative resolution, but simulates the behavior of a name server configured for DNSSEC validating and forwarding\&.
 .PP
-By default, responses are validated using built\-in DNSSEC trust anchors for the root zone ("\&.") and for the ISC DNSSEC lookaside validation zone ("dlv\&.isc\&.org")\&. Records returned by
+By default, responses are validated using built\-in DNSSEC trust anchor for the root zone ("\&.")\&. Records returned by
 \fBdelv\fR
 are either fully validated or were not signed\&. If validation fails, an explanation of the failure is included in the output; the validation process can be traced in detail\&. Because
 \fBdelv\fR
@@ -143,13 +143,13 @@ will perform a lookup for an A record\&.
 Specifies a file from which to read DNSSEC trust anchors\&. The default is
 /etc/bind\&.keys, which is included with
 BIND
-9 and contains trust anchors for the root zone ("\&.") and for the ISC DNSSEC lookaside validation zone ("dlv\&.isc\&.org")\&.
+9 and contains one or more trust anchors for the root zone ("\&.")\&.
 .sp
-Keys that do not match the root or DLV trust\-anchor names are ignored; these key names can be overridden using the
-\fB+dlv=NAME\fR
-or
+Keys that do not match the root zone name are ignored\&. An alternate key name can be specified using the
 \fB+root=NAME\fR
-options\&.
+options\&. DNSSEC Lookaside Validation can also be turned on by using the
+\fB+dlv=NAME\fR
+to specify the name of a zone containing DLV records\&.
 .sp
 Note: When reading the trust anchor file,
 \fBdelv\fR
@@ -412,9 +412,9 @@ must be used to specify a file containing the key\&.
 .PP
 \fB+[no]dlv[=DLV]\fR
 .RS 4
-Indicates whether to perform DNSSEC lookaside validation, and if so, specifies the name of the DLV trust anchor\&. The default is to perform lookaside validation using a trust anchor of "dlv\&.isc\&.org", for which there is a built\-in key\&. If specifying a different name, then
+Indicates whether to perform DNSSEC lookaside validation, and if so, specifies the name of the DLV trust anchor\&. The
 \fB\-a\fR
-must be used to specify a file containing the DLV key\&.
+option must also be used to specify a file containing the DLV key\&.
 .RE
 .SH "FILES"
 .PP
diff --git a/bin/delv/delv.html b/bin/delv/delv.html
index 06b814dbfb..bb02d8171d 100644
--- a/bin/delv/delv.html
+++ b/bin/delv/delv.html
@@ -99,8 +99,7 @@
     </p>
     <p>
       By default, responses are validated using built-in DNSSEC trust
-      anchors for the root zone (".") and for the ISC DNSSEC lookaside
-      validation zone ("dlv.isc.org").  Records returned by
+      anchor for the root zone (".").  Records returned by
       <span class="command"><strong>delv</strong></span> are either fully validated or
       were not signed.  If validation fails, an explanation of
       the failure is included in the output; the validation process
@@ -197,14 +196,15 @@
 	    Specifies a file from which to read DNSSEC trust anchors.
 	    The default is <code class="filename">/etc/bind.keys</code>, which
 	    is included with <acronym class="acronym">BIND</acronym> 9 and contains
-	    trust anchors for the root zone (".") and for the ISC
-	    DNSSEC lookaside validation zone ("dlv.isc.org").
+	    one or more trust anchors for the root zone (".").
 	  </p>
 	  <p>
-	    Keys that do not match the root or DLV trust-anchor
-	    names are ignored; these key names can be overridden
-	    using the <code class="option">+dlv=NAME</code> or
-	    <code class="option">+root=NAME</code> options.
+	    Keys that do not match the root zone name are ignored.
+            An alternate key name can be specified using the
+	    <code class="option">+root=NAME</code> options. DNSSEC Lookaside
+            Validation can also be turned on by using the
+	    <code class="option">+dlv=NAME</code> to specify the name of a
+            zone containing DLV records.
 	  </p>
 	  <p>
 	    Note: When reading the trust anchor file,
@@ -546,11 +546,8 @@
 	    <p>
 	      Indicates whether to perform DNSSEC lookaside validation,
 	      and if so, specifies the name of the DLV trust anchor.
-	      The default is to perform lookaside validation using
-	      a trust anchor of "dlv.isc.org", for which there is a
-	      built-in key.  If specifying a different name, then
-	      <code class="option">-a</code> must be used to specify a file
-	      containing the DLV key.
+	      The <code class="option">-a</code> option must also be used to specify
+              a file containing the DLV key.
 	    </p>
 	  </dd>
 </dl></div>
diff --git a/bin/python/dnssec-checkds.8 b/bin/python/dnssec-checkds.8
index 90ffd45a0e..3ce008d556 100644
--- a/bin/python/dnssec-checkds.8
+++ b/bin/python/dnssec-checkds.8
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2012-2016 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2012-2017 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" Permission to use, copy, modify, and/or distribute this software for any
 .\" purpose with or without fee is hereby granted, provided that the above
@@ -65,8 +65,7 @@ is specified, then the zone is read from that file to find the DNSKEY records\&.
 .PP
 \-l \fIdomain\fR
 .RS 4
-Check for a DLV record in the specified lookaside domain, instead of checking for a DS record in the zone\*(Aqs parent\&. For example, to check for DLV records for "example\&.com" in ISC\*(Aqs DLV zone, use:
-\fBdnssec\-checkds \-l dlv\&.isc\&.org example\&.com\fR
+Check for a DLV record in the specified lookaside domain, instead of checking for a DS record in the zone\*(Aqs parent\&.
 .RE
 .PP
 \-d \fIdig path\fR
@@ -92,5 +91,5 @@ binary\&. Used for testing\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2012-2016 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2012-2017 Internet Systems Consortium, Inc. ("ISC")
 .br
diff --git a/bin/python/dnssec-checkds.html b/bin/python/dnssec-checkds.html
index 86d2f11d01..44fc0e423e 100644
--- a/bin/python/dnssec-checkds.html
+++ b/bin/python/dnssec-checkds.html
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2012-2016 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2012-2017 Internet Systems Consortium, Inc. ("ISC")
  - 
  - Permission to use, copy, modify, and/or distribute this software for any
  - purpose with or without fee is hereby granted, provided that the above
@@ -85,9 +85,6 @@
           <p>
             Check for a DLV record in the specified lookaside domain,
             instead of checking for a DS record in the zone's parent.
-            For example, to check for DLV records for "example.com"
-            in ISC's DLV zone, use:
-            <span class="command"><strong>dnssec-checkds -l dlv.isc.org example.com</strong></span>
           </p>
         </dd>
 <dt><span class="term">-d <em class="replaceable"><code>dig path</code></em></span></dt>
diff --git a/doc/arm/Bv9ARM.ch06.html b/doc/arm/Bv9ARM.ch06.html
index 8391da5545..2a7e64c7f6 100644
--- a/doc/arm/Bv9ARM.ch06.html
+++ b/doc/arm/Bv9ARM.ch06.html
@@ -2921,9 +2921,8 @@ badresp:1,adberr:0,findfail:0,valfail:0]
               <p>
                 The pathname of a file to override the built-in trusted
                 keys provided by <span class="command"><strong>named</strong></span>.
-                See the discussion of <span class="command"><strong>dnssec-lookaside</strong></span>
-                and <span class="command"><strong>dnssec-validation</strong></span> for details.
-                If not specified, the default is
+                See the discussion of <span class="command"><strong>dnssec-validation</strong></span>
+                for details.  If not specified, the default is
                 <code class="filename">/etc/bind.keys</code>.
               </p>
             </dd>
@@ -3115,40 +3114,18 @@ options {
                 record validates a DNSKEY (similarly to the way a DS
                 record does) the DNSKEY RRset is deemed to be trusted.
               </p>
-              <p>
-                If <span class="command"><strong>dnssec-lookaside</strong></span> is set to
-                <strong class="userinput"><code>auto</code></strong>, then built-in default
-                values for the DLV domain and trust anchor will be
-                used, along with a built-in key for validation.
-              </p>
               <p>
                 If <span class="command"><strong>dnssec-lookaside</strong></span> is set to
                 <strong class="userinput"><code>no</code></strong>, then dnssec-lookaside
                 is not used.
               </p>
               <p>
-                The default DLV key is stored in the file
-                <code class="filename">bind.keys</code>;
-                <span class="command"><strong>named</strong></span> will load that key at
-                startup if <span class="command"><strong>dnssec-lookaside</strong></span> is set to
-                <code class="constant">auto</code>.  A copy of the file is
-                installed along with <acronym class="acronym">BIND</acronym> 9, and is
-                current as of the release date.  If the DLV key expires, a
-                new copy of <code class="filename">bind.keys</code> can be downloaded
-                from <a class="link" href="https://www.isc.org/solutions/dlv/" target="_top">https://www.isc.org/solutions/dlv/</a>.
-              </p>
-              <p>
-                (To prevent problems if <code class="filename">bind.keys</code> is
-                not found, the current key is also compiled in to
-                <span class="command"><strong>named</strong></span>.  Relying on this is not
-                recommended, however, as it requires <span class="command"><strong>named</strong></span>
-                to be recompiled with a new key when the DLV key expires.)
-              </p>
-              <p>
-                NOTE: <span class="command"><strong>named</strong></span> only loads certain specific
-                keys from <code class="filename">bind.keys</code>:  those for the
-                DLV zone and for the DNS root zone.  The file cannot be
-                used to store keys for other zones.
+                NOTE: The ISC-provided DLV service at
+                <code class="literal">dlv.isc.org</code>, has been shut down.
+                The <span class="command"><strong>dnssec-lookaside auto;</strong></span>
+                configuration option, which set <span class="command"><strong>named</strong></span>
+                up to use ISC DLV with minimal configuration, has
+                accordingly been removed.
               </p>
             </dd>
 <dt><span class="term"><span class="command"><strong>dnssec-must-be-secure</strong></span></span></dt>
@@ -3162,7 +3139,7 @@ options {
                 be accepted.  The specified domain must be under a
                 <span class="command"><strong>trusted-keys</strong></span> or
                 <span class="command"><strong>managed-keys</strong></span> statement, or
-                <span class="command"><strong>dnssec-lookaside</strong></span> must be active.
+                <span class="command"><strong>dnssec-validation auto</strong></span> must be active.
               </p>
             </dd>
 <dt><span class="term"><span class="command"><strong>dns64</strong></span></span></dt>
@@ -3894,9 +3871,8 @@ options {
                   Causes <span class="command"><strong>named</strong></span> to send specially-formed
                   queries once per day to domains for which trust anchors
                   have been configured via <span class="command"><strong>trusted-keys</strong></span>,
-                  <span class="command"><strong>managed-keys</strong></span>,
-                  <span class="command"><strong>dnssec-validation auto</strong></span>, or
-                  <span class="command"><strong>dnssec-lookaside auto</strong></span>.
+                  <span class="command"><strong>managed-keys</strong></span>, or
+                  <span class="command"><strong>dnssec-validation auto</strong></span>.
                 </p>
                 <p>
                   The query name used for these queries has the
@@ -4237,17 +4213,45 @@ options {
                   Note <span class="command"><strong>dnssec-enable</strong></span> also needs to be
                   set to <strong class="userinput"><code>yes</code></strong> to be effective.
                   If set to <strong class="userinput"><code>no</code></strong>, DNSSEC validation
-                  is disabled.  If set to <strong class="userinput"><code>auto</code></strong>,
-                  DNSSEC validation is enabled, and a default
-                  trust-anchor for the DNS root zone is used.  If set to
-                  <strong class="userinput"><code>yes</code></strong>, DNSSEC validation is enabled,
-                  but a trust anchor must be manually configured using
-                  a <span class="command"><strong>trusted-keys</strong></span> or
-                  <span class="command"><strong>managed-keys</strong></span> statement.  The default
+                  is disabled.
+                </p>
+                <p>
+                  If set to <strong class="userinput"><code>auto</code></strong>, DNSSEC validation
+                  is enabled, and a default trust anchor for the DNS root
+                  zone is used.  If set to <strong class="userinput"><code>yes</code></strong>,
+                  DNSSEC validation is enabled, but a trust anchor must be
+                  manually configured using a <span class="command"><strong>trusted-keys</strong></span>
+                  or <span class="command"><strong>managed-keys</strong></span> statement.  The default
                   is <strong class="userinput"><code>yes</code></strong>.
                 </p>
+                <p>
+                  The default root trust anchor is stored in the file
+                  <code class="filename">bind.keys</code>.
+                  <span class="command"><strong>named</strong></span> will load that key at
+                  startup if <span class="command"><strong>dnssec-validation</strong></span> is
+                  set to <code class="constant">auto</code>.  A copy of the file is
+                  installed along with BIND 9, and is current as of the
+                  release date.  If the root key expires, a new copy of
+                  <code class="filename">bind.keys</code> can be downloaded
+                  from <a class="link" href="https://www.isc.org/bind-keys" target="_top">https://www.isc.org/bind-keys</a>.
+                </p>
+                <p>
+                  To prevent problems if <code class="filename">bind.keys</code> is
+                  not found, the current trust anchor is also compiled in
+                  to <span class="command"><strong>named</strong></span>.  Relying on this is not
+                  recommended, however, as it requires <span class="command"><strong>named</strong></span>
+                  to be recompiled with a new key when the root key expires.)
+                </p>
                 <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
 <h3 class="title">Note</h3>
+                  <p>
+                    <span class="command"><strong>named</strong></span> <span class="emphasis"><em>only</em></span>
+                    loads the root key from <code class="filename">bind.keys</code>.
+                    The file cannot be used to store keys for other zones.
+                    The root key in <code class="filename">bind.keys</code> is ignored
+                    if <span class="command"><strong>dnssec-validation auto</strong></span> is not in
+                    use.
+                  </p>
                   <p>
                     Whenever the resolver sends out queries to an
                     EDNS-compliant server, it always sets the DO bit
@@ -8263,15 +8267,13 @@ example.com                 CNAME   rpz-tcp-only.
             If the <span class="command"><strong>dnssec-validation</strong></span> option is
             set to <strong class="userinput"><code>auto</code></strong>, <span class="command"><strong>named</strong></span>
             will automatically initialize a managed key for the
-            root zone.  Similarly, if the <span class="command"><strong>dnssec-lookaside</strong></span>
-            option is set to <strong class="userinput"><code>auto</code></strong>,
-            <span class="command"><strong>named</strong></span> will automatically initialize
-            a managed key for the zone <code class="literal">dlv.isc.org</code>.
-            (Note: The ISC DLV service is expected to cease operation by
-            the end of 2017.) In both cases, the key that is used to
-            initialize the key maintenance process is built into
-            <span class="command"><strong>named</strong></span>, and can be overridden from
-            <span class="command"><strong>bindkeys-file</strong></span>.
+            root zone.  The key that is used to initialize the key
+            maintenance process is stored in <code class="filename">bind.keys</code>;
+            the location of this file can be overridden with the
+            <span class="command"><strong>bindkeys-file</strong></span> option. As a fallback
+            in the event no <code class="filename">bind.keys</code> can be
+            found, the initializing key is also compiled directly
+            into <span class="command"><strong>named</strong></span>.
           </p>
         </div>
 
diff --git a/doc/arm/Bv9ARM.ch09.html b/doc/arm/Bv9ARM.ch09.html
index 281a1b4a0c..961d6ff4fb 100644
--- a/doc/arm/Bv9ARM.ch09.html
+++ b/doc/arm/Bv9ARM.ch09.html
@@ -182,6 +182,16 @@
 <div class="titlepage"><div><div><h3 class="title">
 <a name="relnotes_changes"></a>Feature Changes</h3></div></div></div>
     <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
+<li class="listitem">
+	<p>
+	  The ISC DNSSEC Lookaside Validation (DLV) service has been shut
+	  down; all DLV records in the dlv.isc.org zone have been removed.
+	  References to the service have been removed from BIND documentation.
+	  Lookaside validation is no longer used by default by
+	  <span class="command"><strong>delv</strong></span>. The DLV key has been removed from
+	  <code class="filename">bind.keys</code>. [RT #46155]
+	</p>
+      </li>
 <li class="listitem">
 	<p>
 	  <span class="command"><strong>dig +ednsopt</strong></span> now accepts the names
@@ -214,6 +224,15 @@
 <div class="titlepage"><div><div><h3 class="title">
 <a name="relnotes_bugs"></a>Bug Fixes</h3></div></div></div>
     <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
+<li class="listitem">
+	<p>
+	  When <span class="command"><strong>named</strong></span> was reconfigured, failure of some
+	  zones to load correctly could leave the system in an inconsistent
+	  state; while generally harmless, this could lead to a crash later
+	  when using <span class="command"><strong>rndc addzone</strong></span>.  Reconfiguration changes
+	  are now fully rolled back in the event of failure. [RT #45841]
+	</p>
+      </li>
 <li class="listitem">
 	<p>
 	  Fixed a bug that was introduced in an earlier development
diff --git a/doc/arm/man.delv.html b/doc/arm/man.delv.html
index 15354344f3..05d1cab345 100644
--- a/doc/arm/man.delv.html
+++ b/doc/arm/man.delv.html
@@ -118,8 +118,7 @@
     </p>
     <p>
       By default, responses are validated using built-in DNSSEC trust
-      anchors for the root zone (".") and for the ISC DNSSEC lookaside
-      validation zone ("dlv.isc.org").  Records returned by
+      anchor for the root zone (".").  Records returned by
       <span class="command"><strong>delv</strong></span> are either fully validated or
       were not signed.  If validation fails, an explanation of
       the failure is included in the output; the validation process
@@ -216,14 +215,15 @@
 	    Specifies a file from which to read DNSSEC trust anchors.
 	    The default is <code class="filename">/etc/bind.keys</code>, which
 	    is included with <acronym class="acronym">BIND</acronym> 9 and contains
-	    trust anchors for the root zone (".") and for the ISC
-	    DNSSEC lookaside validation zone ("dlv.isc.org").
+	    one or more trust anchors for the root zone (".").
 	  </p>
 	  <p>
-	    Keys that do not match the root or DLV trust-anchor
-	    names are ignored; these key names can be overridden
-	    using the <code class="option">+dlv=NAME</code> or
-	    <code class="option">+root=NAME</code> options.
+	    Keys that do not match the root zone name are ignored.
+            An alternate key name can be specified using the
+	    <code class="option">+root=NAME</code> options. DNSSEC Lookaside
+            Validation can also be turned on by using the
+	    <code class="option">+dlv=NAME</code> to specify the name of a
+            zone containing DLV records.
 	  </p>
 	  <p>
 	    Note: When reading the trust anchor file,
@@ -565,11 +565,8 @@
 	    <p>
 	      Indicates whether to perform DNSSEC lookaside validation,
 	      and if so, specifies the name of the DLV trust anchor.
-	      The default is to perform lookaside validation using
-	      a trust anchor of "dlv.isc.org", for which there is a
-	      built-in key.  If specifying a different name, then
-	      <code class="option">-a</code> must be used to specify a file
-	      containing the DLV key.
+	      The <code class="option">-a</code> option must also be used to specify
+              a file containing the DLV key.
 	    </p>
 	  </dd>
 </dl></div>
diff --git a/doc/arm/man.dnssec-checkds.html b/doc/arm/man.dnssec-checkds.html
index 785985a4e5..bc7264514e 100644
--- a/doc/arm/man.dnssec-checkds.html
+++ b/doc/arm/man.dnssec-checkds.html
@@ -104,9 +104,6 @@
           <p>
             Check for a DLV record in the specified lookaside domain,
             instead of checking for a DS record in the zone's parent.
-            For example, to check for DLV records for "example.com"
-            in ISC's DLV zone, use:
-            <span class="command"><strong>dnssec-checkds -l dlv.isc.org example.com</strong></span>
           </p>
         </dd>
 <dt><span class="term">-d <em class="replaceable"><code>dig path</code></em></span></dt>
diff --git a/doc/arm/notes.html b/doc/arm/notes.html
index 7fcde26715..78f6e67fde 100644
--- a/doc/arm/notes.html
+++ b/doc/arm/notes.html
@@ -143,6 +143,16 @@
 <div class="titlepage"><div><div><h3 class="title">
 <a name="relnotes_changes"></a>Feature Changes</h3></div></div></div>
     <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
+<li class="listitem">
+	<p>
+	  The ISC DNSSEC Lookaside Validation (DLV) service has been shut
+	  down; all DLV records in the dlv.isc.org zone have been removed.
+	  References to the service have been removed from BIND documentation.
+	  Lookaside validation is no longer used by default by
+	  <span class="command"><strong>delv</strong></span>. The DLV key has been removed from
+	  <code class="filename">bind.keys</code>. [RT #46155]
+	</p>
+      </li>
 <li class="listitem">
 	<p>
 	  <span class="command"><strong>dig +ednsopt</strong></span> now accepts the names
@@ -175,6 +185,15 @@
 <div class="titlepage"><div><div><h3 class="title">
 <a name="relnotes_bugs"></a>Bug Fixes</h3></div></div></div>
     <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
+<li class="listitem">
+	<p>
+	  When <span class="command"><strong>named</strong></span> was reconfigured, failure of some
+	  zones to load correctly could leave the system in an inconsistent
+	  state; while generally harmless, this could lead to a crash later
+	  when using <span class="command"><strong>rndc addzone</strong></span>.  Reconfiguration changes
+	  are now fully rolled back in the event of failure. [RT #45841]
+	</p>
+      </li>
 <li class="listitem">
 	<p>
 	  Fixed a bug that was introduced in an earlier development