Return raw zone serial for inline zones

Disable ZONEVERSION for built-in chaos and empty zones
Check that 'provide-zoneversion no;' works
2025-03-24 17:32:52 +11:00 · 2025-03-24 17:32:52 +11:00 · 2025-03-24 17:32:52 +11:00 · 2025-03-24 17:32:52 +11:00 · 2025-03-24 17:32:52 +11:00 · 2025-03-24 14:22:07 +11:00
467 changed files with 9177 additions and 7984 deletions
@@ -56,6 +56,16 @@ variables:
  # Some jobs may clean up the build artifacts unless this is set to 0.
  CLEAN_BUILD_ARTIFACTS_ON_SUCCESS: 1

+  # DNS Shotgun performance testing defaults
+  SHOTGUN_ROUNDS: 1
+  SHOTGUN_DURATION: 120
+  # allow unlimited improvements against baseline
+  SHOTGUN_EVAL_THRESHOLD_CPU_MIN: '-inf'
+  SHOTGUN_EVAL_THRESHOLD_MEMORY_MIN: '-inf'
+  SHOTGUN_EVAL_THRESHOLD_RCODE_MAX: '+inf'
+  SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_MIN: '-inf'
+  SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_DRIFT_MIN: '-inf'
+
 default:
  # Allow all running CI jobs to be automatically canceled when a new
  # version of a branch is pushed.
@@ -107,16 +117,55 @@ stages:
    - runner-manager
    - aarch64

-# Autoscaling GitLab Runner on AWS EC2 (FreeBSD)
-
-.freebsd-stress-amd64: &freebsd_stress_amd64
+.freebsd-autoscaler-13-amd64-tags: &freebsd_autoscaler_13_amd64_tags
  tags:
-    - bsd-stress-test
-    - aws
+    - amd64
    - autoscaler
+    - aws
+    - bsd-stress-test-1
    - shell
    - stress-test
+
+.freebsd-autoscaler-14-amd64-tags: &freebsd_autoscaler_14_amd64_tags
+  tags:
    - amd64
+    - autoscaler
+    - aws
+    - bsd-stress-test-2
+    - shell
+    - stress-test
+
+.freebsd-autoscaler-amd64: &freebsd_autoscaler_amd64
+  variables:
+    CC: clang
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    # Even though there's only one job per runtime environment, the GitLab
+    # "instance" executor insists on cloning the Git repository to a path that
+    # contains a variable number from zero to the "maximum concurrent instances
+    # count" allowed on the GitLab Runner. See the "0" directory in this
+    # example path: /home/ec2-user/builds/t1_4FZzvz/0/isc-projects/bind9/.git/.
+    #
+    # This is not a problem for isolated jobs like "stress" tests that depend
+    # on no other jobs. However, it is a problem for jobs that need other jobs'
+    # artifacts. For example, a system test job that has its Git repo cloned to
+    # the "/1/" sub-path will fail if it downloads build job artifacts that
+    # have ./configure output files with "/0/" in its sub-path recorded.
+    GIT_CLONE_PATH: "/home/ec2-user/builds/${CI_PROJECT_PATH}/"
+    # Use MIT Kerberos5 for BIND 9 GSS-API support because of FreeBSD Heimdal
+    # incompatibility; see https://bugs.freebsd.org/275241.
+    EXTRA_CONFIGURE: "${WITH_READLINE_EDITLINE} --with-gssapi=/usr/local/bin/krb5-config"
+
+# Autoscaling GitLab Runner on AWS EC2 (FreeBSD 13)
+
+.freebsd-autoscaler-13-amd64: &freebsd_autoscaler_13_amd64
+  <<: *freebsd_autoscaler_amd64
+  <<: *freebsd_autoscaler_13_amd64_tags
+
+# Autoscaling GitLab Runner on AWS EC2 (FreeBSD 14)
+
+.freebsd-autoscaler-14-amd64: &freebsd_autoscaler_14_amd64
+  <<: *freebsd_autoscaler_amd64
+  <<: *freebsd_autoscaler_14_amd64_tags

 ### Docker Image Templates

@@ -204,14 +253,6 @@ stages:

 ### QCOW2 Image Templates

-.freebsd-13-amd64: &freebsd_13_amd64_image
-  image: "freebsd-13.4-x86_64"
-  <<: *libvirt_amd64
-
-.freebsd-14-amd64: &freebsd_14_amd64_image
-  image: "freebsd-14.2-x86_64"
-  <<: *libvirt_amd64
-
 .openbsd-amd64: &openbsd_amd64_image
  image: "openbsd-7.6-x86_64"
  <<: *libvirt_amd64
@@ -219,31 +260,18 @@ stages:
 ### Job Templates

 .api-pipelines-schedules-tags-triggers-web-triggering-rules: &api_pipelines_schedules_tags_triggers_web_triggering_rules
-  only:
-    - api
-    - pipelines
-    - schedules
-    - tags
-    - triggers
-    - web
+  rules:
+    - if: '$CI_PIPELINE_SOURCE =~ /^(api|pipeline|schedule|trigger|web)$/'
+    - if: '$CI_COMMIT_TAG != null'

 .api-pipelines-schedules-triggers-web-triggering-rules: &api_pipelines_schedules_triggers_web_triggering_rules
-  only:
-    - api
-    - pipelines
-    - schedules
-    - triggers
-    - web
+  rules:
+    - if: '$CI_PIPELINE_SOURCE =~ /^(api|pipeline|schedule|trigger|web)$/'

 .default-triggering-rules: &default_triggering_rules
-  only:
-    - api
-    - merge_requests
-    - pipelines
-    - schedules
-    - tags
-    - triggers
-    - web
+  rules:
+    - if: '$CI_PIPELINE_SOURCE =~ /^(api|merge_request_event|pipeline|schedule|trigger|web)$/'
+    - if: '$CI_COMMIT_TAG != null'

 .precheck: &precheck_job
  <<: *default_triggering_rules
@@ -343,18 +371,41 @@ stages:

 .shotgun: &shotgun_job
  <<: *base_image
-  <<: *api_pipelines_schedules_tags_triggers_web_triggering_rules
  stage: performance
+  rules:
+    - &shotgun_rule_mr
+      if: '$CI_MERGE_REQUEST_DIFF_BASE_SHA != null'
+      variables:
+        BASELINE: '$CI_MERGE_REQUEST_DIFF_BASE_SHA'
+    - &shotgun_rule_tag
+      if: '$CI_COMMIT_TAG != null'
+      variables:
+        SHOTGUN_ROUNDS: 3
+    - &shotgun_rule_other
+      if: '$CI_PIPELINE_SOURCE =~ /^(api|pipeline|schedule|trigger|web)$/'
+  # when using data from a single run, the overall instability of the results
+  # causes quite high false positive rate, rerun the test to attemp to reduce those
+  retry: 1
  script:
-    - if [ -z "$CI_COMMIT_TAG" ]; then export SHOTGUN_ROUNDS=1; else export SHOTGUN_ROUNDS=3; fi
+    - if [ -z "$BASELINE" ]; then export BASELINE=$BIND_BASELINE_VERSION; fi  # this dotenv variable can't be set in the rules section, because rules are evaluated before any jobs run
    - PIPELINE_ID=$(curl -s -X POST --fail
        -F "token=$CI_JOB_TOKEN"
        -F ref=main
-        -F "variables[SHOTGUN_TEST_VERSION]=['$CI_COMMIT_REF_NAME', '$BIND_BASELINE_VERSION']"
+        -F "variables[SHOTGUN_TEST_VERSION]=['$CI_COMMIT_REF_NAME', '$BASELINE']"
        -F "variables[SHOTGUN_DURATION]=300"
        -F "variables[SHOTGUN_ROUNDS]=$SHOTGUN_ROUNDS"
        -F "variables[SHOTGUN_TRAFFIC_MULTIPLIER]=$SHOTGUN_TRAFFIC_MULTIPLIER"
        -F "variables[SHOTGUN_SCENARIO]=$SHOTGUN_SCENARIO"
+        -F "variables[SHOTGUN_EVAL_THRESHOLD_CPU_MIN]=$SHOTGUN_EVAL_THRESHOLD_CPU_MIN"
+        -F "variables[SHOTGUN_EVAL_THRESHOLD_CPU_MAX]=$SHOTGUN_EVAL_THRESHOLD_CPU_MAX"
+        -F "variables[SHOTGUN_EVAL_THRESHOLD_MEMORY_MIN]=$SHOTGUN_EVAL_THRESHOLD_MEMORY_MIN"
+        -F "variables[SHOTGUN_EVAL_THRESHOLD_MEMORY_MAX]=$SHOTGUN_EVAL_THRESHOLD_MEMORY_MAX"
+        -F "variables[SHOTGUN_EVAL_THRESHOLD_RCODE_MIN]=$SHOTGUN_EVAL_THRESHOLD_RCODE_MIN"
+        -F "variables[SHOTGUN_EVAL_THRESHOLD_RCODE_MAX]=$SHOTGUN_EVAL_THRESHOLD_RCODE_MAX"
+        -F "variables[SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_MIN]=$SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_MIN"
+        -F "variables[SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_MAX]=$SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_MAX"
+        -F "variables[SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_DRIFT_MIN]=$SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_DRIFT_MIN"
+        -F "variables[SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_DRIFT_MAX]=$SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_DRIFT_MAX"
        https://gitlab.isc.org/api/v4/projects/188/trigger/pipeline | jq .id)
    - util/ci-wait-shotgun.py $PIPELINE_ID
  needs:
@@ -511,6 +562,8 @@ misc:
    - if git grep SYSTEMTESTTOP -- ':!.gitlab-ci.yml'; then echo 'Please use relative paths instead of $SYSTEMTESTTOP.'; exit 1; fi
    - bash util/unused-headers.sh
    - bash util/xmllint-html.sh
+    # Check dangling symlinks in the repository
+    - if find . -xtype l | grep .; then exit 1; fi
  needs: []
  artifacts:
    paths:
@@ -534,7 +587,7 @@ vulture:
  <<: *precheck_job
  needs: []
  script:
-    - vulture --exclude "*/ans*/ans.py,conftest.py,isctest" --ignore-names "pytestmark" bin/tests/system/
+    - vulture --exclude "*ans.py,conftest.py,isctest" --ignore-names "pytestmark" bin/tests/system/

 ci-variables:
  stage: precheck
@@ -619,9 +672,8 @@ danger:
  script:
    - pip install git+https://gitlab.isc.org/isc-projects/hazard.git
    - hazard
-  only:
-    refs:
-      - merge_requests
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'

 checkbashisms:
  <<: *precheck_job
@@ -1268,6 +1320,8 @@ clang:asan:
  <<: *build_job

 system:clang:asan:
+  variables:
+    LSAN_OPTIONS: "suppressions=$CI_PROJECT_DIR/suppr-lsan.txt"
  <<: *base_image
  <<: *system_test_job
  needs:
@@ -1287,7 +1341,7 @@ gcc:tsan:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -Wno-stringop-overread -ggdb -O2 -fsanitize=thread"
-    LDFLAGS: "-fsanitize=thread"
+    LDFLAGS: "-fsanitize=thread -Wl,--disable-new-dtags"
    EXTRA_CONFIGURE: "--with-libidn2 --enable-pthread-rwlock --without-jemalloc PKG_CONFIG_PATH=/opt/tsan/lib/pkgconfig"
  <<: *tsan_fedora_41_amd64_image
  <<: *build_job
@@ -1316,7 +1370,8 @@ clang:tsan:
  variables:
    CC: "${CLANG}"
    CFLAGS: "${CFLAGS_COMMON} -ggdb -O2 -fsanitize=thread"
-    LDFLAGS: "-fsanitize=thread"
+    # -Wl,--disable-new-dtags ensures that Clang creates valid TSAN reports
+    LDFLAGS: "-fsanitize=thread -Wl,--disable-new-dtags"
    EXTRA_CONFIGURE: "--with-libidn2 --enable-pthread-rwlock --without-jemalloc PKG_CONFIG_PATH=/opt/tsan/lib/pkgconfig"

 system:clang:tsan:
@@ -1395,27 +1450,19 @@ unit:clang:bookworm:amd64:
 # Jobs for Clang builds on FreeBSD 13 (amd64)

 clang:freebsd13:amd64:
-  variables:
-    CFLAGS: "${CFLAGS_COMMON}"
-    # Use MIT Kerberos5 for BIND 9 GSS-API support because of FreeBSD Heimdal
-    # incompatibility; see https://bugs.freebsd.org/275241.
-    EXTRA_CONFIGURE: "${WITH_READLINE_LIBEDIT} --with-gssapi=/usr/local/bin/krb5-config"
-    USER: gitlab-runner
-  <<: *freebsd_13_amd64_image
  <<: *build_job
+  <<: *freebsd_autoscaler_13_amd64

 system:clang:freebsd13:amd64:
-  <<: *freebsd_13_amd64_image
  <<: *system_test_job
-  variables:
-    USER: gitlab-runner
+  <<: *freebsd_autoscaler_13_amd64
  needs:
    - job: clang:freebsd13:amd64
      artifacts: true

 unit:clang:freebsd13:amd64:
-  <<: *freebsd_13_amd64_image
  <<: *unit_test_job
+  <<: *freebsd_autoscaler_13_amd64
  needs:
    - job: clang:freebsd13:amd64
      artifacts: true
@@ -1423,27 +1470,19 @@ unit:clang:freebsd13:amd64:
 # Jobs for Clang builds on FreeBSD 14 (amd64)

 clang:freebsd14:amd64:
-  variables:
-    CFLAGS: "${CFLAGS_COMMON}"
-    # Use MIT Kerberos5 for BIND 9 GSS-API support because of FreeBSD Heimdal
-    # incompatibility; see https://bugs.freebsd.org/275241.
-    EXTRA_CONFIGURE: "${WITH_READLINE_EDITLINE} --with-gssapi=/usr/local/bin/krb5-config"
-    USER: gitlab-runner
-  <<: *freebsd_14_amd64_image
  <<: *build_job
+  <<: *freebsd_autoscaler_14_amd64

 system:clang:freebsd14:amd64:
-  <<: *freebsd_14_amd64_image
  <<: *system_test_job
-  variables:
-    USER: gitlab-runner
+  <<: *freebsd_autoscaler_14_amd64
  needs:
    - job: clang:freebsd14:amd64
      artifacts: true

 unit:clang:freebsd14:amd64:
-  <<: *freebsd_14_amd64_image
  <<: *unit_test_job
+  <<: *freebsd_autoscaler_14_amd64
  needs:
    - job: clang:freebsd14:amd64
      artifacts: true
@@ -1492,8 +1531,8 @@ release:
      artifacts: true
    - job: docs
      artifacts: true
-  only:
-    - tags
+  rules:
+    - if: '$CI_COMMIT_TAG != null'
  artifacts:
    paths:
      - "*-release"
@@ -1536,8 +1575,8 @@ sign:
  needs:
    - job: release
      artifacts: true
-  only:
-    - tags
+  rules:
+    - if: '$CI_COMMIT_TAG != null'
  when: manual
  allow_failure: false

@@ -1589,10 +1628,8 @@ coverity:
      - cov-int.tar.gz
    expire_in: "1 week"
    when: on_failure
-  only:
-    variables:
-      - $COVERITY_SCAN_PROJECT_NAME
-      - $COVERITY_SCAN_TOKEN
+  rules:
+    - if: '$COVERITY_SCAN_PROJECT_NAME != null && $COVERITY_SCAN_TOKEN != null'

 # Respdiff tests

@@ -1627,9 +1664,9 @@ respdiff:tsan:
  <<: *default_triggering_rules
  <<: *tsan_debian_bookworm_amd64_image
  variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -Og -fsanitize=thread"
-    LDFLAGS: "-fsanitize=thread"
+    CC: "${CLANG}"
+    CFLAGS: "${CFLAGS_COMMON} -ggdb -O2 -fsanitize=thread"
+    LDFLAGS: "-fsanitize=thread -Wl,--disable-new-dtags"
    EXTRA_CONFIGURE: "--enable-pthread-rwlock --without-jemalloc PKG_CONFIG_PATH=/opt/tsan/lib/pkgconfig"
    MAX_DISAGREEMENTS_PERCENTAGE: "0.15"
    TSAN_OPTIONS: "${TSAN_OPTIONS_DEBIAN}"
@@ -1654,9 +1691,6 @@ respdiff-third-party:

 # Performance tests

-# Run shotgun:udp right away, but delay other shotgun jobs sligthly in order to
-# allow re-use of the built container image. Otherwise, the jobs would do the
-# same builds in parallel rather than re-use the already built image.
 shotgun:udp:
  <<: *shotgun_job
  variables:
@@ -1667,25 +1701,29 @@ shotgun:tcp:
  <<: *shotgun_job
  variables:
    SHOTGUN_SCENARIO: tcp
-    SHOTGUN_TRAFFIC_MULTIPLIER: 13
-  when: delayed
-  start_in: 5 minutes
+    SHOTGUN_TRAFFIC_MULTIPLIER: 12

 shotgun:dot:
  <<: *shotgun_job
  variables:
    SHOTGUN_SCENARIO: dot
    SHOTGUN_TRAFFIC_MULTIPLIER: 6
-  when: delayed
-  start_in: 5 minutes
+  rules: &shotgun_rules_manual_mr
+    - if: '$CI_MERGE_REQUEST_DIFF_BASE_SHA != null'
+      variables:
+        BASELINE: '$CI_MERGE_REQUEST_DIFF_BASE_SHA'
+      when: manual  # don't run on each MR unless requested
+      allow_failure: true
+    - *shotgun_rule_tag
+    - *shotgun_rule_other

 shotgun:doh-get:
  <<: *shotgun_job
  variables:
    SHOTGUN_SCENARIO: doh-get
    SHOTGUN_TRAFFIC_MULTIPLIER: 3
-  when: delayed
-  start_in: 5 minutes
+    SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_MAX: 0.4  # bump from the default due to increased tail-end jitter
+  rules: *shotgun_rules_manual_mr

 .stress-test: &stress_test
  stage: performance
@@ -1724,8 +1762,8 @@ fsck:
    - git clone https://gitlab.isc.org/isc-projects/bind9.git bind9-full-clone
    - cd bind9-full-clone/
    - git fsck
-  only:
-    - schedules
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "schedule"'
  needs: []

 gcov:
@@ -1777,9 +1815,8 @@ pairwise:
      - pairwise-model.txt
      - pairwise-output.*.txt
    when: on_failure
-  only:
-    variables:
-      - $PAIRWISE_TESTING
+  rules:
+    - if: '$PAIRWISE_TESTING != null'

 .post_merge_template: &post_merge
  <<: *base_image
@@ -70,7 +70,8 @@ confidential!

  - [ ] [:link:][step_clearance]         **(IM)** Grant QA & Marketing clearance to proceed with public release
  - [ ] [:link:][step_matrix]            **(Support)** (BIND 9 only) Add the new CVEs to the vulnerability matrix in the Knowledge Base
-  - [ ] [:link:][step_publish_advisory]  **(Support)** Bump Document Version for the Security Advisory and publish it in the Knowledge Base
+  - [ ] [:link:][step_bump_advisory]     **(Support)** Bump Document Version for the Security Advisory in Printing Press
+  - [ ] [:link:][step_publish_advisory]  **(Support)** Publish the Security Advisory in the Knowledge Base
  - [ ] [:link:][step_publish]           **(QA/Marketing)** Publish the releases (as outlined in the release checklist)
  - [ ] [:link:][step_notifications]     **(First IM)** Send notification emails to third parties
  - [ ] [:link:][step_mitre]             **(First IM)** Advise MITRE about the disclosed CVEs
@@ -114,7 +115,8 @@ confidential!
 [step_packager_emails]:   https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#send-notifications-to-os-packagers
 [step_clearance]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#grant-qa-marketing-clearance-to-proceed-with-public-release
 [step_matrix]:            https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-add-the-new-cves-to-the-vulnerability-matrix-in-the-knowledge-base
-[step_publish_advisory]:  https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bump-document-version-for-the-security-advisory-and-publish-it-in-the-knowledge-base
+[step_bump_advisory]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bump-document-version-for-the-security-advisory-in-printing-press
+[step_publish_advisory]:  https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#publish-the-security-advisory-in-the-knowledge-base
 [step_publish]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#publish-the-releases-as-outlined-in-the-release-checklist
 [step_notifications]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#send-notification-emails-to-third-parties
 [step_mitre]:             https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#advise-mitre-about-the-disclosed-cves
@@ -1 +1 @@
-CHANGES
+doc/arm/changelog.rst
@@ -655,7 +655,7 @@ load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,
 	isc_buffer_constinit(&buffer, zonename, strlen(zonename));
 	isc_buffer_add(&buffer, strlen(zonename));
 	origin = dns_fixedname_initname(&fixorigin);
-	CHECK(dns_name_fromtext(origin, &buffer, dns_rootname, 0, NULL));
+	CHECK(dns_name_fromtext(origin, &buffer, dns_rootname, 0));
 	dns_zone_setorigin(zone, origin);
 	dns_zone_setdbtype(zone, 1, (const char *const *)dbtype);
 	if (strcmp(filename, "-") == 0) {
@@ -22,6 +22,7 @@
 #include <isc/commandline.h>
 #include <isc/dir.h>
 #include <isc/hash.h>
+#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
@@ -30,6 +31,7 @@

 #include <dns/db.h>
 #include <dns/fixedname.h>
+#include <dns/lib.h>
 #include <dns/name.h>
 #include <dns/rdataclass.h>
 #include <dns/rootns.h>
@@ -759,7 +761,7 @@ cleanup:
 	}

 	if (mctx != NULL) {
-		isc_mem_destroy(&mctx);
+		isc_mem_detach(&mctx);
 	}

 	return result == ISC_R_SUCCESS ? 0 : 1;
@@ -22,6 +22,7 @@
 #include <isc/dir.h>
 #include <isc/file.h>
 #include <isc/hash.h>
+#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
@@ -31,6 +32,7 @@

 #include <dns/db.h>
 #include <dns/fixedname.h>
+#include <dns/lib.h>
 #include <dns/master.h>
 #include <dns/masterdump.h>
 #include <dns/name.h>
@@ -575,7 +577,7 @@ main(int argc, char **argv) {
 		fprintf(errout, "OK\n");
 	}
 	destroy();
-	isc_mem_destroy(&mctx);
+	isc_mem_detach(&mctx);

 	return (result == ISC_R_SUCCESS) ? 0 : 1;
 }
@@ -32,6 +32,7 @@
 #include <isc/buffer.h>
 #include <isc/commandline.h>
 #include <isc/file.h>
+#include <isc/lib.h>
 #include <isc/mem.h>
 #include <isc/net.h>
 #include <isc/result.h>
@@ -40,6 +41,7 @@
 #include <isc/util.h>

 #include <dns/keyvalues.h>
+#include <dns/lib.h>
 #include <dns/name.h>

 #include <dst/dst.h>
@@ -288,7 +290,7 @@ options {\n\
 		isc_mem_stats(mctx, stderr);
 	}

-	isc_mem_destroy(&mctx);
+	isc_mem_detach(&mctx);

 	return 0;
 }
@@ -28,6 +28,7 @@
 #include <isc/buffer.h>
 #include <isc/commandline.h>
 #include <isc/file.h>
+#include <isc/lib.h>
 #include <isc/mem.h>
 #include <isc/net.h>
 #include <isc/result.h>
@@ -36,6 +37,7 @@
 #include <isc/util.h>

 #include <dns/keyvalues.h>
+#include <dns/lib.h>
 #include <dns/name.h>

 #include <dst/dst.h>
@@ -294,7 +296,7 @@ nsupdate -k <keyfile>\n");
 		isc_mem_stats(mctx, stderr);
 	}

-	isc_mem_destroy(&mctx);
+	isc_mem_detach(&mctx);

 	return 0;
 }
@@ -26,17 +26,14 @@
 #include <unistd.h>

 #include <openssl/opensslv.h>
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-#include <openssl/err.h>
-#include <openssl/provider.h>
-#endif

 #include <isc/async.h>
 #include <isc/attributes.h>
 #include <isc/base64.h>
 #include <isc/buffer.h>
-#include <isc/fips.h>
+#include <isc/crypto.h>
 #include <isc/hex.h>
+#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/managers.h>
 #include <isc/md.h>
@@ -59,6 +56,7 @@
 #include <dns/fixedname.h>
 #include <dns/keytable.h>
 #include <dns/keyvalues.h>
+#include <dns/lib.h>
 #include <dns/masterdump.h>
 #include <dns/message.h>
 #include <dns/name.h>
@@ -165,10 +163,6 @@ static dns_fixedname_t qfn;
 /* Default trust anchors */
 static char anchortext[] = TRUST_ANCHORS;

-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-static OSSL_PROVIDER *fips = NULL, *base = NULL;
-#endif
-
 /*
 * Static function prototypes
 */
@@ -595,7 +589,7 @@ convert_name(dns_fixedname_t *fn, dns_name_t **name, const char *text) {
 	isc_buffer_add(&b, len);
 	n = dns_fixedname_initname(fn);

-	result = dns_name_fromtext(n, &b, dns_rootname, 0, NULL);
+	result = dns_name_fromtext(n, &b, dns_rootname, 0);
 	if (result != ISC_R_SUCCESS) {
 		delv_log(ISC_LOG_ERROR, "failed to convert name %s: %s", text,
 			 isc_result_totext(result));
@@ -1617,24 +1611,7 @@ preparse_args(int argc, char **argv) {
 		while (strpbrk(option, single_dash_opts) == &option[0]) {
 			switch (option[0]) {
 			case 'F':
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-				fips = OSSL_PROVIDER_load(NULL, "fips");
-				if (fips == NULL) {
-					ERR_clear_error();
-					fatal("Failed to load FIPS provider");
-				}
-				base = OSSL_PROVIDER_load(NULL, "base");
-				if (base == NULL) {
-					OSSL_PROVIDER_unload(fips);
-					ERR_clear_error();
-					fatal("Failed to load base provider");
-				}
-#endif
-				/* Already in FIPS mode?  */
-				if (isc_fips_mode()) {
-					break;
-				}
-				if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
+				if (isc_crypto_fips_enable() != ISC_R_SUCCESS) {
 					fatal("setting FIPS mode failed");
 				}
 				break;
@@ -2138,12 +2115,14 @@ sendquery(void *arg) {

 	dns_view_attach(view, &(dns_view_t *){ NULL });

-	const unsigned int timeout = isc_nm_getinitialtimeout(netmgr) /
-				     MS_PER_SEC;
+	uint32_t initial;
+	isc_nm_gettimeouts(netmgr, &initial, NULL, NULL, NULL);
+	const unsigned int connect_timeout = initial, timeout = initial;
+
 	CHECK(dns_request_create(requestmgr, message, NULL, &peer, NULL, NULL,
-				 DNS_REQUESTOPT_TCP, NULL, timeout, timeout, 0,
-				 0, isc_loop(), recvresponse, message,
-				 &request));
+				 DNS_REQUESTOPT_TCP, NULL, connect_timeout,
+				 timeout, 0, 0, isc_loop(), recvresponse,
+				 message, &request));
 	return;

 cleanup:
@@ -2305,14 +2284,5 @@ cleanup:

 	isc_managers_destroy(&mctx, &loopmgr, &netmgr);

-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-	if (base != NULL) {
-		OSSL_PROVIDER_unload(base);
-	}
-	if (fips != NULL) {
-		OSSL_PROVIDER_unload(fips);
-	}
-#endif
-
 	return 0;
 }
@@ -20,8 +20,9 @@
 #include <time.h>

 #include <isc/attributes.h>
+#include <isc/crypto.h>
 #include <isc/dir.h>
-#include <isc/fips.h>
+#include <isc/lib.h>
 #include <isc/loop.h>
 #include <isc/netaddr.h>
 #include <isc/parseint.h>
@@ -33,6 +34,7 @@
 #include <dns/byaddr.h>
 #include <dns/dns64.h>
 #include <dns/fixedname.h>
+#include <dns/lib.h>
 #include <dns/masterdump.h>
 #include <dns/message.h>
 #include <dns/name.h>
@@ -71,14 +73,6 @@ static bool short_form = false, printcmd = true, plusquest = false,
 static uint32_t splitwidth = 0xffffffff;

 #include <openssl/opensslv.h>
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-#include <openssl/err.h>
-#include <openssl/provider.h>
-#endif
-
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-static OSSL_PROVIDER *fips = NULL, *base = NULL;
-#endif

 /*% opcode text */
 static const char *const opcodetext[] = {
@@ -295,6 +289,7 @@ help(void) {
 	       "                                      form of answers - global "
 	       "option)\n"
 	       "                 +[no]showbadcookie  (Show BADCOOKIE message)\n"
+	       "                 +[no]showbadvers    (Show BADVERS message)\n"
 	       "                 +[no]showsearch     (Search with intermediate "
 	       "results)\n"
 	       "                 +[no]split=##       (Split hex/base64 fields "
@@ -333,6 +328,7 @@ help(void) {
 	       "                 +[no]yaml           (Present the results as "
 	       "YAML)\n"
 	       "                 +[no]zflag          (Set Z flag in query)\n"
+	       "                 +[no]zoneversion    (Request zone version)\n"
 	       "        global d-opts and servers (before host name) affect "
 	       "all "
 	       "queries.\n"
@@ -591,7 +587,7 @@ short_answer(dns_message_t *msg, dns_messagetextflag_t flags, isc_buffer_t *buf,

 	UNUSED(flags);

-	dns_name_init(&empty_name, NULL);
+	dns_name_init(&empty_name);
 	result = dns_message_firstname(msg, DNS_SECTION_ANSWER);
 	if (result == ISC_R_NOMORE) {
 		return ISC_R_SUCCESS;
@@ -633,9 +629,7 @@ static bool
 isdotlocal(dns_message_t *msg) {
 	isc_result_t result;
 	static unsigned char local_ndata[] = { "\005local" };
-	static unsigned char local_offsets[] = { 0, 6 };
-	static dns_name_t local = DNS_NAME_INITABSOLUTE(local_ndata,
-							local_offsets);
+	static dns_name_t local = DNS_NAME_INITABSOLUTE(local_ndata);

 	for (result = dns_message_firstname(msg, DNS_SECTION_QUESTION);
 	     result == ISC_R_SUCCESS;
@@ -1780,6 +1774,8 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 						FULLCHECK("edns");
 						if (!state) {
 							lookup->edns = -1;
+							lookup->original_edns =
+								-1;
 							break;
 						}
 						if (value == NULL) {
@@ -1796,6 +1792,7 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 							goto exit_or_usage;
 						}
 						lookup->edns = num;
+						lookup->original_edns = num;
 						break;
 					case 'f':
 						FULLCHECK("ednsflags");
@@ -2314,8 +2311,18 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 			case 'w': /* showsearch */
 				switch (cmd[4]) {
 				case 'b':
-					FULLCHECK("showbadcookie");
-					lookup->showbadcookie = state;
+					switch (cmd[7]) {
+					case 'c':
+						FULLCHECK("showbadcookie");
+						lookup->showbadcookie = state;
+						break;
+					case 'v':
+						FULLCHECK("showbadvers");
+						lookup->showbadvers = state;
+						break;
+					default:
+						goto invalid_option;
+					}
 					break;
 				case 's':
 					FULLCHECK("showsearch");
@@ -2568,9 +2575,22 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 			lookup->rrcomments = -1;
 		}
 		break;
-	case 'z': /* zflag */
-		FULLCHECK("zflag");
-		lookup->zflag = state;
+	case 'z':
+		switch (cmd[1]) {
+		case 'f': /* zflag */
+			FULLCHECK("zflag");
+			lookup->zflag = state;
+			break;
+		case 'o': /* zoneversion */
+			FULLCHECK("zoneversion");
+			if (state && lookup->edns == -1) {
+				lookup->edns = DEFAULT_EDNS_VERSION;
+			}
+			lookup->zoneversion = state;
+			break;
+		default:
+			goto invalid_option;
+		}
 		break;
 	default:
 	invalid_option:
@@ -2931,24 +2951,7 @@ preparse_args(int argc, char **argv) {
 				debugging = true;
 				break;
 			case 'F':
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-				fips = OSSL_PROVIDER_load(NULL, "fips");
-				if (fips == NULL) {
-					ERR_clear_error();
-					fatal("Failed to load FIPS provider");
-				}
-				base = OSSL_PROVIDER_load(NULL, "base");
-				if (base == NULL) {
-					OSSL_PROVIDER_unload(fips);
-					ERR_clear_error();
-					fatal("Failed to load base provider");
-				}
-#endif
-				/* Already in FIPS mode?  */
-				if (isc_fips_mode()) {
-					break;
-				}
-				if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
+				if (isc_crypto_fips_enable() != ISC_R_SUCCESS) {
 					fatal("setting FIPS mode failed");
 				}
 				break;
@@ -3476,14 +3479,5 @@ main(int argc, char **argv) {
 	dig_startup();
 	dig_shutdown();

-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-	if (base != NULL) {
-		OSSL_PROVIDER_unload(base);
-	}
-	if (fips != NULL) {
-		OSSL_PROVIDER_unload(fips);
-	}
-#endif
-
 	return exitcode;
 }
@@ -614,6 +614,12 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
   BADCOOKIE rcode before retrying the request or not. The default
   is to not show the messages.

+.. option:: +showbadvers, +noshowbadvers
+
+   This option toggles whether to show the message containing the
+   BADVERS rcode before retrying the request or not. The default
+   is to not show the messages.
+
 .. option:: +showsearch, +noshowsearch

   This option performs [or does not perform] a search showing intermediate results.
@@ -751,6 +757,10 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
   This option sets [or does not set] the last unassigned DNS header flag in a DNS query.
   This flag is off by default.

+.. option:: +zoneversion, +nozoneversion
+
+   When enabled, this option includes an EDNS Zone Version request when sending a query.
+
 Multiple Queries
 ~~~~~~~~~~~~~~~~

@@ -605,6 +605,7 @@ make_empty_lookup(void) {
 		.idnout = idnout,
 		.udpsize = -1,
 		.edns = -1,
+		.original_edns = -1,
 		.recurse = true,
 		.retries = tries,
 		.comments = true,
@@ -704,6 +705,7 @@ clone_lookup(dig_lookup_t *lookold, bool servers) {
 	looknew->opcode = lookold->opcode;
 	looknew->expire = lookold->expire;
 	looknew->nsid = lookold->nsid;
+	looknew->zoneversion = lookold->zoneversion;
 	looknew->tcp_keepalive = lookold->tcp_keepalive;
 	looknew->header_only = lookold->header_only;
 	looknew->https_mode = lookold->https_mode;
@@ -738,6 +740,7 @@ clone_lookup(dig_lookup_t *lookold, bool servers) {
 	}

 	looknew->showbadcookie = lookold->showbadcookie;
+	looknew->showbadvers = lookold->showbadvers;
 	looknew->sendcookie = lookold->sendcookie;
 	looknew->seenbadcookie = lookold->seenbadcookie;
 	looknew->badcookie = lookold->badcookie;
@@ -764,6 +767,7 @@ clone_lookup(dig_lookup_t *lookold, bool servers) {
 	looknew->idnout = lookold->idnout;
 	looknew->udpsize = lookold->udpsize;
 	looknew->edns = lookold->edns;
+	looknew->original_edns = lookold->original_edns;
 	looknew->recurse = lookold->recurse;
 	looknew->aaonly = lookold->aaonly;
 	looknew->adflag = lookold->adflag;
@@ -858,14 +862,14 @@ requeue_lookup(dig_lookup_t *lookold, bool servers) {
 void
 setup_text_key(void) {
 	isc_result_t result;
-	dns_name_t keyname;
+	dns_fixedname_t fkey;
+	dns_name_t *keyname = dns_fixedname_initname(&fkey);
 	isc_buffer_t secretbuf;
 	unsigned int secretsize;
 	unsigned char *secretstore;

 	debug("setup_text_key()");
 	isc_buffer_allocate(mctx, &namebuf, MXNAME);
-	dns_name_init(&keyname, NULL);
 	isc_buffer_putstr(namebuf, keynametext);
 	secretsize = (unsigned int)strlen(keysecret) * 3 / 4;
 	secretstore = isc_mem_allocate(mctx, secretsize);
@@ -882,12 +886,12 @@ setup_text_key(void) {
 		goto failure;
 	}

-	result = dns_name_fromtext(&keyname, namebuf, dns_rootname, 0, namebuf);
+	result = dns_name_fromtext(keyname, namebuf, dns_rootname, 0);
 	if (result != ISC_R_SUCCESS) {
 		goto failure;
 	}

-	result = dns_tsigkey_create(&keyname, hmac_alg, secretstore,
+	result = dns_tsigkey_create(keyname, hmac_alg, secretstore,
 				    (int)secretsize, mctx, &tsigkey);
 failure:
 	if (result != ISC_R_SUCCESS) {
@@ -898,7 +902,6 @@ failure:
 	}

 	isc_mem_free(mctx, secretstore);
-	dns_name_invalidate(&keyname);
 	isc_buffer_free(&namebuf);
 }

@@ -1939,6 +1942,7 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section) {
 				}
 				domain = dns_fixedname_name(&lookup->fdomain);
 				dns_name_copy(name, domain);
+				lookup->edns = lookup->original_edns;
 			}
 			debug("adding server %s", namestr);
 			num = getaddresses(lookup, namestr, &lresult);
@@ -2082,8 +2086,8 @@ insert_soa(dig_lookup_t *lookup) {
 	soa.common.rdclass = lookup->rdclass;
 	soa.common.rdtype = dns_rdatatype_soa;

-	dns_name_init(&soa.origin, NULL);
-	dns_name_init(&soa.contact, NULL);
+	dns_name_init(&soa.origin);
+	dns_name_init(&soa.contact);

 	dns_name_clone(dns_rootname, &soa.origin);
 	dns_name_clone(dns_rootname, &soa.contact);
@@ -2206,11 +2210,6 @@ setup_lookup(dig_lookup_t *lookup) {
 	}
 	dns_message_gettempname(lookup->sendmsg, &lookup->name);

-	isc_buffer_init(&lookup->namebuf, lookup->name_space,
-			sizeof(lookup->name_space));
-	isc_buffer_init(&lookup->onamebuf, lookup->oname_space,
-			sizeof(lookup->oname_space));
-
 	/*
 	 * We cannot convert `textname' and `origin' separately.
 	 * `textname' doesn't contain TLD, but local mapping needs
@@ -2258,8 +2257,7 @@ setup_lookup(dig_lookup_t *lookup) {
 		len = (unsigned int)strlen(origin);
 		isc_buffer_init(&b, origin, len);
 		isc_buffer_add(&b, len);
-		result = dns_name_fromtext(lookup->oname, &b, dns_rootname, 0,
-					   &lookup->onamebuf);
+		result = dns_name_fromtext(lookup->oname, &b, dns_rootname, 0);
 		if (result != ISC_R_SUCCESS) {
 			dns_message_puttempname(lookup->sendmsg, &lookup->name);
 			dns_message_puttempname(lookup->sendmsg,
@@ -2277,12 +2275,12 @@ setup_lookup(dig_lookup_t *lookup) {
 			len = (unsigned int)strlen(textname);
 			isc_buffer_init(&b, textname, len);
 			isc_buffer_add(&b, len);
-			result = dns_name_fromtext(name, &b, NULL, 0, NULL);
+			result = dns_name_fromtext(name, &b, NULL, 0);
 			if (result == ISC_R_SUCCESS) {
 				if (!dns_name_isabsolute(name)) {
 					result = dns_name_concatenate(
 						name, lookup->oname,
-						lookup->name, &lookup->namebuf);
+						lookup->name);
 				} else {
 					dns_name_copy(name, lookup->name);
 				}
@@ -2310,8 +2308,7 @@ setup_lookup(dig_lookup_t *lookup) {
 			isc_buffer_init(&b, textname, len);
 			isc_buffer_add(&b, len);
 			result = dns_name_fromtext(lookup->name, &b,
-						   dns_rootname, 0,
-						   &lookup->namebuf);
+						   dns_rootname, 0);
 			if (result != ISC_R_SUCCESS) {
 				dns_message_puttempname(lookup->sendmsg,
 							&lookup->name);
@@ -2464,7 +2461,8 @@ setup_lookup(dig_lookup_t *lookup) {
 			lookup->udpsize = DEFAULT_EDNS_BUFSIZE;
 		}
 		if (lookup->edns < 0) {
-			lookup->edns = DEFAULT_EDNS_VERSION;
+			lookup->original_edns = lookup->edns =
+				DEFAULT_EDNS_VERSION;
 		}

 		if (lookup->nsid) {
@@ -2594,6 +2592,14 @@ setup_lookup(dig_lookup_t *lookup) {
 			i++;
 		}

+		if (lookup->zoneversion) {
+			INSIST(i < MAXOPTS);
+			opts[i].code = DNS_OPT_ZONEVERSION;
+			opts[i].length = 0;
+			opts[i].value = NULL;
+			i++;
+		}
+
 		if (lookup->ednsoptscnt != 0) {
 			INSIST(i + lookup->ednsoptscnt <= MAXOPTS);
 			memmove(&opts[i], lookup->ednsopts,
@@ -4308,6 +4314,11 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
 	if (msg->rcode == dns_rcode_badvers && msg->opt != NULL &&
 	    (newedns = ednsvers(msg->opt)) < l->edns && l->ednsneg)
 	{
+		if (l->showbadvers) {
+			dighost_printmessage(query, &b, msg, true);
+			dighost_received(isc_buffer_usedlength(&b), &peer,
+					 query);
+		}
 		/*
 		 * Add minimum EDNS version required checks here if needed.
 		 */
@@ -117,11 +117,11 @@ struct dig_lookup {
 		section_answer, section_authority, section_question,
 		seenbadcookie, sendcookie, servfail_stops,
 		setqid, /*% use a speciied query ID */
-		showbadcookie, stats, tcflag, tcp_keepalive, tcp_mode,
-		tcp_mode_set, tls_mode, /*% connect using TLS */
-		trace,			/*% dig +trace */
+		showbadcookie, showbadvers, stats, tcflag, tcp_keepalive,
+		tcp_mode, tcp_mode_set, tls_mode, /*% connect using TLS */
+		trace,				  /*% dig +trace */
 		trace_root, /*% initial query for either +trace or +nssearch */
-		ttlunits, use_usec, waiting_connect, zflag;
+		ttlunits, use_usec, waiting_connect, zflag, zoneversion;
 	char textname[MXNAME]; /*% Name we're going to be looking up */
 	char cmdline[MXNAME];
 	dns_rdatatype_t rdtype;
@@ -131,8 +131,6 @@ struct dig_lookup {
 	bool rdclassset;
 	char name_space[BUFSIZE];
 	char oname_space[BUFSIZE];
-	isc_buffer_t namebuf;
-	isc_buffer_t onamebuf;
 	isc_buffer_t renderbuf;
 	char *sendspace;
 	dns_name_t *name;
@@ -150,6 +148,7 @@ struct dig_lookup {
 	int nsfound;
 	int16_t udpsize;
 	int16_t edns;
+	int16_t original_edns;
 	int16_t padding;
 	uint32_t ixfr_serial;
 	isc_buffer_t rdatabuf;
@@ -21,6 +21,7 @@

 #include <isc/attributes.h>
 #include <isc/commandline.h>
+#include <isc/lib.h>
 #include <isc/loop.h>
 #include <isc/netaddr.h>
 #include <isc/string.h>
@@ -28,6 +29,7 @@

 #include <dns/byaddr.h>
 #include <dns/fixedname.h>
+#include <dns/lib.h>
 #include <dns/message.h>
 #include <dns/name.h>
 #include <dns/rdata.h>
@@ -80,6 +82,7 @@ struct rtype rtypes[] = { { 1, "has address" },
 			  { 25, "has key" },
 			  { 28, "has IPv6 address" },
 			  { 29, "location" },
+			  { dns_rdatatype_https, "has HTTP service bindings" },
 			  { 0, NULL } };

 static char *
@@ -218,7 +221,7 @@ printsection(dns_message_t *msg, dns_section_t sectionid,
 		printf(";; %s SECTION:\n", section_name);
 	}

-	dns_name_init(&empty_name, NULL);
+	dns_name_init(&empty_name);

 	result = dns_message_firstname(msg, sectionid);
 	if (result == ISC_R_NOMORE) {
@@ -243,8 +246,7 @@ printsection(dns_message_t *msg, dns_section_t sectionid,
 			       (list_type == dns_rdatatype_any ||
 				rdataset->type == list_type)) ||
 			      (list_addresses &&
-			       (rdataset->type == dns_rdatatype_a ||
-				rdataset->type == dns_rdatatype_aaaa ||
+			       (dns_rdatatype_isaddr(rdataset->type) ||
 				rdataset->type == dns_rdatatype_ns ||
 				rdataset->type == dns_rdatatype_ptr))))
 			{
@@ -457,6 +459,16 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 			lookup->retries = tries;
 			ISC_LIST_APPEND(lookup_list, lookup, link);
 		}
+		lookup = clone_lookup(query->lookup, false);
+		if (lookup != NULL) {
+			strlcpy(lookup->textname, namestr,
+				sizeof(lookup->textname));
+			lookup->rdtype = dns_rdatatype_https;
+			lookup->rdtypeset = true;
+			lookup->origin = NULL;
+			lookup->retries = tries;
+			ISC_LIST_APPEND(lookup_list, lookup, link);
+		}
 	}

 	if (!short_form) {
@@ -122,7 +122,7 @@ Options
   CNAME, NS, SOA, TXT, DNSKEY, AXFR, etc.

   When no query type is specified, :program:`host` automatically selects an
-   appropriate query type. By default, it looks for A, AAAA, and MX
+   appropriate query type. By default, it looks for A, AAAA, MX, and HTTPS
   records. If the :option:`-C` option is given, queries are made for SOA
   records. If ``name`` is a dotted-decimal IPv4 address or
   colon-delimited IPv6 address, :program:`host` queries for PTR records.
@@ -20,7 +20,7 @@
 #include <isc/attributes.h>
 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/condition.h>
+#include <isc/lib.h>
 #include <isc/loop.h>
 #include <isc/netaddr.h>
 #include <isc/parseint.h>
@@ -30,6 +30,7 @@

 #include <dns/byaddr.h>
 #include <dns/fixedname.h>
+#include <dns/lib.h>
 #include <dns/message.h>
 #include <dns/name.h>
 #include <dns/rdata.h>
@@ -41,6 +41,14 @@ dnssec_keygen_LDADD =		\
 	$(LDADD)		\
 	$(OPENSSL_LIBS)

+dnssec_ksr_CPPFLAGS=		\
+	$(AM_CPPFLAGS)		\
+	$(OPENSSL_CFLAGS)
+
+dnssec_ksr_LDADD =		\
+	$(LDADD)		\
+	$(OPENSSL_LIBS)
+
 dnssec_signzone_CPPFLAGS =	\
 	$(AM_CPPFLAGS)		\
 	$(OPENSSL_CFLAGS)
@@ -29,6 +29,7 @@
 #include <isc/dir.h>
 #include <isc/file.h>
 #include <isc/hash.h>
+#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
@@ -44,6 +45,7 @@
 #include <dns/ds.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
+#include <dns/lib.h>
 #include <dns/master.h>
 #include <dns/name.h>
 #include <dns/rdata.h>
@@ -176,7 +178,7 @@ initname(char *setname) {

 	isc_buffer_init(&buf, setname, strlen(setname));
 	isc_buffer_add(&buf, strlen(setname));
-	result = dns_name_fromtext(name, &buf, dns_rootname, 0, NULL);
+	result = dns_name_fromtext(name, &buf, dns_rootname, 0);
 	if (result != ISC_R_SUCCESS) {
 		fatal("could not initialize name %s", setname);
 	}
@@ -1073,7 +1075,7 @@ cleanup(void) {
 		if (print_mem_stats && verbose > 10) {
 			isc_mem_stats(mctx, stdout);
 		}
-		isc_mem_destroy(&mctx);
+		isc_mem_detach(&mctx);
 	}
 }

@@ -22,6 +22,7 @@
 #include <isc/commandline.h>
 #include <isc/dir.h>
 #include <isc/hash.h>
+#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
@@ -34,6 +35,7 @@
 #include <dns/ds.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
+#include <dns/lib.h>
 #include <dns/master.h>
 #include <dns/name.h>
 #include <dns/rdata.h>
@@ -65,7 +67,7 @@ initname(char *setname) {

 	isc_buffer_init(&buf, setname, strlen(setname));
 	isc_buffer_add(&buf, strlen(setname));
-	result = dns_name_fromtext(name, &buf, dns_rootname, 0, NULL);
+	result = dns_name_fromtext(name, &buf, dns_rootname, 0);
 	return result;
 }

@@ -541,7 +543,7 @@ main(int argc, char **argv) {
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
-	isc_mem_destroy(&mctx);
+	isc_mem_detach(&mctx);

 	fflush(stdout);
 	if (ferror(stdout)) {
@@ -20,6 +20,7 @@
 #include <isc/buffer.h>
 #include <isc/commandline.h>
 #include <isc/hash.h>
+#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
@@ -32,6 +33,7 @@
 #include <dns/ds.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
+#include <dns/lib.h>
 #include <dns/master.h>
 #include <dns/name.h>
 #include <dns/rdata.h>
@@ -67,7 +69,7 @@ initname(char *setname) {

 	isc_buffer_init(&buf, setname, strlen(setname));
 	isc_buffer_add(&buf, strlen(setname));
-	result = dns_name_fromtext(name, &buf, dns_rootname, 0, NULL);
+	result = dns_name_fromtext(name, &buf, dns_rootname, 0);
 	return result;
 }

@@ -454,7 +456,7 @@ main(int argc, char **argv) {
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
-	isc_mem_destroy(&mctx);
+	isc_mem_detach(&mctx);

 	fflush(stdout);
 	if (ferror(stdout)) {
@@ -21,6 +21,7 @@
 #include <isc/attributes.h>
 #include <isc/buffer.h>
 #include <isc/commandline.h>
+#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/region.h>
@@ -31,6 +32,7 @@
 #include <dns/dnssec.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
+#include <dns/lib.h>
 #include <dns/name.h>
 #include <dns/rdataclass.h>
 #include <dns/secalg.h>
@@ -365,7 +367,7 @@ main(int argc, char **argv) {
 		isc_buffer_init(&buf, argv[isc_commandline_index],
 				strlen(argv[isc_commandline_index]));
 		isc_buffer_add(&buf, strlen(argv[isc_commandline_index]));
-		ret = dns_name_fromtext(name, &buf, dns_rootname, 0, NULL);
+		ret = dns_name_fromtext(name, &buf, dns_rootname, 0);
 		if (ret != ISC_R_SUCCESS) {
 			fatal("invalid key name %s: %s",
 			      argv[isc_commandline_index],
@@ -744,7 +746,7 @@ main(int argc, char **argv) {
 		isc_mem_stats(mctx, stdout);
 	}
 	isc_mem_free(mctx, label);
-	isc_mem_destroy(&mctx);
+	isc_mem_detach(&mctx);

 	if (freeit != NULL) {
 		free(freeit);
@@ -38,7 +38,8 @@
 #include <isc/attributes.h>
 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/fips.h>
+#include <isc/crypto.h>
+#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/region.h>
@@ -50,17 +51,13 @@
 #include <dns/fixedname.h>
 #include <dns/kasp.h>
 #include <dns/keyvalues.h>
+#include <dns/lib.h>
 #include <dns/name.h>
 #include <dns/rdataclass.h>
 #include <dns/secalg.h>

 #include <dst/dst.h>

-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-#include <openssl/err.h>
-#include <openssl/provider.h>
-#endif
-
 #include "dnssectool.h"

 const char *program = "dnssec-keygen";
@@ -149,7 +146,7 @@ usage(void) {
 	fprintf(stderr, "    -l <file>: configuration file with dnssec-policy "
 			"statement\n");
 	fprintf(stderr, "    -a <algorithm>:\n");
-	if (!isc_fips_mode()) {
+	if (!isc_crypto_fips_mode()) {
 		fprintf(stderr, "        RSASHA1 | NSEC3RSASHA1 |\n");
 	}
 	fprintf(stderr, "        RSASHA256 | RSASHA512 |\n");
@@ -157,7 +154,7 @@ usage(void) {
 	fprintf(stderr, "        ED25519 | ED448\n");
 	fprintf(stderr, "    -3: use NSEC3-capable algorithm\n");
 	fprintf(stderr, "    -b <key size in bits>:\n");
-	if (!isc_fips_mode()) {
+	if (!isc_crypto_fips_mode()) {
 		fprintf(stderr, "        RSASHA1:\t[%d..%d]\n", min_rsa,
 			MAX_RSA);
 		fprintf(stderr, "        NSEC3RSASHA1:\t[%d..%d]\n", min_rsa,
@@ -275,7 +272,7 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 		isc_buffer_init(&buf, argv[isc_commandline_index],
 				strlen(argv[isc_commandline_index]));
 		isc_buffer_add(&buf, strlen(argv[isc_commandline_index]));
-		ret = dns_name_fromtext(name, &buf, dns_rootname, 0, NULL);
+		ret = dns_name_fromtext(name, &buf, dns_rootname, 0);
 		if (ret != ISC_R_SUCCESS) {
 			fatal("invalid key name %s: %s",
 			      argv[isc_commandline_index],
@@ -286,7 +283,7 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 			fatal("unsupported algorithm: %s", algstr);
 		}

-		if (isc_fips_mode()) {
+		if (isc_crypto_fips_mode()) {
 			/* verify only in FIPS mode */
 			switch (ctx->alg) {
 			case DST_ALG_RSASHA1:
@@ -339,7 +336,7 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 			switch (ctx->alg) {
 			case DST_ALG_RSASHA1:
 			case DST_ALG_NSEC3RSASHA1:
-				if (isc_fips_mode()) {
+				if (isc_crypto_fips_mode()) {
 					fatal("key size not specified (-b "
 					      "option)");
 				}
@@ -499,7 +496,7 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 	switch (ctx->alg) {
 	case DNS_KEYALG_RSASHA1:
 	case DNS_KEYALG_NSEC3RSASHA1:
-		if (isc_fips_mode()) {
+		if (isc_crypto_fips_mode()) {
 			fatal("SHA1 based keys not supported in FIPS mode");
 		}
 		FALLTHROUGH;
@@ -845,10 +842,6 @@ main(int argc, char **argv) {
 	isc_textregion_t r;
 	unsigned char c;
 	int ch;
-	bool set_fips_mode = false;
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-	OSSL_PROVIDER *fips = NULL, *base = NULL;
-#endif

 	keygen_ctx_t ctx = {
 		.options = DST_TYPE_PRIVATE | DST_TYPE_PUBLIC,
@@ -1107,7 +1100,9 @@ main(int argc, char **argv) {
 			ctx.prepub = strtottl(isc_commandline_argument);
 			break;
 		case 'F':
-			set_fips_mode = true;
+			if (isc_crypto_fips_enable() != ISC_R_SUCCESS) {
+				fatal("setting FIPS mode failed");
+			}
 			break;
 		case '?':
 			if (isc_commandline_option != '?') {
@@ -1134,32 +1129,11 @@ main(int argc, char **argv) {
 		ctx.quiet = true;
 	}

-	if (set_fips_mode) {
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-		fips = OSSL_PROVIDER_load(NULL, "fips");
-		if (fips == NULL) {
-			ERR_clear_error();
-			fatal("Failed to load FIPS provider");
-		}
-		base = OSSL_PROVIDER_load(NULL, "base");
-		if (base == NULL) {
-			OSSL_PROVIDER_unload(fips);
-			ERR_clear_error();
-			fatal("Failed to load base provider");
-		}
-#endif
-		if (!isc_fips_mode()) {
-			if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
-				fatal("setting FIPS mode failed");
-			}
-		}
-	}
-
 	/*
 	 * The DST subsystem will set FIPS mode if requested at build time.
 	 * The minimum sizes are both raised to 2048.
 	 */
-	if (isc_fips_mode()) {
+	if (isc_crypto_fips_mode()) {
 		min_rsa = min_dh = 2048;
 	}

@@ -1306,16 +1280,8 @@ main(int argc, char **argv) {
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
-	isc_mem_destroy(&mctx);
+	isc_mem_detach(&mctx);

-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-	if (base != NULL) {
-		OSSL_PROVIDER_unload(base);
-	}
-	if (fips != NULL) {
-		OSSL_PROVIDER_unload(fips);
-	}
-#endif
 	if (freeit != NULL) {
 		free(freeit);
 	}
@@ -18,8 +18,9 @@

 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/fips.h>
+#include <isc/crypto.h>
 #include <isc/lex.h>
+#include <isc/lib.h>
 #include <isc/mem.h>

 #include <dns/callbacks.h>
@@ -27,6 +28,7 @@
 #include <dns/fixedname.h>
 #include <dns/keymgr.h>
 #include <dns/keyvalues.h>
+#include <dns/lib.h>
 #include <dns/rdataclass.h>
 #include <dns/rdatalist.h>
 #include <dns/rdataset.h>
@@ -360,7 +362,7 @@ create_key(ksr_ctx_t *ksr, dns_kasp_t *kasp, dns_kasp_key_t *kaspkey,
 	switch (ksr->alg) {
 	case DST_ALG_RSASHA1:
 	case DST_ALG_NSEC3RSASHA1:
-		if (isc_fips_mode()) {
+		if (isc_crypto_fips_mode()) {
 			/* verify-only in FIPS mode */
 			fatal("unsupported algorithm: %s", algstr);
 		}
@@ -1006,7 +1008,7 @@ parse_dnskey(isc_lex_t *lex, char *owner, isc_buffer_t *buf, dns_ttl_t *ttl) {
 	dname = dns_fixedname_initname(&dfname);
 	isc_buffer_init(&b, owner, strlen(owner));
 	isc_buffer_add(&b, strlen(owner));
-	ret = dns_name_fromtext(dname, &b, dns_rootname, 0, NULL);
+	ret = dns_name_fromtext(dname, &b, dns_rootname, 0);
 	if (ret != ISC_R_SUCCESS) {
 		return ret;
 	}
@@ -1346,10 +1348,6 @@ main(int argc, char *argv[]) {
 	isc_buffer_t buf;
 	int ch;
 	char *endp;
-	bool set_fips_mode = false;
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-	OSSL_PROVIDER *fips = NULL, *base = NULL;
-#endif
 	ksr_ctx_t ksr = {
 		.now = isc_stdtime_now(),
 	};
@@ -1369,7 +1367,9 @@ main(int argc, char *argv[]) {
 					    ksr.now, &ksr.setend);
 			break;
 		case 'F':
-			set_fips_mode = true;
+			if (isc_crypto_fips_enable() != ISC_R_SUCCESS) {
+				fatal("setting FIPS mode failed");
+			}
 			break;
 		case 'f':
 			ksr.file = isc_commandline_argument;
@@ -1423,37 +1423,18 @@ main(int argc, char *argv[]) {
 	 * The DST subsystem will set FIPS mode if requested at build time.
 	 * The minimum sizes are both raised to 2048.
 	 */
-	if (isc_fips_mode()) {
+	if (isc_crypto_fips_mode()) {
 		min_rsa = min_dh = 2048;
 	}

 	setup_logging();

-	if (set_fips_mode) {
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-		fips = OSSL_PROVIDER_load(NULL, "fips");
-		if (fips == NULL) {
-			fatal("Failed to load FIPS provider");
-		}
-		base = OSSL_PROVIDER_load(NULL, "base");
-		if (base == NULL) {
-			OSSL_PROVIDER_unload(fips);
-			fatal("Failed to load base provider");
-		}
-#endif
-		if (!isc_fips_mode()) {
-			if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
-				fatal("setting FIPS mode failed");
-			}
-		}
-	}
-
 	/* zone */
 	namestr = argv[1];
 	name = dns_fixedname_initname(&fname);
 	isc_buffer_init(&buf, argv[1], strlen(argv[1]));
 	isc_buffer_add(&buf, strlen(argv[1]));
-	ret = dns_name_fromtext(name, &buf, dns_rootname, 0, NULL);
+	ret = dns_name_fromtext(name, &buf, dns_rootname, 0);
 	if (ret != ISC_R_SUCCESS) {
 		fatal("invalid zone name %s: %s", argv[1],
 		      isc_result_totext(ret));
@@ -23,12 +23,14 @@
 #include <isc/commandline.h>
 #include <isc/file.h>
 #include <isc/hash.h>
+#include <isc/lib.h>
 #include <isc/mem.h>
 #include <isc/result.h>
 #include <isc/string.h>
 #include <isc/util.h>

 #include <dns/keyvalues.h>
+#include <dns/lib.h>

 #include <dst/dst.h>

@@ -246,7 +248,7 @@ cleanup:
 	if (dir != NULL) {
 		isc_mem_free(mctx, dir);
 	}
-	isc_mem_destroy(&mctx);
+	isc_mem_detach(&mctx);

 	return 0;
 }
@@ -25,6 +25,7 @@
 #include <isc/commandline.h>
 #include <isc/file.h>
 #include <isc/hash.h>
+#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
@@ -33,6 +34,7 @@
 #include <isc/util.h>

 #include <dns/keyvalues.h>
+#include <dns/lib.h>

 #include <dst/dst.h>

@@ -947,7 +949,7 @@ main(int argc, char **argv) {
 		isc_mem_stats(mctx, stdout);
 	}
 	isc_mem_free(mctx, directory);
-	isc_mem_destroy(&mctx);
+	isc_mem_detach(&mctx);

 	return 0;
 }
@@ -42,9 +42,9 @@
 #include <isc/commandline.h>
 #include <isc/dir.h>
 #include <isc/file.h>
-#include <isc/fips.h>
 #include <isc/hash.h>
 #include <isc/hex.h>
+#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/loop.h>
 #include <isc/managers.h>
@@ -71,6 +71,7 @@
 #include <dns/fixedname.h>
 #include <dns/kasp.h>
 #include <dns/keyvalues.h>
+#include <dns/lib.h>
 #include <dns/master.h>
 #include <dns/masterdump.h>
 #include <dns/nsec.h>
@@ -88,10 +89,6 @@
 #include <dns/zoneverify.h>

 #include <dst/dst.h>
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-#include <openssl/err.h>
-#include <openssl/provider.h>
-#endif

 #include "dnssectool.h"

@@ -550,7 +547,7 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 		future = isc_serial_lt(now, rrsig.timesigned);

 		key = keythatsigned(&rrsig);
-		offline = key->pubkey;
+		offline = (key != NULL) ? key->pubkey : false;
 		sig_format(&rrsig, sigstr, sizeof(sigstr));
 		expired = isc_serial_gt(now, rrsig.timeexpire);
 		refresh = isc_serial_gt(now + cycle, rrsig.timeexpire);
@@ -957,7 +954,7 @@ addnowildcardhash(hashlist_t *l,

 	wild = dns_fixedname_initname(&fixed);

-	result = dns_name_concatenate(dns_wildcardname, name, wild, NULL);
+	result = dns_name_concatenate(dns_wildcardname, name, wild);
 	if (result == ISC_R_NOSPACE) {
 		return;
 	}
@@ -2032,7 +2029,7 @@ addnsec3(dns_name_t *name, dns_dbnode_t *node, const unsigned char *salt,
 	dns_fixedname_init(&hashname);
 	dns_rdataset_init(&rdataset);

-	dns_name_downcase(name, name, NULL);
+	dns_name_downcase(name, name);
 	result = dns_nsec3_hashname(&hashname, hash, &hash_len, name, gorigin,
 				    dns_hash_sha1, iterations, salt, salt_len);
 	check_result(result, "addnsec3: dns_nsec3_hashname()");
@@ -2400,7 +2397,7 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 			fatal("iterating through the database failed: %s",
 			      isc_result_totext(result));
 		}
-		dns_name_downcase(name, name, NULL);
+		dns_name_downcase(name, name);
 		hashlist_add_dns_name(hashlist, name, hashalg, iterations, salt,
 				      salt_len, false);
 		dns_db_detachnode(gdb, &node);
@@ -2410,7 +2407,7 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 		 * node for another <name,nextname> span so we don't add
 		 * it here.  Empty labels on nextname are within the span.
 		 */
-		dns_name_downcase(nextname, nextname, NULL);
+		dns_name_downcase(nextname, nextname);
 		dns_name_fullcompare(name, nextname, &order, &nlabels);
 		addnowildcardhash(hashlist, name, hashalg, iterations, salt,
 				  salt_len);
@@ -2577,7 +2574,7 @@ loadzone(char *file, char *origin, dns_rdataclass_t rdclass, dns_db_t **db) {
 	isc_buffer_add(&b, len);

 	name = dns_fixedname_initname(&fname);
-	result = dns_name_fromtext(name, &b, dns_rootname, 0, NULL);
+	result = dns_name_fromtext(name, &b, dns_rootname, 0);
 	if (result != ISC_R_SUCCESS) {
 		fatal("failed converting name '%s' to dns format: %s", origin,
 		      isc_result_totext(result));
@@ -3378,10 +3375,6 @@ main(int argc, char *argv[]) {
 	bool set_optout = false;
 	bool set_iter = false;
 	bool nonsecify = false;
-	bool set_fips_mode = false;
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-	OSSL_PROVIDER *fips = NULL, *base = NULL;
-#endif

 	atomic_init(&shuttingdown, false);
 	atomic_init(&finished, false);
@@ -3670,7 +3663,9 @@ main(int argc, char *argv[]) {
 			break;

 		case 'F':
-			set_fips_mode = true;
+			if (isc_crypto_fips_enable() != ISC_R_SUCCESS) {
+				fatal("setting FIPS mode failed");
+			}
 			break;

 		case '?':
@@ -3741,27 +3736,6 @@ main(int argc, char *argv[]) {

 	isc_managers_create(&mctx, nloops, &loopmgr, &netmgr);

-	if (set_fips_mode) {
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-		fips = OSSL_PROVIDER_load(NULL, "fips");
-		if (fips == NULL) {
-			ERR_clear_error();
-			fatal("Failed to load FIPS provider");
-		}
-		base = OSSL_PROVIDER_load(NULL, "base");
-		if (base == NULL) {
-			OSSL_PROVIDER_unload(fips);
-			ERR_clear_error();
-			fatal("Failed to load base provider");
-		}
-#endif
-		if (!isc_fips_mode()) {
-			if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
-				fatal("setting FIPS mode failed");
-			}
-		}
-	}
-
 	setup_logging();

 	argc -= isc_commandline_index;
@@ -4133,15 +4107,6 @@ main(int argc, char *argv[]) {
 		isc_mem_stats(mctx, stdout);
 	}

-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-	if (base != NULL) {
-		OSSL_PROVIDER_unload(base);
-	}
-	if (fips != NULL) {
-		OSSL_PROVIDER_unload(fips);
-	}
-#endif
-
 	isc_managers_destroy(&mctx, &loopmgr, &netmgr);

 	if (printstats) {
@@ -23,6 +23,7 @@
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/hex.h>
+#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/mutex.h>
@@ -43,6 +44,7 @@
 #include <dns/ds.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
+#include <dns/lib.h>
 #include <dns/master.h>
 #include <dns/masterdump.h>
 #include <dns/nsec.h>
@@ -103,7 +105,7 @@ loadzone(char *file, char *origin, dns_rdataclass_t rdclass, dns_db_t **db) {
 	isc_buffer_add(&b, len);

 	name = dns_fixedname_initname(&fname);
-	result = dns_name_fromtext(name, &b, dns_rootname, 0, NULL);
+	result = dns_name_fromtext(name, &b, dns_rootname, 0);
 	if (result != ISC_R_SUCCESS) {
 		fatal("failed converting name '%s' to dns format: %s", origin,
 		      isc_result_totext(result));
@@ -328,7 +330,7 @@ main(int argc, char *argv[]) {
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
-	isc_mem_destroy(&mctx);
+	isc_mem_detach(&mctx);

 	return result == ISC_R_SUCCESS ? 0 : 1;
 }
@@ -931,6 +931,7 @@
                  <th>Messages Received</th>
                  <th>Records Received</th>
                  <th>Bytes Received</th>
+                  <th>Transfer Rate (B/s)</th>
                </tr>
              </thead>
              <tbody>
@@ -959,6 +960,7 @@
                    <td><xsl:value-of select="nmsg"/></td>
                    <td><xsl:value-of select="nrecs"/></td>
                    <td><xsl:value-of select="nbytes"/></td>
+                    <td><xsl:value-of select="rate"/></td>
                  </tr>
                </xsl:for-each>
              </tbody>
@@ -459,7 +459,7 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {

 static isc_result_t
 builtin_lookup(bdb_t *bdb, const dns_name_t *name, bdbnode_t *node) {
-	if (name->labels == 0 && name->length == 0) {
+	if (name->length == 0) {
 		return bdb->lookup(node);
 	} else if ((node->bdb->implementation->flags & BDB_DNS64) != 0) {
 		return dns64_cname(&bdb->common.origin, name, node);
@@ -839,7 +839,7 @@ getoriginnode(dns_db_t *db, dns_dbnode_t **nodep DNS__DB_FLARG) {
 	REQUIRE(VALID_BDB(bdb));
 	REQUIRE(nodep != NULL && *nodep == NULL);

-	dns_name_init(&relname, NULL);
+	dns_name_init(&relname);
 	name = &relname;

 	result = createnode(bdb, &node);
@@ -881,7 +881,7 @@ findnode(dns_db_t *db, const dns_name_t *name, bool create,
 	isorigin = dns_name_equal(name, &bdb->common.origin);

 	labels = dns_name_countlabels(name) - dns_name_countlabels(&db->origin);
-	dns_name_init(&relname, NULL);
+	dns_name_init(&relname);
 	dns_name_getlabelsequence(name, 0, labels, &relname);
 	name = &relname;

@@ -1197,8 +1197,8 @@ create(isc_mem_t *mctx, const dns_name_t *origin, dns_dbtype_t type,

 	isc_refcount_init(&bdb->common.references, 1);
 	isc_mem_attach(mctx, &bdb->common.mctx);
-	dns_name_init(&bdb->common.origin, NULL);
-	dns_name_dupwithoffsets(origin, mctx, &bdb->common.origin);
+	dns_name_init(&bdb->common.origin);
+	dns_name_dup(origin, mctx, &bdb->common.origin);

 	INSIST(argc >= 1);
 	if (strcmp(argv[0], "authors") == 0) {
@@ -99,6 +99,7 @@ options {\n\
 	recursing-file \"named.recursing\";\n\
 	recursive-clients 1000;\n\
 	request-nsid false;\n\
+	request-zoneversion false;\n\
 	resolver-query-timeout 10;\n\
 #	responselog <boolean>;\n\
 	rrset-order { order random; };\n\
@@ -111,6 +112,8 @@ options {\n\
 	session-keyname local-ddns;\n\
 	startup-notify-rate 20;\n\
 	sig0checks-quota 1;\n\
+	sig0key-checks-limit 16;\n\
+	sig0message-checks-limit 2;\n\
 	statistics-file \"named.stats\";\n\
 	tcp-advertised-timeout 300;\n\
 	tcp-clients 150;\n\
@@ -118,7 +121,6 @@ options {\n\
 	tcp-initial-timeout 300;\n\
 	tcp-keepalive-timeout 300;\n\
 	tcp-listen-queue 10;\n\
-	tcp-primaries-timeout 150;\n\
 	tcp-receive-buffer 0;\n\
 	tcp-send-buffer 0;\n\
 #	tkey-domain <none>\n\
@@ -233,10 +235,12 @@ options {\n\
 	max-transfer-time-out 120;\n\
 	min-refresh-time 300;\n\
 	min-retry-time 500;\n\
+	min-transfer-rate-in 10240 5;\n\
 	multi-master no;\n\
 	notify yes;\n\
 	notify-delay 5;\n\
 	notify-to-soa no;\n\
+	provide-zoneversion yes;\n\
 	send-report-channel .;\n\
 	serial-update-method increment;\n\
 	sig-signing-nodes 100;\n\
@@ -258,6 +262,7 @@ view \"_bind\" chaos {\n\
 	notify no;\n\
 	allow-new-zones no;\n\
 	max-cache-size 2M;\n\
+	provide-zoneversion no;\n\
 \n\
 	# Prevent use of this zone in DNS amplified reflection DoS attacks\n\
 	rate-limit {\n\
@@ -549,14 +554,14 @@ named_config_getname(isc_mem_t *mctx, const cfg_obj_t *obj,
 	}

 	*namep = isc_mem_get(mctx, sizeof(**namep));
-	dns_name_init(*namep, NULL);
+	dns_name_init(*namep);

 	objstr = cfg_obj_asstring(obj);
 	isc_buffer_constinit(&b, objstr, strlen(objstr));
 	isc_buffer_add(&b, strlen(objstr));
 	dns_fixedname_init(&fname);
 	result = dns_name_fromtext(dns_fixedname_name(&fname), &b, dns_rootname,
-				   0, NULL);
+				   0);
 	if (result != ISC_R_SUCCESS) {
 		isc_mem_put(mctx, *namep, sizeof(**namep));
 		*namep = NULL;
@@ -736,7 +736,6 @@ controlkeylist_fromcfg(const cfg_obj_t *keylist, isc_mem_t *mctx,
 		key->secret.length = 0;
 		ISC_LINK_INIT(key, link);
 		ISC_LIST_APPEND(*keyids, key, link);
-		newstr = NULL;
 	}
 }

@@ -25,7 +25,6 @@
 #include <string.h>
 #include <unistd.h>

-#include <isc/condition.h>
 #include <isc/log.h>
 #include <isc/loop.h>
 #include <isc/mutex.h>
@@ -86,7 +86,6 @@ EXTERN named_server_t *named_g_server INIT(NULL);
 /*
 * Logging.
 */
-EXTERN bool named_g_logging	       INIT(false);
 EXTERN unsigned int named_g_debuglevel INIT(0);

 /*
@@ -52,8 +52,6 @@ named_log_init(bool safe) {
 	named_log_setdefaultsslkeylogfile(lcfg);
 	rcu_read_unlock();

-	named_g_logging = true;
-
 	return ISC_R_SUCCESS;

 cleanup:
@@ -30,9 +30,9 @@
 #include <isc/crypto.h>
 #include <isc/dir.h>
 #include <isc/file.h>
-#include <isc/fips.h>
 #include <isc/hash.h>
 #include <isc/httpd.h>
+#include <isc/lib.h>
 #include <isc/managers.h>
 #include <isc/netmgr.h>
 #include <isc/os.h>
@@ -47,6 +47,7 @@

 #include <dns/dispatch.h>
 #include <dns/dyndb.h>
+#include <dns/lib.h>
 #include <dns/name.h>
 #include <dns/resolver.h>
 #include <dns/view.h>
@@ -89,10 +90,6 @@
 #include <openssl/crypto.h>
 #include <openssl/evp.h>
 #include <openssl/opensslv.h>
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-#include <openssl/err.h>
-#include <openssl/provider.h>
-#endif
 #ifdef HAVE_LIBXML2
 #include <libxml/parser.h>
 #include <libxml/xmlversion.h>
@@ -132,6 +129,7 @@ static int maxudp = 0;
 /*
 * -T options:
 */
+static bool cookiealwaysvalid = false;
 static bool dropedns = false;
 static bool ednsformerr = false;
 static bool ednsnotimp = false;
@@ -153,24 +151,13 @@ static bool transferstuck = false;
 static bool disable6 = false;
 static bool disable4 = false;

-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-static OSSL_PROVIDER *fips = NULL, *base = NULL;
-#endif
-
 void
 named_main_earlywarning(const char *format, ...) {
 	va_list args;

 	va_start(args, format);
-	if (named_g_logging) {
-		isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-			       ISC_LOG_WARNING, format, args);
-	} else {
-		fprintf(stderr, "%s: ", program_name);
-		vfprintf(stderr, format, args);
-		fprintf(stderr, "\n");
-		fflush(stderr);
-	}
+	isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		       ISC_LOG_WARNING, format, args);
 	va_end(args);
 }

@@ -179,18 +166,10 @@ named_main_earlyfatal(const char *format, ...) {
 	va_list args;

 	va_start(args, format);
-	if (named_g_logging) {
-		isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-			       ISC_LOG_CRITICAL, format, args);
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-			      ISC_LOG_CRITICAL,
-			      "exiting (due to early fatal error)");
-	} else {
-		fprintf(stderr, "%s: ", program_name);
-		vfprintf(stderr, format, args);
-		fprintf(stderr, "\n");
-		fflush(stderr);
-	}
+	isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		       ISC_LOG_CRITICAL, format, args);
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_CRITICAL, "exiting (due to early fatal error)");
 	va_end(args);

 	_exit(EXIT_FAILURE);
@@ -207,26 +186,19 @@ assertion_failed(const char *file, int line, isc_assertiontype_t type,
 	 * Handle assertion failures.
 	 */

-	if (named_g_logging) {
-		/*
-		 * Reset the assertion callback in case it is the log
-		 * routines causing the assertion.
-		 */
-		isc_assertion_setcallback(NULL);
+	/*
+	 * Reset the assertion callback in case it is the log
+	 * routines causing the assertion.
+	 */
+	isc_assertion_setcallback(NULL);

-		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-			      ISC_LOG_CRITICAL, "%s:%d: %s(%s) failed", file,
-			      line, isc_assertion_typetotext(type), cond);
-		isc_backtrace_log(NAMED_LOGCATEGORY_GENERAL,
-				  NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL);
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-			      ISC_LOG_CRITICAL,
-			      "exiting (due to assertion failure)");
-	} else {
-		fprintf(stderr, "%s:%d: %s(%s) failed\n", file, line,
-			isc_assertion_typetotext(type), cond);
-		fflush(stderr);
-	}
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_CRITICAL, "%s:%d: %s(%s) failed", file, line,
+		      isc_assertion_typetotext(type), cond);
+	isc_backtrace_log(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			  ISC_LOG_CRITICAL);
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_CRITICAL, "exiting (due to assertion failure)");

 	if (named_g_coreok) {
 		abort();
@@ -245,27 +217,20 @@ library_fatal_error(const char *file, int line, const char *func,
 	 * Handle isc_error_fatal() calls from our libraries.
 	 */

-	if (named_g_logging) {
-		/*
-		 * Reset the error callback in case it is the log
-		 * routines causing the assertion.
-		 */
-		isc_error_setfatal(NULL);
+	/*
+	 * Reset the error callback in case it is the log
+	 * routines causing the assertion.
+	 */
+	isc_error_setfatal(NULL);

-		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-			      ISC_LOG_CRITICAL,
-			      "%s:%d:%s(): fatal error: ", file, line, func);
-		isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-			       ISC_LOG_CRITICAL, format, args);
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-			      ISC_LOG_CRITICAL,
-			      "exiting (due to fatal error in library)");
-	} else {
-		fprintf(stderr, "%s:%d:%s(): fatal error: ", file, line, func);
-		vfprintf(stderr, format, args);
-		fprintf(stderr, "\n");
-		fflush(stderr);
-	}
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_CRITICAL, "%s:%d:%s(): fatal error: ", file, line,
+		      func);
+	isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		       ISC_LOG_CRITICAL, format, args);
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_CRITICAL,
+		      "exiting (due to fatal error in library)");

 	if (named_g_coreok) {
 		abort();
@@ -285,19 +250,11 @@ library_unexpected_error(const char *file, int line, const char *func,
 	 * Handle isc_error_unexpected() calls from our libraries.
 	 */

-	if (named_g_logging) {
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-			      ISC_LOG_ERROR,
-			      "%s:%d:%s(): unexpected error: ", file, line,
-			      func);
-		isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-			       ISC_LOG_ERROR, format, args);
-	} else {
-		fprintf(stderr, "%s:%d:%s(): fatal error: ", file, line, func);
-		vfprintf(stderr, format, args);
-		fprintf(stderr, "\n");
-		fflush(stderr);
-	}
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_ERROR, "%s:%d:%s(): unexpected error: ", file,
+		      line, func);
+	isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		       ISC_LOG_ERROR, format, args);
 }

 static void
@@ -696,7 +653,9 @@ parse_T_opt(char *option) {
 	 * force the server to behave (or misbehave) in
 	 * specified ways for testing purposes.
 	 */
-	if (!strcmp(option, "dropedns")) {
+	if (!strcmp(option, "cookiealwaysvalid")) {
+		cookiealwaysvalid = true;
+	} else if (!strcmp(option, "dropedns")) {
 		dropedns = true;
 	} else if (!strcmp(option, "ednsformerr")) {
 		ednsformerr = true;
@@ -950,25 +909,7 @@ parse_command_line(int argc, char *argv[]) {
 			named_main_earlyfatal("option '-X' has been removed");
 			break;
 		case 'F':
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-			fips = OSSL_PROVIDER_load(NULL, "fips");
-			if (fips == NULL) {
-				ERR_clear_error();
-				named_main_earlyfatal(
-					"Failed to load FIPS provider");
-			}
-			base = OSSL_PROVIDER_load(NULL, "base");
-			if (base == NULL) {
-				OSSL_PROVIDER_unload(fips);
-				ERR_clear_error();
-				named_main_earlyfatal(
-					"Failed to load base provider");
-			}
-#endif
-			if (isc_fips_mode()) { /* Already in FIPS mode. */
-				break;
-			}
-			if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
+			if (isc_crypto_fips_enable() != ISC_R_SUCCESS) {
 				named_main_earlyfatal(
 					"setting FIPS mode failed");
 			}
@@ -1282,6 +1223,9 @@ setup(void) {
 	/*
 	 * Modify server context according to command line options
 	 */
+	if (cookiealwaysvalid) {
+		ns_server_setoption(sctx, NS_SERVER_COOKIEALWAYSVALID, true);
+	}
 	if (disable4) {
 		ns_server_setoption(sctx, NS_SERVER_DISABLE4, true);
 	}
@@ -1572,15 +1516,6 @@ main(int argc, char *argv[]) {

 	named_os_shutdown();

-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-	if (base != NULL) {
-		OSSL_PROVIDER_unload(base);
-	}
-	if (fips != NULL) {
-		OSSL_PROVIDER_unload(fips);
-	}
-#endif
-
 #ifdef HAVE_GPERFTOOLS_PROFILER
 	ProfilerStop();
 #endif /* ifdef HAVE_GPERFTOOLS_PROFILER */
@@ -38,7 +38,6 @@
 #include <isc/commandline.h>
 #include <isc/dir.h>
 #include <isc/file.h>
-#include <isc/fips.h>
 #include <isc/hash.h>
 #include <isc/hex.h>
 #include <isc/hmac.h>
@@ -178,8 +177,6 @@
 #define MAX_KEEPALIVE_TIMEOUT  UINT32_C(UINT16_MAX * 100)
 #define MIN_ADVERTISED_TIMEOUT UINT32_C(0) /* No minimum */
 #define MAX_ADVERTISED_TIMEOUT UINT32_C(UINT16_MAX * 100)
-#define MIN_PRIMARIES_TIMEOUT  UINT32_C(2500)	/* 2.5 seconds */
-#define MAX_PRIMARIES_TIMEOUT  UINT32_C(120000) /* 2 minutes */

 /*%
 * Check an operation for failure.  Assumes that the function
@@ -666,7 +663,7 @@ configure_view_nametable(const cfg_obj_t *vconfig, const cfg_obj_t *config,
 		str = cfg_obj_asstring(nameobj);
 		isc_buffer_constinit(&b, str, strlen(str));
 		isc_buffer_add(&b, strlen(str));
-		CHECK(dns_name_fromtext(name, &b, dns_rootname, 0, NULL));
+		CHECK(dns_name_fromtext(name, &b, dns_rootname, 0));
 		result = dns_nametree_add(*ntp, name, true);
 		if (result != ISC_R_SUCCESS) {
 			cfg_obj_log(nameobj, ISC_LOG_ERROR,
@@ -726,7 +723,7 @@ ta_fromconfig(const cfg_obj_t *key, bool *initialp, const char **namestrp,
 	name = dns_fixedname_initname(&fname);
 	isc_buffer_constinit(&namebuf, namestr, strlen(namestr));
 	isc_buffer_add(&namebuf, strlen(namestr));
-	CHECK(dns_name_fromtext(name, &namebuf, dns_rootname, 0, NULL));
+	CHECK(dns_name_fromtext(name, &namebuf, dns_rootname, 0));

 	if (*initialp) {
 		atstr = cfg_obj_asstring(cfg_tuple_get(key, "anchortype"));
@@ -915,7 +912,7 @@ process_key(const cfg_obj_t *key, dns_keytable_t *secroots,
 		isc_buffer_constinit(&b, namestr, strlen(namestr));
 		isc_buffer_add(&b, strlen(namestr));
 		keyname = dns_fixedname_initname(&fkeyname);
-		result = dns_name_fromtext(keyname, &b, dns_rootname, 0, NULL);
+		result = dns_name_fromtext(keyname, &b, dns_rootname, 0);
 		if (result != ISC_R_SUCCESS) {
 			return result;
 		}
@@ -1308,7 +1305,7 @@ configure_order(dns_order_t *order, const cfg_obj_t *ent) {
 	isc_buffer_add(&b, strlen(str));
 	dns_fixedname_init(&fixed);
 	result = dns_name_fromtext(dns_fixedname_name(&fixed), &b, dns_rootname,
-				   0, NULL);
+				   0);
 	if (result != ISC_R_SUCCESS) {
 		return result;
 	}
@@ -1394,6 +1391,13 @@ configure_peer(const cfg_obj_t *cpeer, isc_mem_t *mctx, dns_peer_t **peerp) {
 		CHECK(dns_peer_setrequestnsid(peer, cfg_obj_asboolean(obj)));
 	}

+	obj = NULL;
+	(void)cfg_map_get(cpeer, "request-zoneversion", &obj);
+	if (obj != NULL) {
+		CHECK(dns_peer_setrequestzoneversion(peer,
+						     cfg_obj_asboolean(obj)));
+	}
+
 	obj = NULL;
 	(void)cfg_map_get(cpeer, "send-cookie", &obj);
 	if (obj != NULL) {
@@ -1593,7 +1597,7 @@ disable_algorithms(const cfg_obj_t *disabled, dns_resolver_t *resolver) {
 	str = cfg_obj_asstring(cfg_tuple_get(disabled, "name"));
 	isc_buffer_constinit(&b, str, strlen(str));
 	isc_buffer_add(&b, strlen(str));
-	CHECK(dns_name_fromtext(name, &b, dns_rootname, 0, NULL));
+	CHECK(dns_name_fromtext(name, &b, dns_rootname, 0));

 	algorithms = cfg_tuple_get(disabled, "algorithms");
 	for (element = cfg_list_first(algorithms); element != NULL;
@@ -1636,7 +1640,7 @@ disable_ds_digests(const cfg_obj_t *disabled, dns_resolver_t *resolver) {
 	str = cfg_obj_asstring(cfg_tuple_get(disabled, "name"));
 	isc_buffer_constinit(&b, str, strlen(str));
 	isc_buffer_add(&b, strlen(str));
-	CHECK(dns_name_fromtext(name, &b, dns_rootname, 0, NULL));
+	CHECK(dns_name_fromtext(name, &b, dns_rootname, 0));

 	digests = cfg_tuple_get(disabled, "digests");
 	for (element = cfg_list_first(digests); element != NULL;
@@ -1680,7 +1684,7 @@ on_disable_list(const cfg_obj_t *disablelist, dns_name_t *zonename) {
 		str = cfg_obj_asstring(value);
 		isc_buffer_constinit(&b, str, strlen(str));
 		isc_buffer_add(&b, strlen(str));
-		result = dns_name_fromtext(name, &b, dns_rootname, 0, NULL);
+		result = dns_name_fromtext(name, &b, dns_rootname, 0);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		if (dns_name_equal(name, zonename)) {
 			return true;
@@ -1863,7 +1867,7 @@ dns64_reverse(dns_view_t *view, isc_mem_t *mctx, isc_netaddr_t *na,
 	name = dns_fixedname_initname(&fixed);
 	isc_buffer_constinit(&b, reverse, strlen(reverse));
 	isc_buffer_add(&b, strlen(reverse));
-	CHECK(dns_name_fromtext(name, &b, dns_rootname, 0, NULL));
+	CHECK(dns_name_fromtext(name, &b, dns_rootname, 0));
 	dns_zone_create(&zone, mctx, 0);
 	dns_zone_setorigin(zone, name);
 	dns_zone_setview(zone, view);
@@ -2747,7 +2751,7 @@ configure_catz_zone(dns_view_t *view, dns_view_t *pview,
 	dns_name_t origin;
 	dns_catz_options_t *opts;

-	dns_name_init(&origin, NULL);
+	dns_name_init(&origin);
 	catz_obj = cfg_listelt_value(element);

 	str = cfg_obj_asstring(cfg_tuple_get(catz_obj, "zone name"));
@@ -3090,7 +3094,7 @@ add_ns(dns_db_t *db, dns_dbversion_t *version, const dns_name_t *name,
 	ns.common.rdtype = dns_rdatatype_ns;
 	ns.common.rdclass = dns_db_class(db);
 	ns.mctx = NULL;
-	dns_name_init(&ns.name, NULL);
+	dns_name_init(&ns.name);
 	dns_name_clone(nsname, &ns.name);
 	CHECK(dns_rdata_fromstruct(&rdata, dns_db_class(db), dns_rdatatype_ns,
 				   &ns, &b));
@@ -3249,6 +3253,7 @@ create_empty_zone(dns_zone_t *pzone, dns_name_t *name, dns_view_t *view,

 	dns_zone_setoption(zone, ~DNS_ZONEOPT_NOCHECKNS, false);
 	dns_zone_setoption(zone, DNS_ZONEOPT_NOCHECKNS, true);
+	dns_zone_setoption(zone, DNS_ZONEOPT_ZONEVERSION, false);
 	dns_zone_setcheckdstype(zone, dns_checkdstype_no);
 	dns_zone_setnotifytype(zone, dns_notifytype_no);
 	dns_zone_setautomatic(zone, true);
@@ -3765,7 +3770,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	uint32_t maxbits;
 	unsigned int resopts = 0;
 	dns_zone_t *zone = NULL;
-	uint32_t max_clients_per_query;
+	uint32_t clients_per_query, max_clients_per_query;
 	bool empty_zones_enable;
 	const cfg_obj_t *disablelist = NULL;
 	isc_stats_t *resstats = NULL;
@@ -4705,6 +4710,19 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	dns_view_settransports(view, transports);
 	dns_transport_list_detach(&transports);

+	/*
+	 * Configure SIG(0) check limits when matching a DNS message to a view.
+	 */
+	obj = NULL;
+	result = named_config_get(maps, "sig0key-checks-limit", &obj);
+	INSIST(result == ISC_R_SUCCESS);
+	view->sig0key_checks_limit = cfg_obj_asuint32(obj);
+
+	obj = NULL;
+	result = named_config_get(maps, "sig0message-checks-limit", &obj);
+	INSIST(result == ISC_R_SUCCESS);
+	view->sig0message_checks_limit = cfg_obj_asuint32(obj);
+
 	/*
 	 * Configure the view's TSIG keys.
 	 */
@@ -5122,6 +5140,11 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	INSIST(result == ISC_R_SUCCESS);
 	view->requestnsid = cfg_obj_asboolean(obj);

+	obj = NULL;
+	result = named_config_get(maps, "request-zoneversion", &obj);
+	INSIST(result == ISC_R_SUCCESS);
+	view->requestzoneversion = cfg_obj_asboolean(obj);
+
 	obj = NULL;
 	result = named_config_get(maps, "send-cookie", &obj);
 	INSIST(result == ISC_R_SUCCESS);
@@ -5158,15 +5181,26 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	INSIST(result == ISC_R_SUCCESS);
 	view->v6bias = cfg_obj_asuint32(obj) * 1000;

+	obj = NULL;
+	result = named_config_get(maps, "clients-per-query", &obj);
+	INSIST(result == ISC_R_SUCCESS);
+	clients_per_query = cfg_obj_asuint32(obj);
+
 	obj = NULL;
 	result = named_config_get(maps, "max-clients-per-query", &obj);
 	INSIST(result == ISC_R_SUCCESS);
 	max_clients_per_query = cfg_obj_asuint32(obj);

-	obj = NULL;
-	result = named_config_get(maps, "clients-per-query", &obj);
-	INSIST(result == ISC_R_SUCCESS);
-	dns_resolver_setclientsperquery(view->resolver, cfg_obj_asuint32(obj),
+	if (max_clients_per_query < clients_per_query) {
+		cfg_obj_log(obj, ISC_LOG_WARNING,
+			    "configured clients-per-query (%u) exceeds "
+			    "max-clients-per-query (%u); automatically "
+			    "adjusting max-clients-per-query to (%u)",
+			    clients_per_query, max_clients_per_query,
+			    clients_per_query);
+		max_clients_per_query = clients_per_query;
+	}
+	dns_resolver_setclientsperquery(view->resolver, clients_per_query,
 					max_clients_per_query);

 	/*
@@ -5865,8 +5899,8 @@ configure_alternates(const cfg_obj_t *config, dns_view_t *view,
 			isc_buffer_constinit(&buffer, str, strlen(str));
 			isc_buffer_add(&buffer, strlen(str));
 			name = dns_fixedname_initname(&fixed);
-			CHECK(dns_name_fromtext(name, &buffer, dns_rootname, 0,
-						NULL));
+			CHECK(dns_name_fromtext(name, &buffer, dns_rootname,
+						0));

 			portobj = cfg_tuple_get(alternate, "port");
 			if (cfg_obj_isuint32(portobj)) {
@@ -5921,7 +5955,7 @@ validate_tls(const cfg_obj_t *config, dns_view_t *view, const cfg_obj_t *obj,

 	if (name != NULL && *name == NULL) {
 		*name = isc_mem_get(view->mctx, sizeof(dns_name_t));
-		dns_name_init(*name, NULL);
+		dns_name_init(*name);
 		dns_name_dup(nm, view->mctx, *name);
 	}

@@ -6221,7 +6255,7 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 	isc_buffer_add(&buffer, strlen(zname));
 	dns_fixedname_init(&fixorigin);
 	CHECK(dns_name_fromtext(dns_fixedname_name(&fixorigin), &buffer,
-				dns_rootname, 0, NULL));
+				dns_rootname, 0));
 	origin = dns_fixedname_name(&fixorigin);

 	CHECK(named_config_getclass(cfg_tuple_get(zconfig, "class"),
@@ -7232,7 +7266,7 @@ configure_session_key(const cfg_obj_t **maps, named_server_t *server,
 	isc_buffer_constinit(&buffer, keynamestr, strlen(keynamestr));
 	isc_buffer_add(&buffer, strlen(keynamestr));
 	keyname = dns_fixedname_initname(&fname);
-	result = dns_name_fromtext(keyname, &buffer, dns_rootname, 0, NULL);
+	result = dns_name_fromtext(keyname, &buffer, dns_rootname, 0);
 	if (result != ISC_R_SUCCESS) {
 		return result;
 	}
@@ -7284,7 +7318,7 @@ configure_session_key(const cfg_obj_t **maps, named_server_t *server,
 		INSIST(server->session_keybits == 0);

 		server->session_keyname = isc_mem_get(mctx, sizeof(dns_name_t));
-		dns_name_init(server->session_keyname, NULL);
+		dns_name_init(server->session_keyname);
 		dns_name_dup(keyname, mctx, server->session_keyname);

 		server->session_keyfile = isc_mem_strdup(mctx, keyfile);
@@ -7790,8 +7824,7 @@ get_newzone_config(dns_view_t *view, const char *zonename,
 	isc_buffer_constinit(&b, zonename, strlen(zonename));
 	isc_buffer_add(&b, strlen(zonename));
 	name = dns_fixedname_initname(&fname);
-	CHECK(dns_name_fromtext(name, &b, dns_rootname, DNS_NAME_DOWNCASE,
-				NULL));
+	CHECK(dns_name_fromtext(name, &b, dns_rootname, DNS_NAME_DOWNCASE));
 	dns_name_format(name, zname, sizeof(zname));

 	key.mv_data = zname;
@@ -7868,7 +7901,7 @@ load_configuration(const char *filename, named_server_t *server,
 	ns_altsecretlist_t altsecrets, tmpaltsecrets;
 	uint32_t softquota = 0;
 	uint32_t max;
-	uint64_t initial, idle, keepalive, advertised, primaries;
+	uint64_t initial, idle, keepalive, advertised;
 	bool loadbalancesockets;
 	bool exclusive = true;
 	dns_aclenv_t *env =
@@ -7901,7 +7934,7 @@ load_configuration(const char *filename, named_server_t *server,
 	/*
 	 * Shut down all dyndb instances.
 	 */
-	dns_dyndb_cleanup(false);
+	dns_dyndb_cleanup();

 	/*
 	 * Parse the global default pseudo-config file.
@@ -8207,29 +8240,8 @@ load_configuration(const char *filename, named_server_t *server,
 		advertised = MAX_ADVERTISED_TIMEOUT;
 	}

-	obj = NULL;
-	result = named_config_get(maps, "tcp-primaries-timeout", &obj);
-	INSIST(result == ISC_R_SUCCESS);
-	primaries = cfg_obj_asuint32(obj) * 100;
-	if (primaries > MAX_PRIMARIES_TIMEOUT) {
-		cfg_obj_log(obj, ISC_LOG_WARNING,
-			    "tcp-primaries-timeout value is out of range: "
-			    "lowering to %" PRIu32,
-			    MAX_PRIMARIES_TIMEOUT / 100);
-		primaries = MAX_PRIMARIES_TIMEOUT;
-	} else if (primaries < MIN_PRIMARIES_TIMEOUT) {
-		cfg_obj_log(obj, ISC_LOG_WARNING,
-			    "tcp-primaries-timeout value is out of range: "
-			    "raising to %" PRIu32,
-			    MIN_PRIMARIES_TIMEOUT / 100);
-		primaries = MIN_PRIMARIES_TIMEOUT;
-	}
-
-	isc_nm_setinitialtimeout(named_g_netmgr, initial);
-	isc_nm_setprimariestimeout(named_g_netmgr, primaries);
-	isc_nm_setidletimeout(named_g_netmgr, idle);
-	isc_nm_setkeepalivetimeout(named_g_netmgr, keepalive);
-	isc_nm_setadvertisedtimeout(named_g_netmgr, advertised);
+	isc_nm_settimeouts(named_g_netmgr, initial, idle, keepalive,
+			   advertised);

 #define CAP_IF_NOT_ZERO(v, min, max) \
 	if (v > 0 && v < min) {      \
@@ -9388,7 +9400,7 @@ view_loaded(void *arg) {

 		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
 			      ISC_LOG_NOTICE, "FIPS mode is %s",
-			      isc_fips_mode() ? "enabled" : "disabled");
+			      isc_crypto_fips_mode() ? "enabled" : "disabled");

 #if HAVE_LIBSYSTEMD
 		sd_notifyf(0,
@@ -9601,7 +9613,7 @@ shutdown_server(void *arg) {
 	/*
 	 * Shut down all dyndb instances.
 	 */
-	dns_dyndb_cleanup(true);
+	dns_dyndb_cleanup();

 	while ((nsc = ISC_LIST_HEAD(server->cachelist)) != NULL) {
 		ISC_LIST_UNLINK(server->cachelist, nsc, link);
@@ -11843,7 +11855,7 @@ named_server_flushnode(named_server_t *server, isc_lex_t *lex, bool tree) {
 	isc_buffer_constinit(&b, target, strlen(target));
 	isc_buffer_add(&b, strlen(target));
 	name = dns_fixedname_initname(&fixed);
-	result = dns_name_fromtext(name, &b, dns_rootname, 0, NULL);
+	result = dns_name_fromtext(name, &b, dns_rootname, 0);
 	if (result != ISC_R_SUCCESS) {
 		return result;
 	}
@@ -12551,7 +12563,7 @@ nzd_setkey(MDB_val *key, dns_name_t *name, char *namebuf, size_t buflen) {
 	dns_fixedname_t fixed;

 	dns_fixedname_init(&fixed);
-	dns_name_downcase(name, dns_fixedname_name(&fixed), NULL);
+	dns_name_downcase(name, dns_fixedname_name(&fixed));
 	dns_name_format(dns_fixedname_name(&fixed), namebuf, buflen);

 	key->mv_data = namebuf;
@@ -12953,7 +12965,7 @@ load_nzf(dns_view_t *view, ns_cfgctx_t *nzcfg) {
 		isc_buffer_add(&b, strlen(origin));
 		name = dns_fixedname_initname(&fname);
 		CHECK(dns_name_fromtext(name, &b, dns_rootname,
-					DNS_NAME_DOWNCASE, NULL));
+					DNS_NAME_DOWNCASE));
 		dns_name_format(name, zname, sizeof(zname));

 		key.mv_data = zname;
@@ -13662,7 +13674,7 @@ named_server_changezone(named_server_t *server, char *command,
 	isc_buffer_add(&buf, strlen(zonename));

 	dnsname = dns_fixedname_initname(&fname);
-	CHECK(dns_name_fromtext(dnsname, &buf, dns_rootname, 0, NULL));
+	CHECK(dns_name_fromtext(dnsname, &buf, dns_rootname, 0));

 	if (redirect) {
 		if (!dns_name_equal(dnsname, dns_rootname)) {
@@ -15228,7 +15240,7 @@ named_server_nta(named_server_t *server, isc_lex_t *lex, bool readonly,
 		isc_buffer_t b;
 		isc_buffer_init(&b, namebuf, strlen(namebuf));
 		isc_buffer_add(&b, strlen(namebuf));
-		CHECK(dns_name_fromtext(fname, &b, dns_rootname, 0, NULL));
+		CHECK(dns_name_fromtext(fname, &b, dns_rootname, 0));
 		ntaname = fname;
 	}

@@ -15825,7 +15837,7 @@ isc_result_t
 named_server_tcptimeouts(isc_lex_t *lex, isc_buffer_t **text) {
 	char *ptr;
 	isc_result_t result = ISC_R_SUCCESS;
-	uint32_t initial, idle, keepalive, advertised, primaries;
+	uint32_t initial, idle, keepalive, advertised;
 	char msg[128];

 	/* Skip the command name. */
@@ -15834,11 +15846,8 @@ named_server_tcptimeouts(isc_lex_t *lex, isc_buffer_t **text) {
 		return ISC_R_UNEXPECTEDEND;
 	}

-	initial = isc_nm_getinitialtimeout(named_g_netmgr);
-	primaries = isc_nm_getprimariestimeout(named_g_netmgr);
-	idle = isc_nm_getidletimeout(named_g_netmgr);
-	keepalive = isc_nm_getkeepalivetimeout(named_g_netmgr);
-	advertised = isc_nm_getadvertisedtimeout(named_g_netmgr);
+	isc_nm_gettimeouts(named_g_netmgr, &initial, &idle, &keepalive,
+			   &advertised);

 	/* Look for optional arguments. */
 	ptr = next_token(lex, NULL);
@@ -15888,24 +15897,8 @@ named_server_tcptimeouts(isc_lex_t *lex, isc_buffer_t **text) {
 			CHECK(ISC_R_RANGE);
 		}

-		ptr = next_token(lex, text);
-		if (ptr == NULL) {
-			return ISC_R_UNEXPECTEDEND;
-		}
-		CHECK(isc_parse_uint32(&primaries, ptr, 10));
-		primaries *= 100;
-		if (primaries > MAX_PRIMARIES_TIMEOUT) {
-			CHECK(ISC_R_RANGE);
-		}
-		if (primaries < MIN_PRIMARIES_TIMEOUT) {
-			CHECK(ISC_R_RANGE);
-		}
-
-		isc_nm_setinitialtimeout(named_g_netmgr, initial);
-		isc_nm_setprimariestimeout(named_g_netmgr, primaries);
-		isc_nm_setidletimeout(named_g_netmgr, idle);
-		isc_nm_setkeepalivetimeout(named_g_netmgr, keepalive);
-		isc_nm_setadvertisedtimeout(named_g_netmgr, advertised);
+		isc_nm_settimeouts(named_g_netmgr, initial, idle, keepalive,
+				   advertised);
 	}

 	snprintf(msg, sizeof(msg), "tcp-initial-timeout=%u\n", initial / 100);
@@ -15915,11 +15908,9 @@ named_server_tcptimeouts(isc_lex_t *lex, isc_buffer_t **text) {
 	snprintf(msg, sizeof(msg), "tcp-keepalive-timeout=%u\n",
 		 keepalive / 100);
 	CHECK(putstr(text, msg));
-	snprintf(msg, sizeof(msg), "tcp-advertised-timeout=%u\n",
+	snprintf(msg, sizeof(msg), "tcp-advertised-timeout=%u",
 		 advertised / 100);
 	CHECK(putstr(text, msg));
-	snprintf(msg, sizeof(msg), "tcp-primaries-timeout=%u", primaries / 100);
-	CHECK(putstr(text, msg));

 cleanup:
 	if (isc_buffer_usedlength(*text) > 0) {
@@ -97,7 +97,7 @@ typedef struct stats_dumparg {
 	isc_result_t result;
 } stats_dumparg_t;

-static isc_once_t once = ISC_ONCE_INIT;
+static isc_once_t once = ISC_ONCE_INITIALIZER;

 #if defined(HAVE_LIBXML2) || defined(HAVE_JSON_C)
 #define EXTENDED_STATS
@@ -358,6 +358,8 @@ init_desc(void) {
 	SET_NSSTATDESC(expireopt, "Expire option received", "ExpireOpt");
 	SET_NSSTATDESC(keepaliveopt, "EDNS TCP keepalive option received",
 		       "KeepAliveOpt");
+	SET_NSSTATDESC(zoneversionopt, "ZONEVERSION option received",
+		       "ZoneVersionOpt");
 	SET_NSSTATDESC(padopt, "EDNS padding option received", "PadOpt");
 	SET_NSSTATDESC(otheropt, "Other EDNS option received", "OtherOpt");
 	SET_NSSTATDESC(cookiein, "COOKIE option received", "CookieIn");
@@ -1488,6 +1490,7 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {
 	unsigned int nmsg = 0;
 	unsigned int nrecs = 0;
 	uint64_t nbytes = 0;
+	uint64_t rate = 0;

 	statlevel = dns_zone_getstatlevel(zone);
 	if (statlevel == dns_zonestat_none) {
@@ -1602,7 +1605,7 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {
 		isc_sockaddr_format(addrp, addr_buf, sizeof(addr_buf));
 		TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR addr_buf));
 	} else if (is_presoa) {
-		addr = dns_zone_getsourceaddr(zone);
+		dns_zone_getsourceaddr(zone, &addr);
 		isc_sockaddr_format(&addr, addr_buf, sizeof(addr_buf));
 		TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR addr_buf));
 	} else {
@@ -1616,9 +1619,13 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {
 		isc_sockaddr_format(addrp, addr_buf, sizeof(addr_buf));
 		TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR addr_buf));
 	} else if (is_presoa) {
-		addr = dns_zone_getprimaryaddr(zone);
-		isc_sockaddr_format(&addr, addr_buf, sizeof(addr_buf));
-		TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR addr_buf));
+		if (dns_zone_getprimaryaddr(zone, &addr) == ISC_R_SUCCESS) {
+			isc_sockaddr_format(&addr, addr_buf, sizeof(addr_buf));
+			TRY0(xmlTextWriterWriteString(writer,
+						      ISC_XMLCHAR addr_buf));
+		} else {
+			TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR "-"));
+		}
 	} else {
 		TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR "-"));
 	}
@@ -1701,7 +1708,7 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {
 	TRY0(xmlTextWriterEndElement(writer));

 	if (is_running) {
-		dns_xfrin_getstats(xfr, &nmsg, &nrecs, &nbytes);
+		dns_xfrin_getstats(xfr, &nmsg, &nrecs, &nbytes, &rate);
 	}
 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "nmsg"));
 	TRY0(xmlTextWriterWriteFormatString(writer, "%u", nmsg));
@@ -1712,6 +1719,9 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {
 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "nbytes"));
 	TRY0(xmlTextWriterWriteFormatString(writer, "%" PRIu64, nbytes));
 	TRY0(xmlTextWriterEndElement(writer));
+	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "rate"));
+	TRY0(xmlTextWriterWriteFormatString(writer, "%" PRIu64, rate));
+	TRY0(xmlTextWriterEndElement(writer));

 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "ixfr"));
 	if (is_running && is_first_data_received) {
@@ -2559,6 +2569,7 @@ xfrin_jsonrender(dns_zone_t *zone, void *arg) {
 	unsigned int nmsg = 0;
 	unsigned int nrecs = 0;
 	uint64_t nbytes = 0;
+	uint64_t rate = 0;

 	statlevel = dns_zone_getstatlevel(zone);
 	if (statlevel == dns_zonestat_none) {
@@ -2651,7 +2662,7 @@ xfrin_jsonrender(dns_zone_t *zone, void *arg) {
 		json_object_object_add(xfrinobj, "localaddr",
 				       json_object_new_string(addr_buf));
 	} else if (is_presoa) {
-		addr = dns_zone_getsourceaddr(zone);
+		dns_zone_getsourceaddr(zone, &addr);
 		isc_sockaddr_format(&addr, addr_buf, sizeof(addr_buf));
 		json_object_object_add(xfrinobj, "localaddr",
 				       json_object_new_string(addr_buf));
@@ -2666,10 +2677,15 @@ xfrin_jsonrender(dns_zone_t *zone, void *arg) {
 		json_object_object_add(xfrinobj, "remoteaddr",
 				       json_object_new_string(addr_buf));
 	} else if (is_presoa) {
-		addr = dns_zone_getprimaryaddr(zone);
-		isc_sockaddr_format(&addr, addr_buf, sizeof(addr_buf));
-		json_object_object_add(xfrinobj, "remoteaddr",
-				       json_object_new_string(addr_buf));
+		if (dns_zone_getprimaryaddr(zone, &addr) == ISC_R_SUCCESS) {
+			isc_sockaddr_format(&addr, addr_buf, sizeof(addr_buf));
+			json_object_object_add(
+				xfrinobj, "remoteaddr",
+				json_object_new_string(addr_buf));
+		} else {
+			json_object_object_add(xfrinobj, "remoteaddr",
+					       json_object_new_string("-"));
+		}
 	} else {
 		json_object_object_add(xfrinobj, "remoteaddr",
 				       json_object_new_string("-"));
@@ -2756,7 +2772,7 @@ xfrin_jsonrender(dns_zone_t *zone, void *arg) {
 	}

 	if (is_running) {
-		dns_xfrin_getstats(xfr, &nmsg, &nrecs, &nbytes);
+		dns_xfrin_getstats(xfr, &nmsg, &nrecs, &nbytes, &rate);
 	}
 	json_object_object_add(xfrinobj, "nmsg",
 			       json_object_new_int64((int64_t)nmsg));
@@ -2766,6 +2782,10 @@ xfrin_jsonrender(dns_zone_t *zone, void *arg) {
 		xfrinobj, "nbytes",
 		json_object_new_int64(nbytes > INT64_MAX ? INT64_MAX
 							 : (int64_t)nbytes));
+	json_object_object_add(xfrinobj, "rate",
+			       json_object_new_int64(rate > INT64_MAX
+							     ? INT64_MAX
+							     : (int64_t)rate));

 	if (is_running && is_first_data_received) {
 		json_object_object_add(
@@ -62,9 +62,9 @@ named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 		isc_buffer_constinit(&b, s, strlen(s));
 		isc_buffer_add(&b, strlen(s));
 		name = dns_fixedname_initname(&fname);
-		RETERR(dns_name_fromtext(name, &b, dns_rootname, 0, NULL));
+		RETERR(dns_name_fromtext(name, &b, dns_rootname, 0));
 		tctx->domain = isc_mem_get(mctx, sizeof(dns_name_t));
-		dns_name_init(tctx->domain, NULL);
+		dns_name_init(tctx->domain);
 		dns_name_dup(name, mctx, tctx->domain);
 	}

@@ -76,7 +76,7 @@ named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 		isc_buffer_constinit(&b, s, strlen(s));
 		isc_buffer_add(&b, strlen(s));
 		name = dns_fixedname_initname(&fname);
-		RETERR(dns_name_fromtext(name, &b, dns_rootname, 0, NULL));
+		RETERR(dns_name_fromtext(name, &b, dns_rootname, 0));
 		RETERR(dst_gssapi_acquirecred(name, false, &tctx->gsscred));
 	}

@@ -27,17 +27,16 @@
 #include <named/log.h>
 #include <named/transportconf.h>

-#define create_name(id, name)                                      \
-	isc_buffer_t namesrc, namebuf;                             \
-	char namedata[DNS_NAME_FORMATSIZE + 1];                    \
-	dns_name_init(name, NULL);                                 \
-	isc_buffer_constinit(&namesrc, id, strlen(id));            \
-	isc_buffer_add(&namesrc, strlen(id));                      \
-	isc_buffer_init(&namebuf, namedata, sizeof(namedata));     \
-	result = (dns_name_fromtext(name, &namesrc, dns_rootname,  \
-				    DNS_NAME_DOWNCASE, &namebuf)); \
-	if (result != ISC_R_SUCCESS) {                             \
-		goto failure;                                      \
+#define create_name(id, name)                                     \
+	isc_buffer_t namesrc;                                     \
+	dns_fixedname_t _fn;                                      \
+	name = dns_fixedname_initname(&_fn);                      \
+	isc_buffer_constinit(&namesrc, id, strlen(id));           \
+	isc_buffer_add(&namesrc, strlen(id));                     \
+	result = (dns_name_fromtext(name, &namesrc, dns_rootname, \
+				    DNS_NAME_DOWNCASE));          \
+	if (result != ISC_R_SUCCESS) {                            \
+		goto failure;                                     \
 	}

 #define parse_transport_option(map, transport, name, setter)      \
@@ -100,15 +99,15 @@ add_doh_transports(const cfg_obj_t *transportlist, dns_transport_list_t *list) {
 	for (const cfg_listelt_t *element = cfg_list_first(transportlist);
 	     element != NULL; element = cfg_list_next(element))
 	{
-		dns_name_t dohname;
-		dns_transport_t *transport;
+		dns_name_t *dohname = NULL;
+		dns_transport_t *transport = NULL;

 		doh = cfg_listelt_value(element);
 		dohid = cfg_obj_asstring(cfg_map_getname(doh));

-		create_name(dohid, &dohname);
+		create_name(dohid, dohname);

-		transport = dns_transport_new(&dohname, DNS_TRANSPORT_HTTP,
+		transport = dns_transport_new(dohname, DNS_TRANSPORT_HTTP,
 					      list);

 		dns_transport_set_tlsname(transport, dohid);
@@ -148,8 +147,8 @@ add_tls_transports(const cfg_obj_t *transportlist, dns_transport_list_t *list) {
 	for (const cfg_listelt_t *element = cfg_list_first(transportlist);
 	     element != NULL; element = cfg_list_next(element))
 	{
-		dns_name_t tlsname;
-		dns_transport_t *transport;
+		dns_name_t *tlsname = NULL;
+		dns_transport_t *transport = NULL;

 		tls = cfg_listelt_value(element);
 		tlsid = cfg_obj_asstring(cfg_map_getname(tls));
@@ -159,10 +158,9 @@ add_tls_transports(const cfg_obj_t *transportlist, dns_transport_list_t *list) {
 			goto failure;
 		}

-		create_name(tlsid, &tlsname);
+		create_name(tlsid, tlsname);

-		transport = dns_transport_new(&tlsname, DNS_TRANSPORT_TLS,
-					      list);
+		transport = dns_transport_new(tlsname, DNS_TRANSPORT_TLS, list);

 		dns_transport_set_tlsname(transport, tlsid);
 		parse_transport_option(tls, transport, "key-file",
@@ -222,12 +220,12 @@ transport_list_fromconfig(const cfg_obj_t *config, dns_transport_list_t *list) {
 static void
 transport_list_add_ephemeral(dns_transport_list_t *list) {
 	isc_result_t result;
-	dns_name_t tlsname;
+	dns_name_t *tlsname = NULL;
 	dns_transport_t *transport;

-	create_name("ephemeral", &tlsname);
+	create_name("ephemeral", tlsname);

-	transport = dns_transport_new(&tlsname, DNS_TRANSPORT_TLS, list);
+	transport = dns_transport_new(tlsname, DNS_TRANSPORT_TLS, list);
 	dns_transport_set_tlsname(transport, "ephemeral");

 	return;
@@ -46,11 +46,11 @@ add_initial_keys(const cfg_obj_t *list, dns_tsigkeyring_t *ring,
 	{
 		const cfg_obj_t *algobj = NULL;
 		const cfg_obj_t *secretobj = NULL;
-		dns_name_t keyname;
+		dns_fixedname_t fkey;
+		dns_name_t *keyname = dns_fixedname_initname(&fkey);
 		dst_algorithm_t alg = DST_ALG_UNKNOWN;
 		const char *algstr = NULL;
-		char keynamedata[1024];
-		isc_buffer_t keynamesrc, keynamebuf;
+		isc_buffer_t keynamesrc;
 		const char *secretstr = NULL;
 		isc_buffer_t secretbuf;
 		int secretlen = 0;
@@ -68,12 +68,10 @@ add_initial_keys(const cfg_obj_t *list, dns_tsigkeyring_t *ring,
 		/*
 		 * Create the key name.
 		 */
-		dns_name_init(&keyname, NULL);
 		isc_buffer_constinit(&keynamesrc, keyid, strlen(keyid));
 		isc_buffer_add(&keynamesrc, strlen(keyid));
-		isc_buffer_init(&keynamebuf, keynamedata, sizeof(keynamedata));
-		ret = dns_name_fromtext(&keyname, &keynamesrc, dns_rootname,
-					DNS_NAME_DOWNCASE, &keynamebuf);
+		ret = dns_name_fromtext(keyname, &keynamesrc, dns_rootname,
+					DNS_NAME_DOWNCASE);
 		if (ret != ISC_R_SUCCESS) {
 			goto failure;
 		}
@@ -103,7 +101,7 @@ add_initial_keys(const cfg_obj_t *list, dns_tsigkeyring_t *ring,
 		}
 		secretlen = isc_buffer_usedlength(&secretbuf);

-		ret = dns_tsigkey_create(&keyname, alg, secret, secretlen, mctx,
+		ret = dns_tsigkey_create(keyname, alg, secret, secretlen, mctx,
 					 &tsigkey);
 		isc_mem_put(mctx, secret, secretalloc);
 		secret = NULL;
@@ -253,7 +253,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		isc_buffer_constinit(&b, str, strlen(str));
 		isc_buffer_add(&b, strlen(str));
 		result = dns_name_fromtext(dns_fixedname_name(&fident), &b,
-					   dns_rootname, 0, NULL);
+					   dns_rootname, 0);
 		if (result != ISC_R_SUCCESS) {
 			cfg_obj_log(identity, ISC_LOG_ERROR,
 				    "'%s' is not a valid name", str);
@@ -283,7 +283,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 			isc_buffer_constinit(&b, str, strlen(str));
 			isc_buffer_add(&b, strlen(str));
 			result = dns_name_fromtext(dns_fixedname_name(&fname),
-						   &b, dns_rootname, 0, NULL);
+						   &b, dns_rootname, 0);
 			if (result != ISC_R_SUCCESS) {
 				cfg_obj_log(identity, ISC_LOG_ERROR,
 					    "'%s' is not a valid name", str);
@@ -518,7 +518,7 @@ configure_staticstub_servernames(const cfg_obj_t *zconfig, dns_zone_t *zone,

 		isc_buffer_constinit(&b, str, strlen(str));
 		isc_buffer_add(&b, strlen(str));
-		result = dns_name_fromtext(nsname, &b, dns_rootname, 0, NULL);
+		result = dns_name_fromtext(nsname, &b, dns_rootname, 0);
 		if (result != ISC_R_SUCCESS) {
 			cfg_obj_log(zconfig, ISC_LOG_ERROR,
 				    "server-name '%s' is not a valid "
@@ -633,7 +633,7 @@ configure_staticstub(const cfg_obj_t *zconfig, dns_zone_t *zone,
 	 */
 	CHECK(dns_db_newversion(db, &dbversion));

-	dns_name_init(&apexname, NULL);
+	dns_name_init(&apexname);
 	dns_name_clone(dns_zone_getorigin(zone), &apexname);
 	CHECK(dns_db_findnode(db, &apexname, false, &apexnode));

@@ -1227,6 +1227,12 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			dns_zone_setkasp(zone, NULL);
 		}

+		obj = NULL;
+		result = named_config_get(maps, "provide-zoneversion", &obj);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
+		dns_zone_setoption(zone, DNS_ZONEOPT_ZONEVERSION,
+				   cfg_obj_asboolean(obj));
+
 		obj = NULL;
 		result = named_config_get(maps, "notify", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
@@ -1279,22 +1285,22 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		obj = NULL;
 		result = named_config_get(maps, "parental-source", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		CHECK(dns_zone_setparentalsrc4(zone, cfg_obj_assockaddr(obj)));
+		dns_zone_setparentalsrc4(zone, cfg_obj_assockaddr(obj));

 		obj = NULL;
 		result = named_config_get(maps, "parental-source-v6", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		CHECK(dns_zone_setparentalsrc6(zone, cfg_obj_assockaddr(obj)));
+		dns_zone_setparentalsrc6(zone, cfg_obj_assockaddr(obj));

 		obj = NULL;
 		result = named_config_get(maps, "notify-source", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		CHECK(dns_zone_setnotifysrc4(zone, cfg_obj_assockaddr(obj)));
+		dns_zone_setnotifysrc4(zone, cfg_obj_assockaddr(obj));

 		obj = NULL;
 		result = named_config_get(maps, "notify-source-v6", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		CHECK(dns_zone_setnotifysrc6(zone, cfg_obj_assockaddr(obj)));
+		dns_zone_setnotifysrc6(zone, cfg_obj_assockaddr(obj));

 		obj = NULL;
 		result = named_config_get(maps, "notify-to-soa", &obj);
@@ -1874,6 +1880,33 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		}
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_MULTIMASTER, multi);

+		obj = NULL;
+		result = named_config_get(maps, "min-transfer-rate-in", &obj);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
+		uint32_t traffic_bytes =
+			cfg_obj_asuint32(cfg_tuple_get(obj, "traffic_bytes"));
+		uint32_t time_minutes =
+			cfg_obj_asuint32(cfg_tuple_get(obj, "time_minutes"));
+		if (traffic_bytes == 0) {
+			cfg_obj_log(obj, ISC_LOG_ERROR,
+				    "zone '%s': 'min-transfer-rate-in' bytes"
+				    "value can not be '0'",
+				    zname);
+			CHECK(ISC_R_FAILURE);
+		}
+		/* Max. 28 days (in minutes). */
+		const unsigned int time_minutes_max = 28 * 24 * 60;
+		if (time_minutes < 1 || time_minutes > time_minutes_max) {
+			cfg_obj_log(obj, ISC_LOG_ERROR,
+				    "zone '%s': 'min-transfer-rate-in' minutes"
+				    "value is out of range (1..%u)",
+				    zname, time_minutes_max);
+			CHECK(ISC_R_FAILURE);
+		}
+		dns_zone_setminxfrratein(mayberaw, traffic_bytes,
+					 transferinsecs ? time_minutes
+							: time_minutes * 60);
+
 		obj = NULL;
 		result = named_config_get(maps, "max-transfer-time-in", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
@@ -1911,14 +1944,12 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		obj = NULL;
 		result = named_config_get(maps, "transfer-source", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		CHECK(dns_zone_setxfrsource4(mayberaw,
-					     cfg_obj_assockaddr(obj)));
+		dns_zone_setxfrsource4(mayberaw, cfg_obj_assockaddr(obj));

 		obj = NULL;
 		result = named_config_get(maps, "transfer-source-v6", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		CHECK(dns_zone_setxfrsource6(mayberaw,
-					     cfg_obj_assockaddr(obj)));
+		dns_zone_setxfrsource6(mayberaw, cfg_obj_assockaddr(obj));

 		obj = NULL;
 		(void)named_config_get(maps, "try-tcp-refresh", &obj);
@@ -30,6 +30,7 @@
 #include <isc/getaddresses.h>
 #include <isc/hash.h>
 #include <isc/lex.h>
+#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/loop.h>
 #include <isc/managers.h>
@@ -52,6 +53,7 @@
 #include <dns/dispatch.h>
 #include <dns/dnssec.h>
 #include <dns/fixedname.h>
+#include <dns/lib.h>
 #include <dns/masterdump.h>
 #include <dns/message.h>
 #include <dns/name.h>
@@ -521,8 +523,7 @@ setup_keystr(void) {
 	isc_buffer_add(&keynamesrc, (unsigned int)(n - name));

 	debug("namefromtext");
-	result = dns_name_fromtext(mykeyname, &keynamesrc, dns_rootname, 0,
-				   NULL);
+	result = dns_name_fromtext(mykeyname, &keynamesrc, dns_rootname, 0);
 	check_result(result, "dns_name_fromtext");

 	secretlen = strlen(secretstr) * 3 / 4;
@@ -784,16 +785,14 @@ set_source_ports(dns_dispatchmgr_t *manager) {
 }

 static isc_result_t
-create_name(const char *str, char *namedata, size_t len, dns_name_t *name) {
-	isc_buffer_t namesrc, namebuf;
+create_name(const char *str, dns_name_t *name) {
+	isc_buffer_t namesrc;

-	dns_name_init(name, NULL);
 	isc_buffer_constinit(&namesrc, str, strlen(str));
 	isc_buffer_add(&namesrc, strlen(str));
-	isc_buffer_init(&namebuf, namedata, len);

 	return dns_name_fromtext(name, &namesrc, dns_rootname,
-				 DNS_NAME_DOWNCASE, &namebuf);
+				 DNS_NAME_DOWNCASE);
 }

 static void
@@ -803,8 +802,8 @@ setup_system(void *arg ISC_ATTR_UNUSED) {
 	isc_sockaddrlist_t *nslist;
 	isc_logconfig_t *logconfig = NULL;
 	irs_resconf_t *resconf = NULL;
-	dns_name_t tlsname;
-	char namedata[DNS_NAME_FORMATSIZE + 1];
+	dns_fixedname_t ftls;
+	dns_name_t *tlsname = dns_fixedname_initname(&ftls);

 	ddebug("setup_system()");

@@ -938,17 +937,15 @@ setup_system(void *arg ISC_ATTR_UNUSED) {
 	isc_tlsctx_cache_create(gmctx, &tls_ctx_cache);

 	if (tls_client_key_file == NULL) {
-		result = create_name("tls-non-auth-client", namedata,
-				     sizeof(namedata), &tlsname);
+		result = create_name("tls-non-auth-client", tlsname);
 		check_result(result, "create_name (tls-non-auth-client)");
-		transport = dns_transport_new(&tlsname, DNS_TRANSPORT_TLS,
+		transport = dns_transport_new(tlsname, DNS_TRANSPORT_TLS,
 					      transport_list);
 		dns_transport_set_tlsname(transport, "tls-non-auth-client");
 	} else {
-		result = create_name("tls-auth-client", namedata,
-				     sizeof(namedata), &tlsname);
+		result = create_name("tls-auth-client", tlsname);
 		check_result(result, "create_name (tls-auth-client)");
-		transport = dns_transport_new(&tlsname, DNS_TRANSPORT_TLS,
+		transport = dns_transport_new(tlsname, DNS_TRANSPORT_TLS,
 					      transport_list);
 		dns_transport_set_tlsname(transport, "tls-auth-client");
 		dns_transport_set_keyfile(transport, tls_client_key_file);
@@ -1307,7 +1304,7 @@ parse_name(char **cmdlinep, dns_message_t *msg, dns_name_t **namep) {
 	dns_message_gettempname(msg, namep);
 	isc_buffer_init(&source, word, strlen(word));
 	isc_buffer_add(&source, strlen(word));
-	result = dns_name_fromtext(*namep, &source, dns_rootname, 0, NULL);
+	result = dns_name_fromtext(*namep, &source, dns_rootname, 0);
 	if (result != ISC_R_SUCCESS) {
 		error("invalid owner name: %s", isc_result_totext(result));
 		isc_buffer_invalidate(&source);
@@ -1733,7 +1730,7 @@ evaluate_key(char *cmdline) {

 	isc_buffer_init(&b, namestr, strlen(namestr));
 	isc_buffer_add(&b, strlen(namestr));
-	result = dns_name_fromtext(mykeyname, &b, dns_rootname, 0, NULL);
+	result = dns_name_fromtext(mykeyname, &b, dns_rootname, 0);
 	if (result != ISC_R_SUCCESS) {
 		fprintf(stderr, "could not parse key name\n");
 		return STATUS_SYNTAX;
@@ -1787,7 +1784,7 @@ evaluate_zone(char *cmdline) {
 	userzone = dns_fixedname_initname(&fuserzone);
 	isc_buffer_init(&b, word, strlen(word));
 	isc_buffer_add(&b, strlen(word));
-	result = dns_name_fromtext(userzone, &b, dns_rootname, 0, NULL);
+	result = dns_name_fromtext(userzone, &b, dns_rootname, 0);
 	if (result != ISC_R_SUCCESS) {
 		userzone = NULL; /* Lest it point to an invalid name */
 		fprintf(stderr, "could not parse zone name\n");
@@ -2612,8 +2609,8 @@ done:
 	if (usegsstsig) {
 		dns_name_free(&tmpzonename, gmctx);
 		dns_name_free(&restart_primary, gmctx);
-		dns_name_init(&tmpzonename, 0);
-		dns_name_init(&restart_primary, 0);
+		dns_name_init(&tmpzonename);
+		dns_name_init(&restart_primary);
 	}
 	done_update();
 }
@@ -2879,7 +2876,7 @@ lookforsoa:
 	result = dns_rdata_tostruct(&soarr, &soa, NULL);
 	check_result(result, "dns_rdata_tostruct");

-	dns_name_init(&primary, NULL);
+	dns_name_init(&primary);
 	dns_name_clone(&soa.origin, &primary);

 	if (userzone != NULL) {
@@ -2935,9 +2932,9 @@ lookforsoa:

 #if HAVE_GSSAPI
 	if (usegsstsig) {
-		dns_name_init(&tmpzonename, NULL);
+		dns_name_init(&tmpzonename);
 		dns_name_dup(zname, gmctx, &tmpzonename);
-		dns_name_init(&restart_primary, NULL);
+		dns_name_init(&restart_primary);
 		dns_name_dup(&primary, gmctx, &restart_primary);
 		start_gssrequest(&primary);
 	} else {
@@ -2966,7 +2963,7 @@ droplabel:
 	if (nlabels == 1) {
 		fatal("could not find enclosing zone");
 	}
-	dns_name_init(&tname, NULL);
+	dns_name_init(&tname);
 	dns_name_getlabelsequence(name, 1, nlabels - 1, &tname);
 	dns_name_clone(&tname, name);
 	dns_request_destroy(&request);
@@ -3073,8 +3070,8 @@ failed_gssrequest(void) {

 	dns_name_free(&tmpzonename, gmctx);
 	dns_name_free(&restart_primary, gmctx);
-	dns_name_init(&tmpzonename, NULL);
-	dns_name_init(&restart_primary, NULL);
+	dns_name_init(&tmpzonename);
+	dns_name_init(&restart_primary);

 	done_update();
 }
@@ -3121,7 +3118,7 @@ start_gssrequest(dns_name_t *primary) {
 	RUNTIME_CHECK(result < sizeof(servicename));
 	isc_buffer_init(&buf, servicename, strlen(servicename));
 	isc_buffer_add(&buf, strlen(servicename));
-	result = dns_name_fromtext(servname, &buf, dns_rootname, 0, NULL);
+	result = dns_name_fromtext(servname, &buf, dns_rootname, 0);
 	if (result != ISC_R_SUCCESS) {
 		fatal("dns_name_fromtext(servname) failed: %s",
 		      isc_result_totext(result));
@@ -3138,7 +3135,7 @@ start_gssrequest(dns_name_t *primary) {
 	isc_buffer_init(&buf, mykeystr, strlen(mykeystr));
 	isc_buffer_add(&buf, strlen(mykeystr));

-	result = dns_name_fromtext(keyname, &buf, dns_rootname, 0, NULL);
+	result = dns_name_fromtext(keyname, &buf, dns_rootname, 0);
 	if (result != ISC_R_SUCCESS) {
 		fatal("dns_name_fromtext(keyname) failed: %s",
 		      isc_result_totext(result));
@@ -3297,7 +3294,7 @@ recvgss(void *arg) {
 	servname = dns_fixedname_initname(&fname);
 	isc_buffer_init(&buf, servicename, strlen(servicename));
 	isc_buffer_add(&buf, strlen(servicename));
-	result = dns_name_fromtext(servname, &buf, dns_rootname, 0, NULL);
+	result = dns_name_fromtext(servname, &buf, dns_rootname, 0);
 	check_result(result, "dns_name_fromtext");

 	result = dns_tkey_gssnegotiate(tsigquery, rcvmsg, servname, &context,
@@ -3519,7 +3516,7 @@ getinput(void *arg) {

 int
 main(int argc, char **argv) {
-	const uint32_t timeoutms = timeout * MS_PER_SEC;
+	uint32_t timeoutms;

 	style = &dns_master_style_debug;

@@ -3544,11 +3541,8 @@ main(int argc, char **argv) {
 	parse_args(argc, argv);

 	/* Set the network manager timeouts in milliseconds. */
-	isc_nm_setinitialtimeout(netmgr, timeoutms);
-	isc_nm_setprimariestimeout(netmgr, timeoutms);
-	isc_nm_setidletimeout(netmgr, timeoutms);
-	isc_nm_setkeepalivetimeout(netmgr, timeoutms);
-	isc_nm_setadvertisedtimeout(netmgr, timeoutms);
+	timeoutms = timeout * 1000;
+	isc_nm_settimeouts(netmgr, timeoutms, timeoutms, timeoutms, timeoutms);

 	isc_loopmgr_setup(loopmgr, setup_system, NULL);
 	isc_loopmgr_setup(loopmgr, getinput, NULL);
@@ -22,6 +22,7 @@
 #include <isc/commandline.h>
 #include <isc/file.h>
 #include <isc/getaddresses.h>
+#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/loop.h>
 #include <isc/managers.h>
@@ -36,6 +37,7 @@
 #include <isc/thread.h>
 #include <isc/util.h>

+#include <dns/lib.h>
 #include <dns/name.h>

 #include <isccc/alist.h>
@@ -212,7 +214,7 @@ command is one of the following:\n\
 		Dump a single zone's changes to disk, and optionally\n\
 		remove its journal file.\n\
  tcp-timeouts	Display the tcp-*-timeout option values\n\
-  tcp-timeouts initial idle keepalive advertised primaries\n\
+  tcp-timeouts initial idle keepalive advertised\n\
 		Update the tcp-*-timeout option values\n\
  thaw		Enable updates to all dynamic zones and reload them.\n\
  thaw zone [class [view]]\n\
@@ -957,10 +959,7 @@ main(int argc, char **argv) {
 	isc_managers_create(&rndc_mctx, 1, &loopmgr, &netmgr);
 	isc_loopmgr_setup(loopmgr, rndc_start, NULL);

-	isc_nm_setinitialtimeout(netmgr, timeout);
-	isc_nm_setprimariestimeout(netmgr, timeout);
-	isc_nm_setidletimeout(netmgr, timeout);
-	isc_nm_setkeepalivetimeout(netmgr, timeout);
+	isc_nm_settimeouts(netmgr, timeout, timeout, timeout, 0);

 	logconfig = isc_logconfig_get();
 	isc_log_settag(logconfig, progname);
@@ -28,6 +28,7 @@ options {
 	} except-from {
 		"example";
 	};
+	qname-minimization disabled;  // Regression test for GL #4652
 };

 trust-anchors { };
@@ -31,6 +31,7 @@ server 0.0.0.0 {
 	request-ixfr no;
 	request-ixfr-max-diffs 0;
 	request-nsid no;
+	request-zoneversion no;
 	require-cookie no;
 	send-cookie no;
 	tcp-keepalive no;
@@ -55,6 +56,7 @@ server :: {
 	request-ixfr no;
 	request-ixfr-max-diffs 0;
 	request-nsid no;
+	request-zoneversion no;
 	require-cookie no;
 	send-cookie no;
 	tcp-keepalive no;
@@ -131,11 +131,13 @@ status=$((status + ret))
 echo_i "checking that log-report-channel zones fail if '*._er/TXT' is missing ($n)"
 ret=0
 $CHECKZONE -R fail example zones/er.db >test.out2.$n 2>&1 || ret=1
-grep -F "no '*._er/TXT' wildcard found" test.out4.$n >/dev/null && ret=1
+grep -F "no '*._er/TXT' wildcard found" test.out2.$n >/dev/null && ret=1
 $CHECKZONE example zones/er-missing.db >test.out3.$n 2>&1 || ret=1
-grep -F "no '*._er/TXT' wildcard found" test.out4.$n >/dev/null && ret=1
+grep -F "no '*._er/TXT' wildcard found" test.out3.$n >/dev/null && ret=1
 $CHECKZONE -R fail example zones/er-missing.db >test.out4.$n 2>&1 && ret=1
 grep -F "no '*._er/TXT' wildcard found" test.out4.$n >/dev/null || ret=1
+n=$((n + 1))
+if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

 echo_i "checking that raw zone with bad class is handled ($n)"
@@ -308,6 +308,7 @@ def logger(request, system_test_name):
@pytest.fixture(scope="module")
 def expected_artifacts(request):
    common_artifacts = [
+        "*/.hypothesis",  # drop after Ubuntu 20.04 Focal Fossa gets removed from CI
        ".libs/*",  # possible build artifacts, see GL #5055
        "ns*/named.conf",
        "ns*/named.memstats",
@@ -361,6 +361,23 @@ grep "status: NOERROR," dig.out.test$n >/dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

+n=$((n + 1))
+echo_i "Restart NS4 with -T cookiealwaysvalid ($n)"
+stop_server ns4
+touch ns4/named.cookiealwaysvalid
+start_server --noclean --restart --port ${PORT} ns4 || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "test NS6 cookie on NS4 with -T cookiealwaysvalid (expect success) ($n)"
+ret=0
+$DIG $DIGOPTS +cookie=$ns6cookie -b 10.53.0.4 +nobadcookie soa . @10.53.0.4 >dig.out.test$n || ret=1
+grep "; COOKIE:.*(good)" dig.out.test$n >/dev/null || ret=1
+grep "status: NOERROR," dig.out.test$n >/dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
 n=$((n + 1))
 echo_i "check that test server is correctly configured ($n)"
 ret=0
@@ -552,16 +569,21 @@ sys.exit(1)'; then
  $DIG $DIGOPTS @10.53.0.1 tsig. >dig.out.test$n.1 || ret=1
  grep "status: NOERROR" dig.out.test$n.1 >/dev/null || ret=1
  rndc_dumpdb ns1
+  # prime cache with NS response for QNAME minimisation
  grep "$pat" ns1/named_dump.db.test$n >/dev/null || ret=1
+  $DIG $DIGOPTS @10.53.0.1 NS nocookie.tsig >dig.out.test$n.2 || ret=1
+  grep "status: NOERROR" dig.out.test$n.2 >/dev/null || ret=1
  # check the disabled server response
  nextpart ns1/named.run >/dev/null
-  $DIG $DIGOPTS @10.53.0.1 nocookie.tsig >dig.out.test$n.2 || ret=1
-  grep "status: NOERROR" dig.out.test$n.2 >/dev/null || ret=1
-  grep 'A.10\.53\.0\.9' dig.out.test$n.2 >/dev/null || ret=1
-  grep 'A.10\.53\.0\.10' dig.out.test$n.2 >/dev/null || ret=1
+  $DIG $DIGOPTS @10.53.0.1 nocookie.tsig >dig.out.test$n.3 || ret=1
+  grep "status: NOERROR" dig.out.test$n.3 >/dev/null || ret=1
+  grep 'A.10\.53\.0\.9' dig.out.test$n.3 >/dev/null || ret=1
+  grep 'A.10\.53\.0\.10' dig.out.test$n.3 >/dev/null || ret=1
  nextpart ns1/named.run >named.run.test$n
  count=$(grep -c ') [0-9][0-9]* NOERROR 0' named.run.test$n)
  test $count -eq 2 || ret=1
+  count=$(grep -c '^; COOKIE: ................................' named.run.test$n)
+  test $count -eq 1 || ret=1
  if [ $ret != 0 ]; then echo_i "failed"; fi
  status=$((status + ret))
 fi
@@ -19,6 +19,7 @@ pytestmark = pytest.mark.extra_artifacts(
        "ans*/ans.run",
        "ans*/query.log",
        "ns1/named_dump.db*",
+        "ns4/named.cookiealwaysvalid",
    ]
 )

@@ -36,4 +36,5 @@ zone "example" {
 zone "example.tld" {
 	type primary;
 	file "example.tld.db";
+	provide-zoneversion no;
 };
@@ -801,6 +801,73 @@ if [ -x "$DIG" ]; then
  if [ $ret -ne 0 ]; then echo_i "failed"; fi
  status=$((status + ret))

+  n=$((n + 1))
+  echo_i "checking dig +zoneversion to a authoritative server ($n)"
+  ret=0
+  dig_with_opts @10.53.0.2 +zoneversion a.example >dig.out.test$n 2>&1 || ret=1
+  pat="; ZONEVERSION: ZONE: example, SOA-SERIAL: 2000042407"
+  grep "$pat" dig.out.test$n >/dev/null || ret=1
+  if [ $ret -ne 0 ]; then echo_i "failed"; fi
+  status=$((status + ret))
+
+  n=$((n + 1))
+  echo_i "checking dig +zoneversion to a authoritative server with zoneversion disabled ($n)"
+  ret=0
+  dig_with_opts @10.53.0.2 +zoneversion a.example.tld >dig.out.test$n 2>&1 || ret=1
+  grep "status: NOERROR" dig.out.test$n >/dev/null || ret=1
+  grep "; ZONEVERSION:" dig.out.test$n >/dev/null && ret=1
+  if [ $ret -ne 0 ]; then echo_i "failed"; fi
+  status=$((status + ret))
+
+  if [ $HAS_PYYAML -ne 0 ]; then
+    n=$((n + 1))
+    echo_i "checking dig +yaml +zoneversion to a authoritative server ($n)"
+    ret=0
+    dig_with_opts @10.53.0.2 +yaml +zoneversion a.example >dig.out.test$n 2>&1 || ret=1
+    $PYTHON yamlget.py dig.out.test$n 0 message response_message_data OPT_PSEUDOSECTION EDNS ZONEVERSION >yamlget.out.test$n 2>&1 || ret=1
+    read -r value <yamlget.out.test$n
+    expected="{'ZONE': 'example', 'SOA-SERIAL': 2000042407}"
+    [ "$value" = "$expected" ] || ret=1
+    if [ $ret -ne 0 ]; then echo_i "failed"; fi
+    status=$((status + ret))
+  fi
+
+  n=$((n + 1))
+  echo_i "checking dig +ednsopt=ZONEVERSION:<answer> to a authoritative server ($n)"
+  ret=0
+  dig_with_opts @10.53.0.2 +ednsopt=ZONEVERSION:0100000007DA a.example >dig.out.test$n 2>&1 || ret=1
+  grep "status: FORMERR" dig.out.test$n >/dev/null || ret=1
+  grep "; ZONEVERSION:" dig.out.test$n >/dev/null && ret=1
+  if [ $ret -ne 0 ]; then echo_i "failed"; fi
+  status=$((status + ret))
+
+  n=$((n + 1))
+  echo_i "checking dig +zoneversion to a recursive server ($n)"
+  ret=0
+  dig_with_opts @10.53.0.3 +zoneversion a.example >dig.out.test$n 2>&1 || ret=1
+  grep '; ZONEVERSION:' dig.out.test$n >/dev/null && ret=1
+  if [ $ret -ne 0 ]; then echo_i "failed"; fi
+  status=$((status + ret))
+
+  n=$((n + 1))
+  echo_i "checking display of non serial type zoneversion ($n)"
+  ret=0
+  dig_with_opts @10.53.0.2 +qr +ednsopt=ZONEVERSION:0100000007DA a.example >dig.out.test$n 2>&1 || ret=1
+  grep '; ZONEVERSION: LABELS: 1, TYPE: 0, VALUE: 000007da ("....")' dig.out.test$n >/dev/null && ret=1
+  if [ $ret -ne 0 ]; then echo_i "failed"; fi
+  status=$((status + ret))
+
+  if [ $HAS_PYYAML -ne 0 ]; then
+    n=$((n + 1))
+    echo_i "checking display of non serial type zoneversion +yaml ($n)"
+    ret=0
+    dig_with_opts @10.53.0.2 +qr +ednsopt=ZONEVERSION:0100000007DA a.example +yaml >dig.out.test$n 2>&1 || ret=1
+    $PYTHON yamlget.py dig.out.test$n 0 message query_message_data OPT_PSEUDOSECTION EDNS ZONEVERSION >yamlget.out.test$n 2>&1 || ret=1
+    expected="{'ZONE': 'example', 'TYPE': 1, 'VALUE': 000007da, PVALUE: '....'}"
+    if [ $ret -ne 0 ]; then echo_i "failed"; fi
+    status=$((status + ret))
+  fi
+
  n=$((n + 1))
  echo_i "check that dig gracefully handles bad escape in domain name ($n)"
  ret=0
@@ -1135,6 +1202,16 @@ if [ -x "$DIG" ]; then
  grep "; EDNS: version: 0, flags:; udp: 1232" dig.out.test$n >/dev/null || ret=1
  if [ $ret -ne 0 ]; then echo_i "failed"; fi
  status=$((status + ret))
+
+  n=$((n + 1))
+  echo_i "check that dig +showbadvers works ($n)"
+  dig_with_opts @10.53.0.3 +edns=1 +qr +showbadvers a.example >dig.out.test$n 2>&1 || ret=1
+  grep "; EDNS: version: 1, flags:; udp: 1232" dig.out.test$n >/dev/null || ret=1
+  grep "; EDNS: version: 0, flags:; udp: 1232" dig.out.test$n >/dev/null || ret=1
+  grep -F "status: BADVERS" dig.out.test$n >/dev/null || ret=1
+  grep -F "status: NOERROR" dig.out.test$n >/dev/null || ret=1
+  if [ $ret -ne 0 ]; then echo_i "failed"; fi
+  status=$((status + ret))
 else
  echo_i "$DIG is needed, so skipping these dig tests"
 fi
@@ -1483,6 +1560,7 @@ if [ -x "$DELV" ]; then

  n=$((n + 1))
  echo_i "check that delv handles REFUSED when chasing DS records ($n)"
+  ret=0
  delv_with_opts @10.53.0.2 +root xxx.example.tld A >delv.out.test$n 2>&1 || ret=1
  grep ";; resolution failed: broken trust chain" delv.out.test$n >/dev/null || ret=1
  if [ $ret -ne 0 ]; then echo_i "failed"; fi
@@ -1490,9 +1568,11 @@ if [ -x "$DELV" ]; then

  n=$((n + 1))
  echo_i "check NS output from delv +ns ($n)"
+  ret=0
  delv_with_opts -i +ns +nortrace +nostrace +nomtrace +novtrace +hint=../_common/root.hint ns example >delv.out.test$n || ret=1
  lines=$(awk '$1 == "example." && $4 == "NS" {print}' delv.out.test$n | wc -l)
  [ $lines -eq 2 ] || ret=1
+  if [ $ret -ne 0 ]; then echo_i "failed"; fi
  status=$((status + ret))

  n=$((n + 1))
@@ -38,6 +38,7 @@ def logquery(type, qname):
 # NS gets a unsigned response.
 # DNSKEY get a unsigned NODATA response.
 # A gets a signed response.
+# TXT gets a signed NODATA response without RRSIG.
 # All other types get a unsigned NODATA response.
 ############################################################################
 def create_response(msg):
@@ -72,6 +73,11 @@ def create_response(msg):
        r.answer.append(dns.rrset.from_text(qname, 1, IN, NS, "."))
    elif rrtype == SOA:
        r.answer.append(dns.rrset.from_text(qname, 1, IN, SOA, ". . 0 0 0 0 0"))
+    elif rrtype == TXT:
+        r.authority.append(dns.rrset.from_text(qname, 1, IN, SOA, ". . 0 0 0 0 0"))
+        r.authority.append(
+            dns.rrset.from_text(qname, 1, IN, NSEC, qname + " A NS SOA RRSIG NSEC")
+        )
    else:
        r.authority.append(dns.rrset.from_text(qname, 1, IN, SOA, ". . 0 0 0 0 0"))
    r.flags |= dns.flags.AA
@@ -43,3 +43,7 @@ dnskey-rrsigs-stripped.	NS	ns2.dnskey-rrsigs-stripped.
 ns2.dnskey-rrsigs-stripped.	A	10.53.0.2
 ds-rrsigs-stripped.	NS	ns2.ds-rrsigs-stripped.
 ns2.ds-rrsigs-stripped.	A	10.53.0.2
+inconsistent.		NS	ns2.inconsistent.
+ns2.inconsistent.	A	10.53.0.2
+nsec-rrsigs-stripped.	NS	ns10.nsec-rrsigs-stripped.
+ns10.nsec-rrsigs-stripped.	A	10.53.0.10
@@ -33,6 +33,7 @@ cp "../ns2/dsset-lazy-ksk." .
 cp "../ns2/dsset-peer-ns-spoof." .
 cp "../ns2/dsset-dnskey-rrsigs-stripped." .
 cp "../ns2/dsset-ds-rrsigs-stripped." .
+cp "../ns2/dsset-inconsistent." .

 grep "$DEFAULT_ALGORITHM_NUMBER [12] " "../ns2/dsset-algroll." >"dsset-algroll."
 cp "../ns6/dsset-optout-tld." .
@@ -0,0 +1,24 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300	; 5 minutes
+@			IN SOA	ns2.example. . (
+				2010042407 ; serial
+				20         ; refresh (20 seconds)
+				20         ; retry (20 seconds)
+				1814400    ; expire (3 weeks)
+				3600       ; minimum (1 hour)
+				)
+			NS	ns2.example.
+			NS	ns3.example.
+			A	10.53.0.1
+ns2			A	10.53.0.2
+ns3			A	10.53.0.3
@@ -207,6 +207,11 @@ zone "too-many-iterations" {
 	file "too-many-iterations.db.signed";
 };

+zone "inconsistent" {
+	type primary;
+	file "inconsistent.db.signed";
+};
+
 zone "lazy-ksk" {
 	type primary;
 	file "lazy-ksk.db";
@@ -64,7 +64,7 @@ for subdomain in digest-alg-unsupported ds-unsupported secure badds \
  kskonly update-nsec3 auto-nsec auto-nsec3 secure.below-cname \
  ttlpatch split-dnssec split-smart expired expiring upper lower \
  dnskey-unknown dnskey-unsupported dnskey-unsupported-2 \
-  dnskey-nsec3-unknown managed-future revkey \
+  dnskey-nsec3-unknown managed-future future revkey \
  dname-at-apex-nsec3 occluded rsasha1 rsasha1-1024; do
  cp "../ns3/dsset-$subdomain.example." .
 done
@@ -432,3 +432,14 @@ cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile"
  | awk '$4 == "SOA" { $7 = $7 + 1; print; next } { print }' >"$zonefile.next"
 "$SIGNER" -g -o "$zone" -f "$zonefile.next" "$zonefile.next" >/dev/null 2>&1
 cp "$zonefile.stripped" "$zonefile.signed"
+
+#
+# Inconsistent NS RRset between parent and child
+#
+zone=inconsistent
+infile=inconsistent.db.in
+zonefile=inconsistent.db
+key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
+cat "$infile" "$key1.key" "$key2.key" >"$zonefile"
+"$SIGNER" -3 - -g -o "$zone" "$zonefile" >/dev/null 2>&1
@@ -26,6 +26,8 @@ options {
 	bindkeys-file "managed.conf";
 	dnssec-accept-expired yes;
 	minimal-responses no;
+	servfail-ttl 0;
+
 	disable-algorithms "digest-alg-unsupported.example." { ECDSAP384SHA384; };
 	disable-ds-digests "digest-alg-unsupported.example." { "SHA384"; "SHA-384";};
 	disable-ds-digests "ds-unsupported.example." { "SHA256"; "SHA-256"; "SHA384"; "SHA-384"; };
@@ -25,6 +25,7 @@ options {
 	dnssec-validation yes;
 	forward only;
 	forwarders { 10.53.0.4; };
+	servfail-ttl 0;
 };

 key rndc_key {
@@ -0,0 +1,6 @@
+; This is a key-signing key, keyid 23640, for .
+; Created: 20250310185208 (Mon Mar 10 18:52:08 2025)
+; Publish: 20250310185208 (Mon Mar 10 18:52:08 2025)
+; Activate: 20250310185208 (Mon Mar 10 18:52:08 2025)
+; Revoke: 20250310185208 (Mon Mar 10 18:52:08 2025)
+. IN DNSKEY 257 3 13 uKwpRtMH+9iuUk/Xj6LciIP5ZckaBtXaUqxUxzJYexXjvxGZGX4470Jv hq2NCI3HBZQNaCCP/h9sluhIzRGPTA==
@@ -0,0 +1,7 @@
+Private-key-format: v1.3
+Algorithm: 13 (ECDSAP256SHA256)
+PrivateKey: m5udfGNSijISQ8Tfp4kx09O1em4PErLUw/mCj3SKmqw=
+Created: 20250310185208
+Publish: 20250310185208
+Activate: 20250310185208
+Revoke: 20250310185208
@@ -0,0 +1,5 @@
+; This is a zone-signing key, keyid 23768, for .
+; Created: 20250310185208 (Mon Mar 10 18:52:08 2025)
+; Publish: 20250310185208 (Mon Mar 10 18:52:08 2025)
+; Activate: 20250310185208 (Mon Mar 10 18:52:08 2025)
+. IN DNSKEY 256 3 13 TFelYtTRBWeA9A307vvuWIcaNwW4txW4RgSELtsi46ZQs24ncRxmxtFf uJuPyVXePNiE4HNI9CIowGUsn5WuBw==
@@ -0,0 +1,37 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+;	This is a zone which has two DNSKEY records, both of which have
+; existing private key files available.  They should be loaded automatically
+; and the zone correctly signed.
+;
+$TTL 30	; 30 seconds
+.			IN SOA	a.root.servers.nil. each.isc.org. (
+				2000042101 ; serial
+				600        ; refresh (10 minutes)
+				600        ; retry (10 minutes)
+				1200       ; expire (20 minutes)
+				600        ; minimum (10 minutes)
+				)
+			NS	a.root-servers.nil.
+			DNSKEY	256 3 13 (
+				TFelYtTRBWeA9A307vvuWIcaNwW4txW4RgSELtsi46ZQ
+				s24ncRxmxtFfuJuPyVXePNiE4HNI9CIowGUsn5WuBw==
+				) ; ZSK; alg = ECDSAP256SHA256 ; key id = 23768
+			DNSKEY	257 3 13 (
+				OSmhpULEDCUzHCBeDU5uJXzkCcGuW2qrkQznKRPGhRZN
+				j7ZUIGInGzM5Um5m02ULWt8tKbi55NJUeifKWegQ0g==
+				) ; KSK; alg = ECDSAP256SHA256 ; key id = 22255
+			DNSKEY	385 3 13 (
+				uKwpRtMH+9iuUk/Xj6LciIP5ZckaBtXaUqxUxzJYexXj
+				vxGZGX4470Jvhq2NCI3HBZQNaCCP/h9sluhIzRGPTA==
+				) ; revoked KSK; alg = ECDSAP256SHA256 ; key id = 23768
+a.root-servers.nil.	A	10.53.0.1
@@ -1564,6 +1564,18 @@ n=$((n + 1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status + ret))

+echo_ic "revoked KSK ID collides with ZSK ($n)"
+ret=0
+# signing should fail, but should not coredump
+(
+  cd signer/general || exit 0
+  rm -f signed.zone
+  $SIGNER -S -f signed.zone -o . test12.zone >signer.out.$n
+) && ret=1
+n=$((n + 1))
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status + ret))
+
 echo_ic "check that dnssec-signzone rejects excessive NSEC3 iterations ($n)"
 ret=0
 (
@@ -2179,7 +2191,7 @@ echo_i "checking RRSIG query from cache ($n)"
 ret=0
 dig_with_opts normalthenrrsig.secure.example. @10.53.0.4 a >/dev/null || ret=1
 ans=$(dig_with_opts +short normalthenrrsig.secure.example. @10.53.0.4 rrsig) || ret=1
-expect=$(dig_with_opts +short normalthenrrsig.secure.example. @10.53.0.3 rrsig | grep '^A') || ret=1
+expect=$(dig_with_opts +short normalthenrrsig.secure.example. @10.53.0.3 rrsig | grep -E '^(A|NSEC)') || ret=1
 test "$ans" = "$expect" || ret=1
 # also check that RA is set
 dig_with_opts normalthenrrsig.secure.example. @10.53.0.4 rrsig >dig.out.ns4.test$n || ret=1
@@ -2859,6 +2871,19 @@ dig_with_opts +noauth expired.example. +dnssec @10.53.0.4 soa >dig.out.ns4.test$
 grep "SERVFAIL" dig.out.ns4.test$n >/dev/null || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n >/dev/null && ret=1
 grep "expired.example/.*: RRSIG has expired" ns4/named.run >/dev/null || ret=1
+grep "; EDE: 7 (Signature Expired): (expired.example/DNSKEY)" dig.out.ns4.test$n >/dev/null || ret=1
+n=$((n + 1))
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status + ret))
+
+status=$((status + ret))
+echo_i "checking signatures in the future do not validate ($n)"
+ret=0
+dig_with_opts +noauth future.example. +dnssec @10.53.0.4 soa >dig.out.ns4.test$n || ret=1
+grep "SERVFAIL" dig.out.ns4.test$n >/dev/null || ret=1
+grep "flags:.*ad.*QUERY" dig.out.ns4.test$n >/dev/null && ret=1
+grep "future.example/.*: RRSIG validity period has not begun" ns4/named.run >/dev/null || ret=1
+grep "; EDE: 8 (Signature Not Yet Valid): (future.example/DNSKEY)" dig.out.ns4.test$n >/dev/null || ret=1
 n=$((n + 1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status + ret))
@@ -3755,7 +3780,7 @@ status=$((status + ret))
 echo_i "checking EDE code 1 for bad alg mnemonic ($n)"
 ret=0
 dig_with_opts @10.53.0.4 badalg.secure.example >dig.out.ns4.test$n || ret=1
-grep "; EDE: 1 (Unsupported DNSKEY Algorithm): (ECDSAP256SHA256 badalg.secure.example/A)" dig.out.ns4.test$n >/dev/null || ret=1
+grep "; EDE: 1 (Unsupported DNSKEY Algorithm): (ECDSAP256SHA256 badalg.secure.example/NSEC)" dig.out.ns4.test$n >/dev/null || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n >/dev/null && ret=1
 n=$((n + 1))
 test "$ret" -eq 0 || echo_i "failed"
@@ -4666,5 +4691,37 @@ n=$((n + 1))
 if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

+echo_i "checking validator behavior with mismatching NS ($n)"
+ret=0
+rndccmd 10.53.0.4 flush 2>&1 | sed 's/^/ns4 /' | cat_i
+$DIG +tcp +cd -p "$PORT" -t ns inconsistent @10.53.0.4 >dig.out.ns4.test$n.1 || ret=1
+grep "ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 2" dig.out.ns4.test$n.1 >/dev/null || ret=1
+grep "flags:.*ad.*QUERY" dig.out.ns4.test$n.1 >/dev/null && ret=1
+$DIG +tcp +cd +dnssec -p "$PORT" -t ns inconsistent @10.53.0.4 >dig.out.ns4.test$n.2 || ret=1
+grep "ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 2" dig.out.ns4.test$n.2 >/dev/null || ret=1
+grep "flags:.*ad.*QUERY" dig.out.ns4.test$n.2 >/dev/null && ret=1
+$DIG +tcp +dnssec -p "$PORT" -t ns inconsistent @10.53.0.4 >dig.out.ns4.test$n.3 || ret=1
+grep "ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1" dig.out.ns4.test$n.3 >/dev/null || ret=1
+grep "flags:.*ad.*QUERY" dig.out.ns4.test$n.3 >/dev/null || ret=1
+n=$((n + 1))
+if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+echo_i "checking that a insecure negative response where there is a NSEC without a RRSIG succeeds ($n)"
+ret=0
+# check server preconditions
+dig_with_opts +notcp @10.53.0.10 nsec-rrsigs-stripped. TXT +dnssec >dig.out.ns10.test$n
+grep "status: NOERROR" dig.out.ns10.test$n >/dev/null || ret=1
+grep "QUERY: 1, ANSWER: 0, AUTHORITY: 2, ADDITIONAL: 1" dig.out.ns10.test$n >/dev/null || ret=1
+grep "IN.RRSIG.NSEC" dig.out.ns10.test$n >/dev/null && ret=1
+# check resolver succeeds
+dig_with_opts @10.53.0.4 nsec-rrsigs-stripped. TXT +dnssec >dig.out.ns4.test$n
+grep "status: NOERROR" dig.out.ns4.test$n >/dev/null || ret=1
+grep "QUERY: 1, ANSWER: 0, AUTHORITY: 2, ADDITIONAL: 1" dig.out.ns4.test$n >/dev/null || ret=1
+grep "IN.RRSIG.NSEC" dig.out.ns4.test$n >/dev/null && ret=1
+n=$((n + 1))
+if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -70,6 +70,7 @@ pytestmark = pytest.mark.extra_artifacts(
        "ns2/settime.out.updatecheck-kskonly.secure.zsk",
        "ns2/single-nsec3.db",
        "ns2/too-many-iterations.db",
+        "ns2/inconsistent.db",
        "ns2/trusted.db",
        "ns2/updatecheck-kskonly.secure.ksk.id",
        "ns2/updatecheck-kskonly.secure.ksk.key",
@@ -232,9 +232,7 @@ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	dns_fixedname_init(&name);
 	CHECK(dns__db_addrdataset(sampledb->db, node, version, now, rdataset,
 				  options, addedrdataset DNS__DB_FLARG_PASS));
-	if (rdataset->type == dns_rdatatype_a ||
-	    rdataset->type == dns_rdatatype_aaaa)
-	{
+	if (dns_rdatatype_isaddr(rdataset->type)) {
 		CHECK(dns_db_nodefullname(sampledb->db, node,
 					  dns_fixedname_name(&name)));
 		CHECK(syncptrs(sampledb->inst, dns_fixedname_name(&name),
@@ -263,9 +261,7 @@ subtractrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 		goto cleanup;
 	}

-	if (rdataset->type == dns_rdatatype_a ||
-	    rdataset->type == dns_rdatatype_aaaa)
-	{
+	if (dns_rdatatype_isaddr(rdataset->type)) {
 		CHECK(dns_db_nodefullname(sampledb->db, node,
 					  dns_fixedname_name(&name)));
 		CHECK(syncptrs(sampledb->inst, dns_fixedname_name(&name),
@@ -518,7 +514,7 @@ add_ns(dns_db_t *db, dns_dbversion_t *version, const dns_name_t *name,
 	ns.common.rdtype = dns_rdatatype_ns;
 	ns.common.rdclass = dns_db_class(db);
 	ns.mctx = NULL;
-	dns_name_init(&ns.name, NULL);
+	dns_name_init(&ns.name);
 	dns_name_clone(nsname, &ns.name);
 	CHECK(dns_rdata_fromstruct(&rdata, dns_db_class(db), dns_rdatatype_ns,
 				   &ns, &b));
@@ -608,9 +604,9 @@ create_db(isc_mem_t *mctx, const dns_name_t *origin, dns_dbtype_t type,
 	};

 	isc_mem_attach(mctx, &sampledb->common.mctx);
-	dns_name_init(&sampledb->common.origin, NULL);
+	dns_name_init(&sampledb->common.origin);

-	dns_name_dupwithoffsets(origin, mctx, &sampledb->common.origin);
+	dns_name_dup(origin, mctx, &sampledb->common.origin);

 	isc_refcount_init(&sampledb->common.references, 1);

@@ -224,7 +224,7 @@ syncptr(sample_instance_t *inst, dns_name_t *name, dns_rdata_t *addr_rdata,

 	dns_fixedname_init(&ptr_name);
 	DNS_RDATACOMMON_INIT(&ptr_struct, dns_rdatatype_ptr, dns_rdataclass_in);
-	dns_name_init(&ptr_struct.ptr, NULL);
+	dns_name_init(&ptr_struct.ptr);

 	syncptr = isc_mem_get(mctx, sizeof(*syncptr));
 	*syncptr = (syncptr_t){ 0 };
@@ -23,13 +23,15 @@
 #include <openssl/provider.h>
 #endif

-#include <isc/fips.h>
+#include <isc/crypto.h>
+#include <isc/lib.h>
 #include <isc/md.h>
 #include <isc/mem.h>
 #include <isc/net.h>
 #include <isc/util.h>

 #include <dns/edns.h>
+#include <dns/lib.h>

 #include <dst/dst.h>

@@ -132,7 +134,7 @@ main(int argc, char **argv) {
 		return 1;
 #endif
 #else
-		if (isc_fips_mode()) {
+		if (isc_crypto_fips_mode()) {
 #if OPENSSL_VERSION_NUMBER >= 0x30000000L
 			return 0;
 #else
@@ -147,7 +149,7 @@ main(int argc, char **argv) {
 #if defined(ENABLE_FIPS_MODE)
 		return 0;
 #else
-		return isc_fips_mode() ? 0 : 1;
+		return isc_crypto_fips_mode() ? 0 : 1;
 #endif
 	}

@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	query-source address 10.53.0.5;
+	notify-source 10.53.0.5;
+	transfer-source 10.53.0.5;
+	port @PORT@;
+	directory ".";
+	pid-file "named.pid";
+	listen-on { 10.53.0.5; };
+	listen-on-v6 { none; };
+	recursion yes;
+	dnssec-validation yes;
+	notify yes;
+	stale-answer-enable yes;
+	stale-cache-enable yes;
+	stale-answer-client-timeout 0;
+	/* max-clients-per-query < clients-per-query */
+	clients-per-query 10;
+	max-clients-per-query 5;
+};
+
+trust-anchors { };
+
+server 10.53.0.4 {
+	edns no;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet 10.53.0.5 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+zone "." {
+	type hint;
+	file "root.hint";
+};
@@ -328,5 +328,14 @@ echo_i "$zspill clients spilled (expected $expected)"
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

+n=$((n + 1))
+echo_i "checking a warning is logged if max-clients-per-query < clients-per-query ($n)"
+ret=0
+copy_setports ns5/named3.conf.in ns5/named.conf
+rndc_reconfig ns5 10.53.0.5
+wait_for_message ns5/named.run "configured clients-per-query (10) exceeds max-clients-per-query (5); automatically adjusting max-clients-per-query to (10)" || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -36,7 +36,7 @@ fi
 echo_i "two question types"
 $PERL formerr.pl -a 10.53.0.1 -p ${PORT} twoquestiontypes >twoquestiontypes.out
 ans=$(grep got: twoquestiontypes.out)
-if [ "${ans}" != "got: 0000800100020000000000000e41414141414141414141414141410000010001c00c00020001" ]; then
+if [ "${ans}" != "got: 000080010000000000000000" ]; then
  echo_i "failed"
  status=$((status + 1))
 fi
@@ -224,6 +224,20 @@ class DnsProtocol(enum.Enum):
    TCP = enum.auto()


+@dataclass(frozen=True)
+class Peer:
+    """
+    Pretty-printed connection endpoint.
+    """
+
+    host: str
+    port: int
+
+    def __str__(self) -> str:
+        host = f"[{self.host}]" if ":" in self.host else self.host
+        return f"{host}:{self.port}"
+
+
@dataclass
 class QueryContext:
    """
@@ -232,7 +246,7 @@ class QueryContext:

    query: dns.message.Message
    response: dns.message.Message
-    peer: Tuple[str, int]
+    peer: Peer
    protocol: DnsProtocol
    zone: Optional[dns.zone.Zone] = None
    soa: Optional[dns.rrset.RRset] = None
@@ -513,56 +527,110 @@ class AsyncDnsServer(AsyncServer):
            self._zone_tree.add(zone)

    async def _handle_udp(
-        self, wire: bytes, peer: Tuple[str, int], transport: asyncio.DatagramTransport
+        self, wire: bytes, addr: Tuple[str, int], transport: asyncio.DatagramTransport
    ) -> None:
        logging.debug("Received UDP message: %s", wire.hex())
+        peer = Peer(addr[0], addr[1])
        responses = self._handle_query(wire, peer, DnsProtocol.UDP)
        async for response in responses:
-            transport.sendto(response, peer)
+            transport.sendto(response, addr)

    async def _handle_tcp(
        self, reader: asyncio.StreamReader, writer: asyncio.StreamWriter
    ) -> None:
-        wire_length_bytes = await reader.read(2)
-        (wire_length,) = struct.unpack("!H", wire_length_bytes)
-        logging.debug("Receiving TCP message (%d octets)...", wire_length)
+        peer_info = writer.get_extra_info("peername")
+        peer = Peer(peer_info[0], peer_info[1])
+        logging.debug("Accepted TCP connection from %s", peer)

-        wire = await reader.read(wire_length)
-        full_message = wire_length_bytes + wire
-        logging.debug("Received complete TCP message: %s", full_message.hex())
-
-        peer = writer.get_extra_info("peername")
-        responses = self._handle_query(wire, peer, DnsProtocol.TCP)
-        async for response in responses:
-            writer.write(response)
+        while True:
            try:
-                await writer.drain()
+                wire = await self._read_tcp_query(reader, peer)
+                if not wire:
+                    break
+                await self._send_tcp_response(writer, peer, wire)
            except ConnectionResetError:
-                logging.error(
-                    "TCP connection from %s reset by peer", self._format_peer(peer)
-                )
+                logging.error("TCP connection from %s reset by peer", peer)
                return

+        logging.debug("Closing TCP connection from %s", peer)
        writer.close()
        await writer.wait_closed()

-    def _format_peer(self, peer: Tuple[str, int]) -> str:
-        host = peer[0]
-        port = peer[1]
-        if "::" in host:
-            host = f"[{host}]"
-        return f"{host}:{port}"
+    async def _read_tcp_query(
+        self, reader: asyncio.StreamReader, peer: Peer
+    ) -> Optional[bytes]:
+        wire_length = await self._read_tcp_query_wire_length(reader, peer)
+        if not wire_length:
+            return None

-    def _log_query(
-        self, qctx: QueryContext, peer: Tuple[str, int], protocol: DnsProtocol
+        return await self._read_tcp_query_wire(reader, peer, wire_length)
+
+    async def _read_tcp_query_wire_length(
+        self, reader: asyncio.StreamReader, peer: Peer
+    ) -> Optional[int]:
+        logging.debug("Receiving TCP message length from %s...", peer)
+
+        wire_length_bytes = await self._read_tcp_octets(reader, peer, 2)
+        if not wire_length_bytes:
+            return None
+
+        (wire_length,) = struct.unpack("!H", wire_length_bytes)
+
+        return wire_length
+
+    async def _read_tcp_query_wire(
+        self, reader: asyncio.StreamReader, peer: Peer, wire_length: int
+    ) -> Optional[bytes]:
+        logging.debug("Receiving TCP message (%d octets) from %s...", wire_length, peer)
+
+        wire = await self._read_tcp_octets(reader, peer, wire_length)
+        if not wire:
+            return None
+
+        logging.debug("Received complete TCP message from %s: %s", peer, wire.hex())
+
+        return wire
+
+    async def _read_tcp_octets(
+        self, reader: asyncio.StreamReader, peer: Peer, expected: int
+    ) -> Optional[bytes]:
+        buffer = b""
+
+        while len(buffer) < expected:
+            chunk = await reader.read(expected - len(buffer))
+            if not chunk:
+                if buffer:
+                    logging.debug(
+                        "Received short TCP message (%d octets) from %s: %s",
+                        len(buffer),
+                        peer,
+                        buffer.hex(),
+                    )
+                else:
+                    logging.debug("Received disconnect from %s", peer)
+                return None
+
+            logging.debug("Received %d TCP octets from %s", len(chunk), peer)
+            buffer += chunk
+
+        return buffer
+
+    async def _send_tcp_response(
+        self, writer: asyncio.StreamWriter, peer: Peer, wire: bytes
    ) -> None:
+        responses = self._handle_query(wire, peer, DnsProtocol.TCP)
+        async for response in responses:
+            writer.write(response)
+            await writer.drain()
+
+    def _log_query(self, qctx: QueryContext, peer: Peer, protocol: DnsProtocol) -> None:
        logging.info(
            "Received %s/%s/%s (ID=%d) query from %s (%s)",
            qctx.qname.to_text(omit_final_dot=True),
            dns.rdataclass.to_text(qctx.qclass),
            dns.rdatatype.to_text(qctx.qtype),
            qctx.query.id,
-            self._format_peer(peer),
+            peer,
            protocol.name,
        )
        logging.debug(
@@ -573,14 +641,14 @@ class AsyncDnsServer(AsyncServer):
        self,
        qctx: QueryContext,
        response: Optional[Union[dns.message.Message, bytes]],
-        peer: Tuple[str, int],
+        peer: Peer,
        protocol: DnsProtocol,
    ) -> None:
        if not response:
            logging.info(
                "Not sending a response to query (ID=%d) from %s (%s)",
                qctx.query.id,
-                self._format_peer(peer),
+                peer,
                protocol.name,
            )
            return
@@ -606,7 +674,7 @@ class AsyncDnsServer(AsyncServer):
                len(response.authority),
                len(response.additional),
                qctx.query.id,
-                self._format_peer(peer),
+                peer,
                protocol.name,
            )
            logging.debug(
@@ -618,13 +686,13 @@ class AsyncDnsServer(AsyncServer):
            "Sending response (%d bytes) to a query (ID=%d) from %s (%s)",
            len(response),
            qctx.query.id,
-            self._format_peer(peer),
+            peer,
            protocol.name,
        )
        logging.debug("[OUT] %s", response.hex())

    async def _handle_query(
-        self, wire: bytes, peer: Tuple[str, int], protocol: DnsProtocol
+        self, wire: bytes, peer: Peer, protocol: DnsProtocol
    ) -> AsyncGenerator[bytes, None]:
        """
        Yield wire data to send as a response over the established transport.
@@ -130,7 +130,7 @@ $KEYGEN -G -k rsasha256 -l policies/kasp.conf $zone >keygen.out.$zone.2 2>&1
 zone="multisigner-model2.kasp"
 echo_i "setting up zone: $zone"
 KSK=$($KEYGEN -a $DEFAULT_ALGORITHM -f KSK -L 3600 -M 32768:65535 $zone 2>keygen.out.$zone.1)
-ZSK=$($KEYGEN -a $DEFAULT_ALGORITHM -L 3600 $zone -M 32768:65535 2>keygen.out.$zone.2)
+ZSK=$($KEYGEN -a $DEFAULT_ALGORITHM -L 3600 -M 32768:65535 $zone 2>keygen.out.$zone.2)
 cat "${KSK}.key" | grep -v ";.*" >>"${zone}.db"
 cat "${ZSK}.key" | grep -v ";.*" >>"${zone}.db"
 # Import the ZSK sets of the other providers into their DNSKEY RRset.
@@ -350,10 +350,9 @@ setup step2.enable-dnssec.autosign
 TpubN="now-900s"
 # RRSIG TTL:              12 hour (43200 seconds)
 # zone-propagation-delay: 5 minutes (300 seconds)
-# retire-safety:          20 minutes (1200 seconds)
 # Already passed time:    -900 seconds
-# Total:                  43800 seconds
-TsbmN="now+43800s"
+# Total:                  42600 seconds
+TsbmN="now+42600s"
 keytimes="-P ${TpubN} -P sync ${TsbmN} -A ${TpubN}"
 CSK=$($KEYGEN -k enable-dnssec -l policies/autosign.conf $keytimes $zone 2>keygen.out.$zone.1)
 $SETTIME -s -g $O -k $R $TpubN -r $R $TpubN -d $H $TpubN -z $R $TpubN "$CSK" >settime.out.$zone.1 2>&1
@@ -365,10 +364,10 @@ $SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O raw -f "${zonefile}.signed" $i
 # Step 3:
 # The zone signatures have been published long enough to become OMNIPRESENT.
 setup step3.enable-dnssec.autosign
-# Passed time since publications: 43800 + 900 = 44700 seconds.
-TpubN="now-44700s"
+# Passed time since publications: 42600 + 900 = 43500 seconds.
+TpubN="now-43500s"
 # The key is secure for using in chain of trust when the DNSKEY is OMNIPRESENT.
-TcotN="now-43800s"
+TcotN="now-42600s"
 # We can submit the DS now.
 TsbmN="now"
 keytimes="-P ${TpubN} -P sync ${TsbmN} -A ${TpubN}"
@@ -127,9 +127,9 @@ setup step2.algorithm-roll.kasp
 # The time passed since the new algorithm keys have been introduced is 3 hours.
 TactN="now-3h"
 TpubN1="now-3h"
-# Tsbm(N+1) = TpubN1 + Ipub = now + TTLsig + Dprp + publish-safety =
-# now - 3h + 6h + 1h + 1h = now + 5h
-TsbmN1="now+5h"
+# Tsbm(N+1) = TpubN1 + Ipub = now + TTLsig + Dprp =
+# now - 3h + 6h + 1h = now + 4h
+TsbmN1="now+4h"
 ksk1times="-P ${TactN}  -A ${TactN}  -P sync ${TactN}  -I now"
 zsk1times="-P ${TactN}  -A ${TactN}                    -I now"
 ksk2times="-P ${TpubN1} -A ${TpubN1} -P sync ${TsbmN1}"
@@ -156,11 +156,11 @@ $SIGNER -S -x -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infil
 # Step 3:
 # The zone signatures are also OMNIPRESENT.
 setup step3.algorithm-roll.kasp
-# The time passed since the new algorithm keys have been introduced is 9 hours.
-TactN="now-9h"
-TretN="now-6h"
-TpubN1="now-9h"
-TsbmN1="now-1h"
+# The time passed since the new algorithm keys have been introduced is 7 hours.
+TactN="now-7h"
+TretN="now-3h"
+TpubN1="now-7h"
+TsbmN1="now"
 ksk1times="-P ${TactN}  -A ${TactN}  -P sync ${TactN}  -I ${TretN}"
 zsk1times="-P ${TactN}  -A ${TactN}                    -I ${TretN}"
 ksk2times="-P ${TpubN1} -A ${TpubN1} -P sync ${TsbmN1}"
@@ -188,11 +188,11 @@ $SIGNER -S -x -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infil
 # The DS is swapped and can become OMNIPRESENT.
 setup step4.algorithm-roll.kasp
 # The time passed since the DS has been swapped is 29 hours.
-TactN="now-38h"
-TretN="now-35h"
-TpubN1="now-38h"
-TsbmN1="now-30h"
-TactN1="now-29h"
+TactN="now-36h"
+TretN="now-33h"
+TpubN1="now-36h"
+TsbmN1="now-29h"
+TactN1="now-27h"
 ksk1times="-P ${TactN}  -A ${TactN}  -P sync ${TactN}  -I ${TretN}"
 zsk1times="-P ${TactN}  -A ${TactN}                    -I ${TretN}"
 ksk2times="-P ${TpubN1} -A ${TpubN1} -P sync ${TsbmN1}"
@@ -220,12 +220,12 @@ $SIGNER -S -x -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infil
 # The DNSKEY is removed long enough to be HIDDEN.
 setup step5.algorithm-roll.kasp
 # The time passed since the DNSKEY has been removed is 2 hours.
-TactN="now-40h"
-TretN="now-37h"
+TactN="now-38h"
+TretN="now-35h"
 TremN="now-2h"
-TpubN1="now-40h"
-TsbmN1="now-32h"
-TactN1="now-31h"
+TpubN1="now-38h"
+TsbmN1="now-31h"
+TactN1="now-29h"
 ksk1times="-P ${TactN}  -A ${TactN}  -P sync ${TactN}  -I ${TretN}"
 zsk1times="-P ${TactN}  -A ${TactN}                    -I ${TretN}"
 ksk2times="-P ${TpubN1} -A ${TpubN1} -P sync ${TsbmN1}"
@@ -253,13 +253,13 @@ $SIGNER -S -x -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infil
 # The RRSIGs have been removed long enough to be HIDDEN.
 setup step6.algorithm-roll.kasp
 # Additional time passed: 7h.
-TactN="now-47h"
-TretN="now-44h"
+TactN="now-45h"
+TretN="now-42h"
 TremN="now-7h"
-TpubN1="now-47h"
-TsbmN1="now-39h"
-TactN1="now-38h"
-TdeaN="now-9h"
+TpubN1="now-45h"
+TsbmN1="now-38h"
+TactN1="now-36h"
+TdeaN="now-7h"
 ksk1times="-P ${TactN}  -A ${TactN}  -P sync ${TactN}  -I ${TretN}"
 zsk1times="-P ${TactN}  -A ${TactN}                    -I ${TretN}"
 ksk2times="-P ${TpubN1} -A ${TpubN1} -P sync ${TsbmN1}"
@@ -324,11 +324,11 @@ $SIGNER -S -x -z -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $in
 # Step 3:
 # The zone signatures are also OMNIPRESENT.
 setup step3.csk-algorithm-roll.kasp
-# The time passed since the new algorithm keys have been introduced is 9 hours.
-TactN="now-9h"
-TretN="now-6h"
-TpubN1="now-9h"
-TactN1="now-6h"
+# The time passed since the new algorithm keys have been introduced is 7 hours.
+TactN="now-7h"
+TretN="now-3h"
+TpubN1="now-7h"
+TactN1="now-3h"
 csktimes="-P ${TactN}  -A ${TactN} -P sync ${TactN} -I ${TretN}"
 newtimes="-P ${TpubN1} -A ${TpubN1}"
 CSK1=$($KEYGEN -k csk-algoroll -l policies/csk1.conf $csktimes $zone 2>keygen.out.$zone.1)
@@ -347,10 +347,10 @@ $SIGNER -S -x -z -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $in
 # The DS is swapped and can become OMNIPRESENT.
 setup step4.csk-algorithm-roll.kasp
 # The time passed since the DS has been swapped is 29 hours.
-TactN="now-38h"
-TretN="now-35h"
-TpubN1="now-38h"
-TactN1="now-35h"
+TactN="now-36h"
+TretN="now-33h"
+TpubN1="now-36h"
+TactN1="now-33h"
 TsubN1="now-29h"
 csktimes="-P ${TactN}  -A ${TactN} -P sync ${TactN} -I ${TretN}"
 newtimes="-P ${TpubN1} -A ${TpubN1}"
@@ -370,11 +370,11 @@ $SIGNER -S -x -z -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $in
 # The DNSKEY is removed long enough to be HIDDEN.
 setup step5.csk-algorithm-roll.kasp
 # The time passed since the DNSKEY has been removed is 2 hours.
-TactN="now-40h"
-TretN="now-37h"
+TactN="now-38h"
+TretN="now-35h"
 TremN="now-2h"
-TpubN1="now-40h"
-TactN1="now-37h"
+TpubN1="now-38h"
+TactN1="now-35h"
 TsubN1="now-31h"
 csktimes="-P ${TactN}  -A ${TactN} -P sync ${TactN} -I ${TretN}"
 newtimes="-P ${TpubN1} -A ${TpubN1}"
@@ -394,12 +394,12 @@ $SIGNER -S -x -z -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $in
 # The RRSIGs have been removed long enough to be HIDDEN.
 setup step6.csk-algorithm-roll.kasp
 # Additional time passed: 7h.
-TactN="now-47h"
-TretN="now-44h"
+TactN="now-45h"
+TretN="now-42h"
 TdeaN="now-9h"
 TremN="now-7h"
-TpubN1="now-47h"
-TactN1="now-44h"
+TpubN1="now-45h"
+TactN1="now-42h"
 TsubN1="now-38h"
 csktimes="-P ${TactN}  -A ${TactN} -P sync ${TactN} -I ${TretN}"
 newtimes="-P ${TpubN1} -A ${TpubN1}"
@@ -275,9 +275,8 @@ set_keytimes_csk_policy() {
  set_keytime "KEY1" "ACTIVE" "${created}"
  # The DS can be published if the DNSKEY and RRSIG records are
  # OMNIPRESENT.  This happens after max-zone-ttl (1d) plus
-  # publish-safety (1h) plus zone-propagation-delay (300s) =
-  # 86400 + 3600 + 300 = 90300.
-  set_addkeytime "KEY1" "SYNCPUBLISH" "${created}" 90300
+  # zone-propagation-delay (300s) = 86400 + 300 = 86700.
+  set_addkeytime "KEY1" "SYNCPUBLISH" "${created}" 86700
  # Key lifetime is unlimited, so not setting RETIRED and REMOVED.
 }

@@ -769,9 +768,8 @@ set_keytimes_algorithm_policy() {

  # The DS can be published if the DNSKEY and RRSIG records are
  # OMNIPRESENT.  This happens after max-zone-ttl (1d) plus
-  # publish-safety (1h) plus zone-propagation-delay (300s) =
-  # 86400 + 3600 + 300 = 90300.
-  set_addkeytime "KEY1" "SYNCPUBLISH" "${published}" 90300
+  # zone-propagation-delay (300s) = 86400 + 300 = 86700.
+  set_addkeytime "KEY1" "SYNCPUBLISH" "${published}" 86700
  # Key lifetime is 10 years, 315360000 seconds.
  set_addkeytime "KEY1" "RETIRED" "${published}" 315360000
  # The key is removed after the retire time plus DS TTL (1d),
@@ -1720,10 +1718,10 @@ published=$(awk '{print $3}' <published.test${n}.key1)
 set_keytime "KEY1" "PUBLISHED" "${published}"
 set_keytime "KEY1" "ACTIVE" "${published}"
 published=$(key_get KEY1 PUBLISHED)
-# The DS can be published if the DNSKEY and RRSIG records are OMNIPRESENT.
-#  This happens after max-zone-ttl (1d) plus publish-safety (1h) plus
-# zone-propagation-delay (300s) = 86400 + 3600 + 300 = 90300.
-set_addkeytime "KEY1" "SYNCPUBLISH" "${published}" 90300
+# The DS can be published if the zone is fully signed.
+# This happens after max-zone-ttl (1d) plus
+# zone-propagation-delay (300s) = 86400 + 300 = 86700.
+set_addkeytime "KEY1" "SYNCPUBLISH" "${published}" 86700
 # Key lifetime is 6 months, 315360000 seconds.
 set_addkeytime "KEY1" "RETIRED" "${published}" 16070400
 # The key is removed after the retire time plus DS TTL (1d), parent
@@ -2486,9 +2484,9 @@ set_keytime "KEY1" "PUBLISHED" "${created}"
 set_keytime "KEY1" "ACTIVE" "${created}"
 # - The DS can be published if the DNSKEY and RRSIG records are
 #   OMNIPRESENT.  This happens after max-zone-ttl (12h) plus
-#   publish-safety (5m) plus zone-propagation-delay (5m) =
-#   43200 + 300 + 300 = 43800.
-set_addkeytime "KEY1" "SYNCPUBLISH" "${created}" 43800
+#   plus zone-propagation-delay (5m) =
+#   43200 + 300 = 43500.
+set_addkeytime "KEY1" "SYNCPUBLISH" "${created}" 43500
 # - Key lifetime is unlimited, so not setting RETIRED and REMOVED.

 # Various signing policy checks.
@@ -2556,7 +2554,7 @@ check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
 created=$(key_get KEY1 CREATED)
 set_addkeytime "KEY1" "PUBLISHED" "${created}" -900
 set_addkeytime "KEY1" "ACTIVE" "${created}" -900
-set_addkeytime "KEY1" "SYNCPUBLISH" "${created}" 43800
+set_addkeytime "KEY1" "SYNCPUBLISH" "${created}" 42600

 # Continue signing policy checks.
 check_keytimes
@@ -2566,8 +2564,8 @@ dnssec_verify

 # Next key event is when the zone signatures become OMNIPRESENT: max-zone-ttl
 # plus zone propagation delay plus retire safety minus the already elapsed
-# 900 seconds: 12h + 300s + 20m - 900 = 44700 - 900 = 43800 seconds
-check_next_key_event 43800
+# 900 seconds: 12h + 300s + 20m - 900 = 43500 - 900 = 42600 seconds
+check_next_key_event 42600

 #
 # Zone: step3.enable-dnssec.autosign.
@@ -2584,10 +2582,10 @@ check_keys
 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"

 # Set expected key times:
-# - The key was published and activated 44700 seconds ago (with settime).
+# - The key was published and activated 43500 seconds ago (with settime).
 created=$(key_get KEY1 CREATED)
-set_addkeytime "KEY1" "PUBLISHED" "${created}" -44700
-set_addkeytime "KEY1" "ACTIVE" "${created}" -44700
+set_addkeytime "KEY1" "PUBLISHED" "${created}" -43500
+set_addkeytime "KEY1" "ACTIVE" "${created}" -43500
 set_keytime "KEY1" "SYNCPUBLISH" "${created}"

 # Continue signing policy checks.
@@ -2603,8 +2601,8 @@ check_cdslog "$DIR" "$ZONE" KEY1
 rndc_checkds "$SERVER" "$DIR" KEY1 "now" "published" "$ZONE"
 # Next key event is when the DS can move to the OMNIPRESENT state.  This occurs
 # when the parent propagation delay have passed, plus the DS TTL and retire
-# safety delay:  1h + 2h + 20m = 3h20m = 12000 seconds
-check_next_key_event 12000
+# safety delay:  1h + 2h = 3h = 10800 seconds
+check_next_key_event 10800

 #
 # Zone: step4.enable-dnssec.autosign.
@@ -4388,9 +4386,9 @@ check_subdomain
 dnssec_verify

 # Next key event is when the DS becomes HIDDEN. This happens after the
-# parent propagation delay, retire safety delay, and DS TTL:
-# 1h + 1h + 1d = 26h = 93600 seconds.
-check_next_key_event 93600
+# parent propagation delay, and DS TTL:
+# 1h + 1d = 25h = 90000 seconds.
+check_next_key_event 90000

 #
 # Zone: step2.going-insecure.kasp
@@ -4456,8 +4454,8 @@ dnssec_verify

 # Next key event is when the DS becomes HIDDEN. This happens after the
 # parent propagation delay, retire safety delay, and DS TTL:
-# 1h + 1h + 1d = 26h = 93600 seconds.
-check_next_key_event 93600
+# 1h + 1d = 25h = 90000 seconds.
+check_next_key_event 90000

 #
 # Zone: step2.going-insecure-dynamic.kasp
@@ -4651,12 +4649,11 @@ set_addkeytime "KEY2" "REMOVED" "${retired}" "${IretZSK}"
 created=$(key_get KEY3 CREATED)
 set_keytime "KEY3" "PUBLISHED" "${created}"
 set_keytime "KEY3" "ACTIVE" "${created}"
-# - It takes TTLsig + Dprp + publish-safety hours to propagate the zone.
+# - It takes TTLsig + Dprp to propagate the zone.
 #   TTLsig:         6h (39600 seconds)
 #   Dprp:           1h (3600 seconds)
-#   publish-safety: 1h (3600 seconds)
-#   Ipub:           8h (28800 seconds)
-Ipub=28800
+#   Ipub:           7h (25200 seconds)
+Ipub=25200
 set_addkeytime "KEY3" "SYNCPUBLISH" "${created}" "${Ipub}"
 # - The new ZSK is published and activated.
 created=$(key_get KEY4 CREATED)
@@ -4725,12 +4722,12 @@ dnssec_verify

 # Next key event is when all zone signatures are signed with the new
 # algorithm.  This is the max-zone-ttl plus zone propagation delay
-# plus retire safety: 6h + 1h + 2h.  But three hours have already passed
-# (the time it took to make the DNSKEY omnipresent), so the next event
-# should be scheduled in 6 hour: 21600 seconds.  Prevent intermittent
+# 6h + 1h.  But three hours have already passed (the time it took to
+# make the DNSKEY omnipresent), so the next event should be scheduled
+# in 4 hour: 14400 seconds.  Prevent intermittent
 # false positives on slow platforms by subtracting the number of seconds
 # which passed between key creation and invoking 'rndc reconfig'.
-next_time=$((21600 - time_passed))
+next_time=$((14400 - time_passed))
 check_next_key_event $next_time

 #
@@ -4753,28 +4750,28 @@ check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
 check_cdslog "$DIR" "$ZONE" KEY3

 # Set expected key times:
-# - The old keys were activated 9 hours ago (32400 seconds).
-rollover_predecessor_keytimes -32400
-# - And retired 6 hours ago (21600 seconds).
+# - The old keys were activated 7 hours ago (25200 seconds).
+rollover_predecessor_keytimes -25200
+# - And retired 3 hours ago (10800 seconds).
 created=$(key_get KEY1 CREATED)
-set_addkeytime "KEY1" "RETIRED" "${created}" -21600
+set_addkeytime "KEY1" "RETIRED" "${created}" -10800
 retired=$(key_get KEY1 RETIRED)
 set_addkeytime "KEY1" "REMOVED" "${retired}" "${IretKSK}"

 created=$(key_get KEY2 CREATED)
-set_addkeytime "KEY2" "RETIRED" "${created}" -21600
+set_addkeytime "KEY2" "RETIRED" "${created}" -10800
 retired=$(key_get KEY2 RETIRED)
 set_addkeytime "KEY2" "REMOVED" "${retired}" "${IretZSK}"
-# - The new keys are published 9 hours ago.
+# - The new keys are published 7 hours ago.
 created=$(key_get KEY3 CREATED)
-set_addkeytime "KEY3" "PUBLISHED" "${created}" -32400
-set_addkeytime "KEY3" "ACTIVE" "${created}" -32400
+set_addkeytime "KEY3" "PUBLISHED" "${created}" -25200
+set_addkeytime "KEY3" "ACTIVE" "${created}" -25200
 published=$(key_get KEY3 PUBLISHED)
 set_addkeytime "KEY3" "SYNCPUBLISH" "${published}" ${Ipub}

 created=$(key_get KEY4 CREATED)
-set_addkeytime "KEY4" "PUBLISHED" "${created}" -32400
-set_addkeytime "KEY4" "ACTIVE" "${created}" -32400
+set_addkeytime "KEY4" "PUBLISHED" "${created}" -25200
+set_addkeytime "KEY4" "ACTIVE" "${created}" -25200

 # Continue signing policy checks.
 check_keytimes
@@ -4787,9 +4784,9 @@ dnssec_verify
 rndc_checkds "$SERVER" "$DIR" KEY1 "now" "withdrawn" "$ZONE"
 rndc_checkds "$SERVER" "$DIR" KEY3 "now" "published" "$ZONE"
 # Next key event is when the DS becomes OMNIPRESENT. This happens after the
-# parent propagation delay, retire safety delay, and DS TTL:
-# 1h + 2h + 2h = 5h = 18000 seconds.
-check_next_key_event 18000
+# parent propagation delay, and DS TTL:
+# 1h + 2h = 3h = 10800 seconds.
+check_next_key_event 10800

 #
 # Zone: step4.algorithm-roll.kasp
@@ -4816,29 +4813,29 @@ wait_for_done_signing
 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"

 # Set expected key times:
-# - The old keys were activated 38 hours ago (136800 seconds).
-rollover_predecessor_keytimes -136800
-# - And retired 35 hours ago (126000 seconds).
+# - The old keys were activated 36 hours ago (129600 seconds).
+rollover_predecessor_keytimes -129600
+# - And retired 33 hours ago (118800 seconds).
 created=$(key_get KEY1 CREATED)
-set_addkeytime "KEY1" "RETIRED" "${created}" -126000
+set_addkeytime "KEY1" "RETIRED" "${created}" -118800
 retired=$(key_get KEY1 RETIRED)
 set_addkeytime "KEY1" "REMOVED" "${retired}" "${IretKSK}"

 created=$(key_get KEY2 CREATED)
-set_addkeytime "KEY2" "RETIRED" "${created}" -126000
+set_addkeytime "KEY2" "RETIRED" "${created}" -118800
 retired=$(key_get KEY2 RETIRED)
 set_addkeytime "KEY2" "REMOVED" "${retired}" "${IretZSK}"

-# - The new keys are published 38 hours ago.
+# - The new keys are published 36 hours ago.
 created=$(key_get KEY3 CREATED)
-set_addkeytime "KEY3" "PUBLISHED" "${created}" -136800
-set_addkeytime "KEY3" "ACTIVE" "${created}" -136800
+set_addkeytime "KEY3" "PUBLISHED" "${created}" -129600
+set_addkeytime "KEY3" "ACTIVE" "${created}" -129600
 published=$(key_get KEY3 PUBLISHED)
 set_addkeytime "KEY3" "SYNCPUBLISH" "${published}" ${Ipub}

 created=$(key_get KEY4 CREATED)
-set_addkeytime "KEY4" "PUBLISHED" "${created}" -136800
-set_addkeytime "KEY4" "ACTIVE" "${created}" -136800
+set_addkeytime "KEY4" "PUBLISHED" "${created}" -129600
+set_addkeytime "KEY4" "ACTIVE" "${created}" -129600

 # Continue signing policy checks.
 check_keytimes
@@ -4867,29 +4864,29 @@ wait_for_done_signing
 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"

 # Set expected key times:
-# - The old keys were activated 40 hours ago (144000 seconds)
-rollover_predecessor_keytimes -144000
-# - And retired 37 hours ago (133200 seconds).
+# - The old keys were activated 38 hours ago (136800 seconds)
+rollover_predecessor_keytimes -136800
+# - And retired 35 hours ago (126000 seconds).
 created=$(key_get KEY1 CREATED)
-set_addkeytime "KEY1" "RETIRED" "${created}" -133200
+set_addkeytime "KEY1" "RETIRED" "${created}" -126000
 retired=$(key_get KEY1 RETIRED)
 set_addkeytime "KEY1" "REMOVED" "${retired}" "${IretKSK}"

 created=$(key_get KEY2 CREATED)
-set_addkeytime "KEY2" "RETIRED" "${created}" -133200
+set_addkeytime "KEY2" "RETIRED" "${created}" -126000
 retired=$(key_get KEY2 RETIRED)
 set_addkeytime "KEY2" "REMOVED" "${retired}" "${IretZSK}"

 # The new keys are published 40 hours ago.
 created=$(key_get KEY3 CREATED)
-set_addkeytime "KEY3" "PUBLISHED" "${created}" -144000
-set_addkeytime "KEY3" "ACTIVE" "${created}" -144000
+set_addkeytime "KEY3" "PUBLISHED" "${created}" -136800
+set_addkeytime "KEY3" "ACTIVE" "${created}" -136800
 published=$(key_get KEY3 PUBLISHED)
 set_addkeytime "KEY3" "SYNCPUBLISH" "${published}" ${Ipub}

 created=$(key_get KEY4 CREATED)
-set_addkeytime "KEY4" "PUBLISHED" "${created}" -144000
-set_addkeytime "KEY4" "ACTIVE" "${created}" -144000
+set_addkeytime "KEY4" "PUBLISHED" "${created}" -136800
+set_addkeytime "KEY4" "ACTIVE" "${created}" -136800

 # Continue signing policy checks.
 check_keytimes
@@ -4898,12 +4895,12 @@ check_subdomain
 dnssec_verify

 # Next key event is when the RSASHA1 signatures become HIDDEN.  This happens
-# after the max-zone-ttl plus zone propagation delay plus retire safety
-# (6h + 1h + 2h) minus the time already passed since the UNRETENTIVE state has
-# been reached (2h): 9h - 2h = 7h = 25200 seconds. Prevent intermittent
+# after the max-zone-ttl plus zone propagation delay (6h + 1h)
+# minus the time already passed since the UNRETENTIVE state has
+# been reached (2h): 7h - 2h = 5h = 18000 seconds. Prevent intermittent
 # false positives on slow platforms by subtracting the number of seconds
 # which passed between key creation and invoking 'rndc reconfig'.
-next_time=$((25200 - time_passed))
+next_time=$((18000 - time_passed))
 check_next_key_event $next_time

 #
@@ -4921,29 +4918,29 @@ wait_for_done_signing
 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"

 # Set expected key times:
-# - The old keys were activated 47 hours ago (169200 seconds)
-rollover_predecessor_keytimes -169200
-# - And retired 44 hours ago (158400 seconds).
+# - The old keys were activated 45 hours ago (162000 seconds)
+rollover_predecessor_keytimes -162000
+# - And retired 42 hours ago (151200 seconds).
 created=$(key_get KEY1 CREATED)
-set_addkeytime "KEY1" "RETIRED" "${created}" -158400
+set_addkeytime "KEY1" "RETIRED" "${created}" -151200
 retired=$(key_get KEY1 RETIRED)
 set_addkeytime "KEY1" "REMOVED" "${retired}" "${IretKSK}"

 created=$(key_get KEY2 CREATED)
-set_addkeytime "KEY2" "RETIRED" "${created}" -158400
+set_addkeytime "KEY2" "RETIRED" "${created}" -151200
 retired=$(key_get KEY2 RETIRED)
 set_addkeytime "KEY2" "REMOVED" "${retired}" "${IretZSK}"

 # The new keys are published 47 hours ago.
 created=$(key_get KEY3 CREATED)
-set_addkeytime "KEY3" "PUBLISHED" "${created}" -169200
-set_addkeytime "KEY3" "ACTIVE" "${created}" -169200
+set_addkeytime "KEY3" "PUBLISHED" "${created}" -162000
+set_addkeytime "KEY3" "ACTIVE" "${created}" -162000
 published=$(key_get KEY3 PUBLISHED)
 set_addkeytime "KEY3" "SYNCPUBLISH" "${published}" ${Ipub}

 created=$(key_get KEY4 CREATED)
-set_addkeytime "KEY4" "PUBLISHED" "${created}" -169200
-set_addkeytime "KEY4" "ACTIVE" "${created}" -169200
+set_addkeytime "KEY4" "PUBLISHED" "${created}" -162000
+set_addkeytime "KEY4" "ACTIVE" "${created}" -162000

 # Continue signing policy checks.
 check_keytimes
@@ -5026,9 +5023,8 @@ set_keytime "KEY2" "ACTIVE" "${created}"
 # - It takes TTLsig + Dprp + publish-safety hours to propagate the zone.
 #   TTLsig:         6h (39600 seconds)
 #   Dprp:           1h (3600 seconds)
-#   publish-safety: 1h (3600 seconds)
-#   Ipub:           8h (28800 seconds)
-Ipub=28800
+#   Ipub:           7h (25200 seconds)
+Ipub=25200
 set_addkeytime "KEY2" "SYNCPUBLISH" "${created}" "${Ipub}"

 # Continue signing policy checks.
@@ -5082,14 +5078,13 @@ check_apex
 check_subdomain
 dnssec_verify

-# Next key event is when all zone signatures are signed with the new
-# algorithm.  This is the max-zone-ttl plus zone propagation delay
-# plus retire safety: 6h + 1h + 2h.  But three hours have already passed
-# (the time it took to make the DNSKEY omnipresent), so the next event
-# should be scheduled in 6 hour: 21600 seconds.  Prevent intermittent
-# false positives on slow platforms by subtracting the number of seconds
-# which passed between key creation and invoking 'rndc reconfig'.
-next_time=$((21600 - time_passed))
+# Next key event is when all zone signatures are signed with the new algorithm.
+# This is the max-zone-ttl plus zone propagation delay: 6h + 1h.  But three
+# hours have already passed (the time it took to make the DNSKEY omnipresent),
+# so the next event should be scheduled in 4 hour: 14400 seconds.  Prevent
+# intermittent false positives on slow platforms by subtracting the number of
+# seconds which passed between key creation and invoking 'rndc reconfig'.
+next_time=$((14400 - time_passed))
 check_next_key_event $next_time

 #
@@ -5114,17 +5109,17 @@ check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
 check_cdslog "$DIR" "$ZONE" KEY2

 # Set expected key times:
-# - The old key was activated 9 hours ago (32400 seconds).
-csk_rollover_predecessor_keytimes -32400
-# - And was retired 6 hours ago (21600 seconds).
+# - The old key was activated 7 hours ago (25200 seconds).
+csk_rollover_predecessor_keytimes -25200
+# - And was retired 3 hours ago (10800 seconds).
 created=$(key_get KEY1 CREATED)
-set_addkeytime "KEY1" "RETIRED" "${created}" -21600
+set_addkeytime "KEY1" "RETIRED" "${created}" -10800
 retired=$(key_get KEY1 RETIRED)
 set_addkeytime "KEY1" "REMOVED" "${retired}" "${IretCSK}"
 # - The new key was published 9 hours ago.
 created=$(key_get KEY2 CREATED)
-set_addkeytime "KEY2" "PUBLISHED" "${created}" -32400
-set_addkeytime "KEY2" "ACTIVE" "${created}" -32400
+set_addkeytime "KEY2" "PUBLISHED" "${created}" -25200
+set_addkeytime "KEY2" "ACTIVE" "${created}" -25200
 published=$(key_get KEY2 PUBLISHED)
 set_addkeytime "KEY2" "SYNCPUBLISH" "${published}" "${Ipub}"

@@ -5138,9 +5133,9 @@ dnssec_verify
 rndc_checkds "$SERVER" "$DIR" KEY1 "now" "withdrawn" "$ZONE"
 rndc_checkds "$SERVER" "$DIR" KEY2 "now" "published" "$ZONE"
 # Next key event is when the DS becomes OMNIPRESENT. This happens after the
-# parent propagation delay, retire safety delay, and DS TTL:
-# 1h + 2h + 2h = 5h = 18000 seconds.
-check_next_key_event 18000
+# parent propagation delay, and DS TTL:
+# 1h + 2h = 3h = 10800 seconds.
+check_next_key_event 10800

 #
 # Zone: step4.csk-algorithm-roll.kasp
@@ -5164,17 +5159,17 @@ wait_for_done_signing
 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"

 # Set expected key times:
-# - The old key was activated 38 hours ago (136800 seconds)
-csk_rollover_predecessor_keytimes -136800
-# - And retired 35 hours ago (126000 seconds).
+# - The old keys were activated 36 hours ago (129600 seconds).
+csk_rollover_predecessor_keytimes -129600
+# - And retired 33 hours ago (118800 seconds).
 created=$(key_get KEY1 CREATED)
-set_addkeytime "KEY1" "RETIRED" "${created}" -126000
+set_addkeytime "KEY1" "RETIRED" "${created}" -118800
 retired=$(key_get KEY1 RETIRED)
 set_addkeytime "KEY1" "REMOVED" "${retired}" "${IretCSK}"
-# - The new key was published 38 hours ago.
+# - The new key was published 36 hours ago.
 created=$(key_get KEY2 CREATED)
-set_addkeytime "KEY2" "PUBLISHED" "${created}" -136800
-set_addkeytime "KEY2" "ACTIVE" "${created}" -136800
+set_addkeytime "KEY2" "PUBLISHED" "${created}" -129600
+set_addkeytime "KEY2" "ACTIVE" "${created}" -129600
 published=$(key_get KEY2 PUBLISHED)
 set_addkeytime "KEY2" "SYNCPUBLISH" "${published}" ${Ipub}

@@ -5204,17 +5199,17 @@ wait_for_done_signing
 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"

 # Set expected key times:
-# - The old key was activated 40 hours ago (144000 seconds)
-csk_rollover_predecessor_keytimes -144000
-# - And retired 37 hours ago (133200 seconds).
+# - The old key was activated 38 hours ago (136800 seconds)
+csk_rollover_predecessor_keytimes -136800
+# - And retired 35 hours ago (126000 seconds).
 created=$(key_get KEY1 CREATED)
-set_addkeytime "KEY1" "RETIRED" "${created}" -133200
+set_addkeytime "KEY1" "RETIRED" "${created}" -126000
 retired=$(key_get KEY1 RETIRED)
 set_addkeytime "KEY1" "REMOVED" "${retired}" "${IretCSK}"
-# - The new key was published 40 hours ago.
+# - The new key was published 38 hours ago.
 created=$(key_get KEY2 CREATED)
-set_addkeytime "KEY2" "PUBLISHED" "${created}" -144000
-set_addkeytime "KEY2" "ACTIVE" "${created}" -144000
+set_addkeytime "KEY2" "PUBLISHED" "${created}" -136800
+set_addkeytime "KEY2" "ACTIVE" "${created}" -136800
 published=$(key_get KEY2 PUBLISHED)
 set_addkeytime "KEY2" "SYNCPUBLISH" "${published}" ${Ipub}

@@ -5225,12 +5220,12 @@ check_subdomain
 dnssec_verify

 # Next key event is when the RSASHA1 signatures become HIDDEN.  This happens
-# after the max-zone-ttl plus zone propagation delay plus retire safety
-# (6h + 1h + 2h) minus the time already passed since the UNRETENTIVE state has
-# been reached (2h): 9h - 2h = 7h = 25200 seconds.  Prevent intermittent
-# false positives on slow platforms by subtracting the number of seconds
-# which passed between key creation and invoking 'rndc reconfig'.
-next_time=$((25200 - time_passed))
+# after the max-zone-ttl plus zone propagation delay (6h + 1h) minus the
+# time already passed since the UNRETENTIVE state has been reached (2h):
+# 7h - 2h = 5h = 18000 seconds.  Prevent intermittent false positives on slow
+# platforms by subtracting the number of seconds which passed between key
+# creation and invoking 'rndc reconfig'.
+next_time=$((18000 - time_passed))
 check_next_key_event $next_time

 #
@@ -5248,17 +5243,17 @@ wait_for_done_signing
 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"

 # Set expected key times:
-# - The old keys were activated 47 hours ago (169200 seconds)
-csk_rollover_predecessor_keytimes -169200
-# - And retired 44 hours ago (158400 seconds).
+# - The old keys were activated 45 hours ago (162000 seconds)
+csk_rollover_predecessor_keytimes -162000
+# - And retired 42 hours ago (151200 seconds).
 created=$(key_get KEY1 CREATED)
-set_addkeytime "KEY1" "RETIRED" "${created}" -158400
+set_addkeytime "KEY1" "RETIRED" "${created}" -151200
 retired=$(key_get KEY1 RETIRED)
 set_addkeytime "KEY1" "REMOVED" "${retired}" "${IretCSK}"
 # - The new key was published 47 hours ago.
 created=$(key_get KEY2 CREATED)
-set_addkeytime "KEY2" "PUBLISHED" "${created}" -169200
-set_addkeytime "KEY2" "ACTIVE" "${created}" -169200
+set_addkeytime "KEY2" "PUBLISHED" "${created}" -162000
+set_addkeytime "KEY2" "ACTIVE" "${created}" -162000
 published=$(key_get KEY2 PUBLISHED)
 set_addkeytime "KEY2" "SYNCPUBLISH" "${published}" ${Ipub}

@@ -53,12 +53,11 @@ def test_dig_tcp_keepalive_handling(named_port, servers):
    )

    isctest.log.info("check a re-configured keepalive value")
-    response = servers["ns2"].rndc("tcp-timeouts 300 300 300 200 100", log=False)
+    response = servers["ns2"].rndc("tcp-timeouts 300 300 300 200", log=False)
    assert "tcp-initial-timeout=300" in response
    assert "tcp-idle-timeout=300" in response
    assert "tcp-keepalive-timeout=300" in response
    assert "tcp-advertised-timeout=200" in response
-    assert "tcp-primaries-timeout=100" in response
    assert "; TCP-KEEPALIVE: 20.0 secs" in dig(
        "+tcp +keepalive foo.example. @10.53.0.2"
    )
@@ -597,6 +597,10 @@ def test_ksr_common(servers):
            selected += 1
        if "Generating" in output:
            generated += 1
+        # Subtract if there was a key collision.
+        if "collide" in output:
+            generated -= 1
+
    assert selected == 2
    assert generated == 2
    for index, key in enumerate(overlapping_zsks):
@@ -17,6 +17,7 @@
 #include <stdlib.h>

 #include <isc/hash.h>
+#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
@@ -25,6 +26,7 @@
 #include <dns/db.h>
 #include <dns/fixedname.h>
 #include <dns/journal.h>
+#include <dns/lib.h>
 #include <dns/name.h>
 #include <dns/types.h>

@@ -109,7 +111,7 @@ cleanup:
 	}

 	if (mctx != NULL) {
-		isc_mem_destroy(&mctx);
+		isc_mem_detach(&mctx);
 	}

 	return result != ISC_R_SUCCESS ? 1 : 0;
@@ -385,7 +385,7 @@ $DIG $DIGOPTS @10.53.0.3 foo.initially-unavailable. A >dig.out.ns3.test$n.1 2>&1
 grep "NOERROR" dig.out.ns3.test$n.1 >/dev/null || ret=1
 grep "flags:.* ad" dig.out.ns3.test$n.1 >/dev/null || ret=1
 # Sanity check: the authoritative server should have been queried.
-nextpart ns2/named.run | grep "query 'foo.initially-unavailable/A/IN'" >/dev/null || ret=1
+nextpart ns2/named.run | grep "query 'foo.initially-unavailable/NS/IN'" >/dev/null || ret=1
 # Reconfigure ns2 so that the zone can be mirrored on ns3.
 sed '/^zone "initially-unavailable" {$/,/^};$/ {
 	s/10.53.0.254/10.53.0.3/
@@ -403,7 +403,7 @@ $DIG $DIGOPTS @10.53.0.3 foo.initially-unavailable. A >dig.out.ns3.test$n.2 2>&1
 grep "NOERROR" dig.out.ns3.test$n.2 >/dev/null || ret=1
 grep "flags:.* ad" dig.out.ns3.test$n.2 >/dev/null || ret=1
 # Ensure the authoritative server was not queried.
-nextpart ns2/named.run | grep "query 'foo.initially-unavailable/A/IN'" >/dev/null && ret=1
+nextpart ns2/named.run | grep "query 'foo.initially-unavailable/NS/IN'" >/dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

@@ -434,7 +434,7 @@ $DIG $DIGOPTS @10.53.0.3 foo.initially-unavailable. A >dig.out.ns3.test$n 2>&1 |
 grep "NOERROR" dig.out.ns3.test$n >/dev/null || ret=1
 grep "flags:.* ad" dig.out.ns3.test$n >/dev/null || ret=1
 # Sanity check: the authoritative server should have been queried.
-nextpart ns2/named.run | grep "query 'foo.initially-unavailable/A/IN'" >/dev/null || ret=1
+nextpart ns2/named.run | grep "query 'foo.initially-unavailable/NS/IN'" >/dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

@@ -25,8 +25,6 @@ options {
 	recursion yes;
 	notify yes;
 	dnssec-validation no;
-
-	tcp-initial-timeout 150; # 15 seconds
 };

 zone "." {
@@ -20,6 +20,7 @@
 #include <isc/base64.h>
 #include <isc/commandline.h>
 #include <isc/hash.h>
+#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/loop.h>
 #include <isc/managers.h>
@@ -33,6 +34,7 @@

 #include <dns/dispatch.h>
 #include <dns/fixedname.h>
+#include <dns/lib.h>
 #include <dns/message.h>
 #include <dns/name.h>
 #include <dns/rdataset.h>
@@ -139,7 +141,7 @@ sendquery(void) {
 	isc_buffer_init(&buf, host, strlen(host));
 	isc_buffer_add(&buf, strlen(host));
 	result = dns_name_fromtext(dns_fixedname_name(&queryname), &buf,
-				   dns_rootname, 0, NULL);
+				   dns_rootname, 0);
 	CHECK("dns_name_fromtext", result);

 	dns_message_create(mctx, NULL, NULL, DNS_MESSAGE_INTENTRENDER,
@@ -0,0 +1,17 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@		30	SOA	ns2.good. hostmaster.arpa. 2018050100 1 1 1 1
+@		30	NS	ns2.good.
+
+8.2.6.0		60	NS	ns3.good.
+
+1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.f.4.0 1 PTR nee.com.
@@ -1,456 +1,111 @@
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# SPDX-License-Identifier: MPL-2.0
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0.  If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
+"""
+Copyright (C) Internet Systems Consortium, Inc. ("ISC")

-from __future__ import print_function
-import os
-import sys
-import signal
-import socket
-import select
-from datetime import datetime, timedelta
-import time
-import functools
+SPDX-License-Identifier: MPL-2.0

-import dns, dns.message, dns.query, dns.flags
-from dns.rdatatype import *
-from dns.rdataclass import *
-from dns.rcode import *
-from dns.name import *
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+"""
+
+from typing import AsyncGenerator
+
+import dns.message
+import dns.name
+import dns.rcode
+import dns.rdataclass
+import dns.rdatatype
+
+from isctest.asyncserver import (
+    AsyncDnsServer,
+    DnsResponseSend,
+    DomainHandler,
+    QueryContext,
+    ResponseAction,
+)
+
+from qmin_ans import (
+    DelayedResponseHandler,
+    EntRcodeChanger,
+    QueryLogHandler,
+    log_query,
+)


-# Log query to file
-def logquery(type, qname):
-    with open("qlog", "a") as f:
-        f.write("%s %s\n", type, qname)
+class QueryLogger(QueryLogHandler):
+    domains = ["1.0.0.2.ip6.arpa.", "fwd.", "good."]


-def endswith(domain, labels):
-    return domain.endswith("." + labels) or domain == labels
+class BadHandler(EntRcodeChanger):
+    domains = ["bad."]
+    rcode = dns.rcode.NXDOMAIN


-############################################################################
-# Respond to a DNS query.
-# For good. it serves:
-# ns2.good. IN A 10.53.0.2
-# zoop.boing.good. NS ns3.good.
-# ns3.good. IN A 10.53.0.3
-# too.many.labels.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z.good. A 192.0.2.2
-# it responds properly (with NODATA empty response) to non-empty terminals
-#
-# For slow. it works the same as for good., but each response is delayed by 400 milliseconds
-#
-# For bad. it works the same as for good., but returns NXDOMAIN to non-empty terminals
-#
-# For ugly. it works the same as for good., but returns garbage to non-empty terminals
-#
-# For 1.0.0.2.ip6.arpa it serves
-# 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.f.4.0.1.0.0.2.ip6.arpa. IN PTR nee.com.
-# 8.2.6.0.1.0.0.2.ip6.arpa IN NS ns3.good
-# 1.0.0.2.ip6.arpa. IN NS ns2.good
-# ip6.arpa. IN NS ns2.good
-#
-# For stale. it serves:
-# a.b. NS ns.a.b.stale.
-# ns.a.b.stale. IN A 10.53.0.3
-# b. NS ns.b.stale.
-# ns.b.stale. IN A 10.53.0.4
-############################################################################
-def create_response(msg):
-    m = dns.message.from_wire(msg)
-    qname = m.question[0].name.to_text()
-    lqname = qname.lower()
-    labels = lqname.split(".")
-
-    # get qtype
-    rrtype = m.question[0].rdtype
-    typename = dns.rdatatype.to_text(rrtype)
-    if typename == "A" or typename == "AAAA":
-        typename = "ADDR"
-    bad = False
-    ugly = False
-    slow = False
-
-    # log this query
-    with open("query.log", "a") as f:
-        f.write("%s %s\n" % (typename, lqname))
-        print("%s %s" % (typename, lqname), end=" ")
-
-    r = dns.message.make_response(m)
-    r.set_rcode(NOERROR)
-
-    if endswith(lqname, "1.0.0.2.ip6.arpa."):
-        # Direct query - give direct answer
-        if endswith(lqname, "8.2.6.0.1.0.0.2.ip6.arpa."):
-            # Delegate to ns3
-            r.authority.append(
-                dns.rrset.from_text(
-                    "8.2.6.0.1.0.0.2.ip6.arpa.", 60, IN, NS, "ns3.good."
-                )
-            )
-            r.additional.append(
-                dns.rrset.from_text("ns3.good.", 60, IN, A, "10.53.0.3")
-            )
-        elif (
-            lqname
-            == "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.f.4.0.1.0.0.2.ip6.arpa."
-            and rrtype == PTR
-        ):
-            # Direct query - give direct answer
-            r.answer.append(
-                dns.rrset.from_text(
-                    "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.f.4.0.1.0.0.2.ip6.arpa.",
-                    1,
-                    IN,
-                    PTR,
-                    "nee.com.",
-                )
-            )
-            r.flags |= dns.flags.AA
-        elif lqname == "1.0.0.2.ip6.arpa." and rrtype == NS:
-            # NS query at the apex
-            r.answer.append(
-                dns.rrset.from_text("1.0.0.2.ip6.arpa.", 30, IN, NS, "ns2.good.")
-            )
-            r.flags |= dns.flags.AA
-        elif endswith(
-            "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.f.4.0.1.0.0.2.ip6.arpa.",
-            lqname,
-        ):
-            # NODATA answer
-            r.authority.append(
-                dns.rrset.from_text(
-                    "1.0.0.2.ip6.arpa.",
-                    30,
-                    IN,
-                    SOA,
-                    "ns2.good. hostmaster.arpa. 2018050100 1 1 1 1",
-                )
-            )
-        else:
-            # NXDOMAIN
-            r.authority.append(
-                dns.rrset.from_text(
-                    "1.0.0.2.ip6.arpa.",
-                    30,
-                    IN,
-                    SOA,
-                    "ns2.good. hostmaster.arpa. 2018050100 1 1 1 1",
-                )
-            )
-            r.set_rcode(NXDOMAIN)
-        return r
-    elif endswith(lqname, "ip6.arpa."):
-        if lqname == "ip6.arpa." and rrtype == NS:
-            # NS query at the apex
-            r.answer.append(dns.rrset.from_text("ip6.arpa.", 30, IN, NS, "ns2.good."))
-            r.flags |= dns.flags.AA
-        elif endswith("1.0.0.2.ip6.arpa.", lqname):
-            # NODATA answer
-            r.authority.append(
-                dns.rrset.from_text(
-                    "ip6.arpa.",
-                    30,
-                    IN,
-                    SOA,
-                    "ns2.good. hostmaster.arpa. 2018050100 1 1 1 1",
-                )
-            )
-        else:
-            # NXDOMAIN
-            r.authority.append(
-                dns.rrset.from_text(
-                    "ip6.arpa.",
-                    30,
-                    IN,
-                    SOA,
-                    "ns2.good. hostmaster.arpa. 2018050100 1 1 1 1",
-                )
-            )
-            r.set_rcode(NXDOMAIN)
-        return r
-    elif endswith(lqname, "stale."):
-        if endswith(lqname, "a.b.stale."):
-            # Delegate to ns.a.b.stale.
-            r.authority.append(
-                dns.rrset.from_text("a.b.stale.", 2, IN, NS, "ns.a.b.stale.")
-            )
-            r.additional.append(
-                dns.rrset.from_text("ns.a.b.stale.", 2, IN, A, "10.53.0.3")
-            )
-        elif endswith(lqname, "b.stale."):
-            # Delegate to ns.b.stale.
-            r.authority.append(
-                dns.rrset.from_text("b.stale.", 2, IN, NS, "ns.b.stale.")
-            )
-            r.additional.append(
-                dns.rrset.from_text("ns.b.stale.", 2, IN, A, "10.53.0.4")
-            )
-        elif lqname == "stale." and rrtype == NS:
-            # NS query at the apex.
-            r.answer.append(dns.rrset.from_text("stale.", 2, IN, NS, "ns2.stale."))
-            r.flags |= dns.flags.AA
-        elif lqname == "stale." and rrtype == SOA:
-            # SOA query at the apex.
-            r.answer.append(
-                dns.rrset.from_text(
-                    "stale.", 2, IN, SOA, "ns2.stale. hostmaster.stale. 1 2 3 4 5"
-                )
-            )
-            r.flags |= dns.flags.AA
-        elif lqname == "stale.":
-            # NODATA answer
-            r.authority.append(
-                dns.rrset.from_text(
-                    "stale.", 2, IN, SOA, "ns2.stale. hostmaster.arpa. 1 2 3 4 5"
-                )
-            )
-            r.flags |= dns.flags.AA
-        elif lqname == "ns2.stale.":
-            if rrtype == A:
-                r.additional.append(
-                    dns.rrset.from_text("ns.b.stale.", 2, IN, A, "10.53.0.2")
-                )
-            else:
-                r.authority.append(
-                    dns.rrset.from_text(
-                        "stale.", 2, IN, SOA, "ns2.stale. hostmaster.arpa. 1 2 3 4 5"
-                    )
-                )
-            r.flags |= dns.flags.AA
-        else:
-            # NXDOMAIN
-            r.authority.append(
-                dns.rrset.from_text(
-                    "stale.", 2, IN, SOA, "ns2.stale. hostmaster.arpa. 1 2 3 4 5"
-                )
-            )
-            r.set_rcode(NXDOMAIN)
-        return r
-    elif endswith(lqname, "bad."):
-        bad = True
-        suffix = "bad."
-        lqname = lqname[:-4]
-    elif endswith(lqname, "ugly."):
-        ugly = True
-        suffix = "ugly."
-        lqname = lqname[:-5]
-    elif endswith(lqname, "good."):
-        suffix = "good."
-        lqname = lqname[:-5]
-    elif endswith(lqname, "slow."):
-        slow = True
-        suffix = "slow."
-        lqname = lqname[:-5]
-    elif endswith(lqname, "fwd."):
-        suffix = "fwd."
-        lqname = lqname[:-4]
-    else:
-        r.set_rcode(REFUSED)
-        return r
-
-    # Good/bad/ugly differs only in how we treat non-empty terminals
-    if endswith(lqname, "zoop.boing."):
-        r.authority.append(
-            dns.rrset.from_text("zoop.boing." + suffix, 1, IN, NS, "ns3." + suffix)
-        )
-    elif (
-        lqname == "many.labels.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z."
-        and rrtype == A
-    ):
-        r.answer.append(dns.rrset.from_text(lqname + suffix, 1, IN, A, "192.0.2.2"))
-        r.flags |= dns.flags.AA
-    elif lqname == "" and rrtype == NS:
-        r.answer.append(dns.rrset.from_text(suffix, 30, IN, NS, "ns2." + suffix))
-        r.flags |= dns.flags.AA
-    elif lqname == "ns2.":
-        r.flags |= dns.flags.AA
-        if rrtype == A:
-            r.answer.append(
-                dns.rrset.from_text("ns2." + suffix, 30, IN, A, "10.53.0.2")
-            )
-        elif rrtype == AAAA:
-            r.answer.append(
-                dns.rrset.from_text(
-                    "ns2." + suffix, 30, IN, AAAA, "fd92:7065:b8e:ffff::2"
-                )
-            )
-        else:
-            r.authority.append(
-                dns.rrset.from_text(
-                    suffix,
-                    30,
-                    IN,
-                    SOA,
-                    "ns2." + suffix + " hostmaster.arpa. 2018050100 1 1 1 1",
-                )
-            )
-    elif lqname == "ns3.":
-        r.flags |= dns.flags.AA
-        if rrtype == A:
-            r.answer.append(
-                dns.rrset.from_text("ns3." + suffix, 30, IN, A, "10.53.0.3")
-            )
-        elif lqname == "ns3." and rrtype == AAAA:
-            r.answer.append(
-                dns.rrset.from_text(
-                    "ns3." + suffix, 30, IN, AAAA, "fd92:7065:b8e:ffff::3"
-                )
-            )
-        else:
-            r.authority.append(
-                dns.rrset.from_text(
-                    suffix,
-                    30,
-                    IN,
-                    SOA,
-                    "ns2." + suffix + " hostmaster.arpa. 2018050100 1 1 1 1",
-                )
-            )
-    elif lqname == "ns4.":
-        r.flags |= dns.flags.AA
-        if rrtype == A:
-            r.answer.append(
-                dns.rrset.from_text("ns4." + suffix, 30, IN, A, "10.53.0.4")
-            )
-        elif rrtype == AAAA:
-            r.answer.append(
-                dns.rrset.from_text(
-                    "ns4." + suffix, 30, IN, AAAA, "fd92:7065:b8e:ffff::4"
-                )
-            )
-        else:
-            r.authority.append(
-                dns.rrset.from_text(
-                    suffix,
-                    30,
-                    IN,
-                    SOA,
-                    "ns2." + suffix + " hostmaster.arpa. 2018050100 1 1 1 1",
-                )
-            )
-    elif lqname == "a.bit.longer.ns.name." and rrtype == A:
-        r.answer.append(
-            dns.rrset.from_text("a.bit.longer.ns.name." + suffix, 1, IN, A, "10.53.0.4")
-        )
-        r.flags |= dns.flags.AA
-    elif lqname == "a.bit.longer.ns.name." and rrtype == AAAA:
-        r.answer.append(
-            dns.rrset.from_text(
-                "a.bit.longer.ns.name." + suffix, 1, IN, AAAA, "fd92:7065:b8e:ffff::4"
-            )
-        )
-        r.flags |= dns.flags.AA
-    else:
-        r.authority.append(
-            dns.rrset.from_text(
-                suffix,
-                1,
-                IN,
-                SOA,
-                "ns2." + suffix + " hostmaster.arpa. 2018050100 1 1 1 1",
-            )
-        )
-        if bad or not (
-            endswith("icky.icky.icky.ptang.zoop.boing.", lqname)
-            or endswith(
-                "many.labels.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z.",
-                lqname,
-            )
-            or endswith("a.bit.longer.ns.name.", lqname)
-        ):
-            r.set_rcode(NXDOMAIN)
-        if ugly:
-            r.set_rcode(FORMERR)
-    if slow:
-        time.sleep(0.2)
-    return r
+class UglyHandler(EntRcodeChanger):
+    domains = ["ugly."]
+    rcode = dns.rcode.FORMERR


-def sigterm(signum, frame):
-    print("Shutting down now...")
-    os.remove("ans.pid")
-    running = False
-    sys.exit(0)
+class SlowHandler(DelayedResponseHandler):
+    domains = ["slow."]
+    delay = 0.2


-############################################################################
-# Main
-#
-# Set up responder and control channel, open the pid file, and start
-# the main loop, listening for queries on the query channel or commands
-# on the control channel and acting on them.
-############################################################################
-ip4 = "10.53.0.2"
-ip6 = "fd92:7065:b8e:ffff::2"
+def send_delegation(
+    qctx: QueryContext, zone_cut: dns.name.Name, target_addr: str
+) -> ResponseAction:
+    """
+    Delegate `zone_cut` to a single in-bailiwick name server, `ns.<zone_cut>`,
+    with a single IPv4 glue record (provided in `target_addr`) included in the
+    ADDITIONAL section.
+    """
+    ns_name = "ns." + zone_cut.to_text()
+    ns_rrset = dns.rrset.from_text(
+        zone_cut, 2, dns.rdataclass.IN, dns.rdatatype.NS, ns_name
+    )
+    a_rrset = dns.rrset.from_text(
+        ns_name, 2, dns.rdataclass.IN, dns.rdatatype.A, target_addr
+    )

-try:
-    port = int(os.environ["PORT"])
-except:
-    port = 5300
+    response = dns.message.make_response(qctx.query)
+    response.set_rcode(dns.rcode.NOERROR)
+    response.authority.append(ns_rrset)
+    response.additional.append(a_rrset)

-query4_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
-query4_socket.bind((ip4, port))
+    return DnsResponseSend(response, authoritative=False)

-havev6 = True
-try:
-    query6_socket = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)
-    try:
-        query6_socket.bind((ip6, port))
-    except:
-        query6_socket.close()
-        havev6 = False
-except:
-    havev6 = False

-signal.signal(signal.SIGTERM, sigterm)
+class StaleHandler(DomainHandler):
+    """
+    `a.b.stale` is a subdomain of `b.stale` and these two subdomains need to be
+    delegated to different name servers.  Therefore, their delegations cannot
+    be placed in the zone file because the zone cut at `b.stale` would occlude
+    the one at `a.b.stale`.  Generate these delegations dynamically depending
+    on the QNAME.
+    """

-f = open("ans.pid", "w")
-pid = os.getpid()
-print(pid, file=f)
-f.close()
+    domains = ["stale."]

-running = True
+    async def get_responses(
+        self, qctx: QueryContext
+    ) -> AsyncGenerator[ResponseAction, None]:
+        log_query(qctx)
+        a_b_stale = dns.name.from_text("a.b.stale.")
+        b_stale = dns.name.from_text("b.stale.")
+        if qctx.qname.is_subdomain(a_b_stale):
+            yield send_delegation(qctx, a_b_stale, "10.53.0.3")
+        elif qctx.qname.is_subdomain(b_stale):
+            yield send_delegation(qctx, b_stale, "10.53.0.4")

-print("Listening on %s port %d" % (ip4, port))
-if havev6:
-    print("Listening on %s port %d" % (ip6, port))
-print("Ctrl-c to quit")

-if havev6:
-    input = [query4_socket, query6_socket]
-else:
-    input = [query4_socket]
-
-while running:
-    try:
-        inputready, outputready, exceptready = select.select(input, [], [])
-    except select.error as e:
-        break
-    except socket.error as e:
-        break
-    except KeyboardInterrupt:
-        break
-
-    for s in inputready:
-        if s == query4_socket or s == query6_socket:
-            print(
-                "Query received on %s" % (ip4 if s == query4_socket else ip6), end=" "
-            )
-            # Handle incoming queries
-            msg = s.recvfrom(65535)
-            rsp = create_response(msg[0])
-            if rsp:
-                print(dns.rcode.to_text(rsp.rcode()))
-                s.sendto(rsp.to_wire(), msg[1])
-            else:
-                print("NO RESPONSE")
-    if not running:
-        break
+if __name__ == "__main__":
+    server = AsyncDnsServer()
+    server.install_response_handler(QueryLogger())
+    server.install_response_handler(BadHandler())
+    server.install_response_handler(UglyHandler())
+    server.install_response_handler(SlowHandler())
+    server.install_response_handler(StaleHandler())
+    server.run()
@@ -0,0 +1 @@
+good.db
@@ -0,0 +1 @@
+good.db
@@ -0,0 +1,26 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@			1	SOA	ns2 hostmaster.arpa. 2018050100 1 1 1 1
+
+@			30	NS	ns2
+ns2			30	A	10.53.0.2
+			30	AAAA	fd92:7065:b8e:ffff::2
+
+zoop.boing		30	NS	ns3
+ns3			30	A	10.53.0.3
+			30	AAAA	fd92:7065:b8e:ffff::3
+
+ns4			30	A	10.53.0.4
+			30	AAAA	fd92:7065:b8e:ffff::4
+
+a.bit.longer.ns.name	1	A	10.53.0.4
+			1	AAAA	fd92:7065:b8e:ffff::4
@@ -0,0 +1 @@
+good.db
@@ -0,0 +1,15 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@	2	SOA	ns2 hostmaster.stale. 1 2 3 4 5
+@	2	NS	ns2
+ns2	2	A	10.53.0.2
+	2	AAAA	fd92:7065:b8e:ffff::2
@@ -0,0 +1 @@
+good.db
@@ -0,0 +1,15 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@		30	SOA	ns3.good. hostmaster.arpa. 2018050100 1 1 1 1
+@		30	NS	ns3.good.
+
+1.1.1.1		60	NS	ns4.good.
@@ -0,0 +1,15 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@	1	SOA	ns hostmaster.a.b.stale. 1 2 3 4 5
+@	1	NS	ns
+@	1	TXT	"peekaboo"
+ns	1	A	10.53.0.3
@@ -1,285 +1,46 @@
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# SPDX-License-Identifier: MPL-2.0
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0.  If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
+"""
+Copyright (C) Internet Systems Consortium, Inc. ("ISC")

-from __future__ import print_function
-import os
-import sys
-import signal
-import socket
-import select
-from datetime import datetime, timedelta
-import time
-import functools
+SPDX-License-Identifier: MPL-2.0

-import dns, dns.message, dns.query, dns.flags
-from dns.rdatatype import *
-from dns.rdataclass import *
-from dns.rcode import *
-from dns.name import *
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+"""
+
+import dns.rcode
+
+from isctest.asyncserver import AsyncDnsServer
+
+from qmin_ans import DelayedResponseHandler, EntRcodeChanger, QueryLogHandler


-# Log query to file
-def logquery(type, qname):
-    with open("qlog", "a") as f:
-        f.write("%s %s\n", type, qname)
+class QueryLogger(QueryLogHandler):
+    domains = ["8.2.6.0.1.0.0.2.ip6.arpa.", "a.b.stale.", "zoop.boing.good."]


-def endswith(domain, labels):
-    return domain.endswith("." + labels) or domain == labels
+class ZoopBoingBadHandler(EntRcodeChanger):
+    domains = ["zoop.boing.bad."]
+    rcode = dns.rcode.NXDOMAIN


-############################################################################
-# Respond to a DNS query.
-# For good. it serves:
-# zoop.boing.good. NS ns3.good.
-# icky.ptang.zoop.boing.good. NS a.bit.longer.ns.name.good.
-# it responds properly (with NODATA empty response) to non-empty terminals
-#
-# For slow. it works the same as for good., but each response is delayed by 400 milliseconds
-#
-# For bad. it works the same as for good., but returns NXDOMAIN to non-empty terminals
-#
-# For ugly. it works the same as for good., but returns garbage to non-empty terminals
-#
-# For stale. it serves:
-# a.b.stale. IN TXT peekaboo (resolver did not do qname minimization)
-############################################################################
-def create_response(msg):
-    m = dns.message.from_wire(msg)
-    qname = m.question[0].name.to_text()
-    lqname = qname.lower()
-    labels = lqname.split(".")
-    suffix = ""
-
-    # get qtype
-    rrtype = m.question[0].rdtype
-    typename = dns.rdatatype.to_text(rrtype)
-    if typename == "A" or typename == "AAAA":
-        typename = "ADDR"
-    bad = False
-    ugly = False
-    slow = False
-
-    # log this query
-    with open("query.log", "a") as f:
-        f.write("%s %s\n" % (typename, lqname))
-        print("%s %s" % (typename, lqname), end=" ")
-
-    r = dns.message.make_response(m)
-    r.set_rcode(NOERROR)
-
-    ip6req = False
-
-    if endswith(lqname, "bad."):
-        bad = True
-        suffix = "bad."
-        lqname = lqname[:-4]
-    elif endswith(lqname, "ugly."):
-        ugly = True
-        suffix = "ugly."
-        lqname = lqname[:-5]
-    elif endswith(lqname, "good."):
-        suffix = "good."
-        lqname = lqname[:-5]
-    elif endswith(lqname, "slow."):
-        slow = True
-        suffix = "slow."
-        lqname = lqname[:-5]
-    elif endswith(lqname, "8.2.6.0.1.0.0.2.ip6.arpa."):
-        ip6req = True
-    elif endswith(lqname, "a.b.stale."):
-        if lqname == "a.b.stale.":
-            r.flags |= dns.flags.AA
-            if rrtype == TXT:
-                # Direct query.
-                r.answer.append(dns.rrset.from_text(lqname, 1, IN, TXT, "peekaboo"))
-            elif rrtype == NS:
-                # NS a.b.
-                r.answer.append(dns.rrset.from_text(lqname, 1, IN, NS, "ns.a.b.stale."))
-                r.additional.append(
-                    dns.rrset.from_text("ns.a.b.stale.", 1, IN, A, "10.53.0.3")
-                )
-            elif rrtype == SOA:
-                # SOA a.b.
-                r.answer.append(
-                    dns.rrset.from_text(
-                        lqname, 1, IN, SOA, "a.b.stale. hostmaster.a.b.stale. 1 2 3 4 5"
-                    )
-                )
-            else:
-                # NODATA.
-                r.authority.append(
-                    dns.rrset.from_text(
-                        lqname, 1, IN, SOA, "a.b.stale. hostmaster.a.b.stale. 1 2 3 4 5"
-                    )
-                )
-        elif lqname == "ns.a.b.stale.":
-            r.flags |= dns.flags.AA
-            if rrtype == A:
-                r.answer.append(
-                    dns.rrset.from_text("ns.a.b.stale.", 1, IN, A, "10.53.0.3")
-                )
-            else:
-                r.authority.append(
-                    dns.rrset.from_text(
-                        lqname, 1, IN, SOA, "a.b.stale. hostmaster.a.b.stale. 1 2 3 4 5"
-                    )
-                )
-        else:
-            r.flags |= dns.flags.AA
-            r.authority.append(
-                dns.rrset.from_text(
-                    lqname, 1, IN, SOA, "a.b.stale. hostmaster.a.b.stale. 1 2 3 4 5"
-                )
-            )
-            r.set_rcode(NXDOMAIN)
-            # NXDOMAIN.
-        return r
-    else:
-        r.set_rcode(REFUSED)
-        return r
-
-    # Good/bad differs only in how we treat non-empty terminals
-    if lqname == "zoop.boing." and rrtype == NS:
-        r.answer.append(
-            dns.rrset.from_text(lqname + suffix, 1, IN, NS, "ns3." + suffix)
-        )
-        r.flags |= dns.flags.AA
-    elif endswith(lqname, "icky.ptang.zoop.boing."):
-        r.authority.append(
-            dns.rrset.from_text(
-                "icky.ptang.zoop.boing." + suffix,
-                1,
-                IN,
-                NS,
-                "a.bit.longer.ns.name." + suffix,
-            )
-        )
-    elif endswith("icky.ptang.zoop.boing.", lqname):
-        r.authority.append(
-            dns.rrset.from_text(
-                "zoop.boing." + suffix,
-                1,
-                IN,
-                SOA,
-                "ns3." + suffix + " hostmaster.arpa. 2018050100 1 1 1 1",
-            )
-        )
-        if bad:
-            r.set_rcode(NXDOMAIN)
-        if ugly:
-            r.set_rcode(FORMERR)
-    elif endswith(lqname, "zoop.boing."):
-        r.authority.append(
-            dns.rrset.from_text(
-                "zoop.boing." + suffix,
-                1,
-                IN,
-                SOA,
-                "ns3." + suffix + " hostmaster.arpa. 2018050100 1 1 1 1",
-            )
-        )
-        r.set_rcode(NXDOMAIN)
-    elif ip6req:
-        r.authority.append(
-            dns.rrset.from_text(
-                "1.1.1.1.8.2.6.0.1.0.0.2.ip6.arpa.", 60, IN, NS, "ns4.good."
-            )
-        )
-        r.additional.append(dns.rrset.from_text("ns4.good.", 60, IN, A, "10.53.0.4"))
-    else:
-        r.set_rcode(REFUSED)
-
-    if slow:
-        time.sleep(0.4)
-    return r
+class ZoopBoingUglyHandler(EntRcodeChanger):
+    domains = ["zoop.boing.ugly."]
+    rcode = dns.rcode.FORMERR


-def sigterm(signum, frame):
-    print("Shutting down now...")
-    os.remove("ans.pid")
-    running = False
-    sys.exit(0)
+class ZoopBoingSlowHandler(DelayedResponseHandler):
+    domains = ["zoop.boing.slow."]
+    delay = 0.4


-############################################################################
-# Main
-#
-# Set up responder and control channel, open the pid file, and start
-# the main loop, listening for queries on the query channel or commands
-# on the control channel and acting on them.
-############################################################################
-ip4 = "10.53.0.3"
-ip6 = "fd92:7065:b8e:ffff::3"
-
-try:
-    port = int(os.environ["PORT"])
-except:
-    port = 5300
-
-query4_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
-query4_socket.bind((ip4, port))
-
-havev6 = True
-try:
-    query6_socket = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)
-    try:
-        query6_socket.bind((ip6, port))
-    except:
-        query6_socket.close()
-        havev6 = False
-except:
-    havev6 = False
-
-signal.signal(signal.SIGTERM, sigterm)
-
-f = open("ans.pid", "w")
-pid = os.getpid()
-print(pid, file=f)
-f.close()
-
-running = True
-
-print("Listening on %s port %d" % (ip4, port))
-if havev6:
-    print("Listening on %s port %d" % (ip6, port))
-print("Ctrl-c to quit")
-
-if havev6:
-    input = [query4_socket, query6_socket]
-else:
-    input = [query4_socket]
-
-while running:
-    try:
-        inputready, outputready, exceptready = select.select(input, [], [])
-    except select.error as e:
-        break
-    except socket.error as e:
-        break
-    except KeyboardInterrupt:
-        break
-
-    for s in inputready:
-        if s == query4_socket or s == query6_socket:
-            print(
-                "Query received on %s" % (ip4 if s == query4_socket else ip6), end=" "
-            )
-            # Handle incoming queries
-            msg = s.recvfrom(65535)
-            rsp = create_response(msg[0])
-            if rsp:
-                print(dns.rcode.to_text(rsp.rcode()))
-                s.sendto(rsp.to_wire(), msg[1])
-            else:
-                print("NO RESPONSE")
-    if not running:
-        break
+if __name__ == "__main__":
+    server = AsyncDnsServer()
+    server.install_response_handler(QueryLogger())
+    server.install_response_handler(ZoopBoingBadHandler())
+    server.install_response_handler(ZoopBoingUglyHandler())
+    server.install_response_handler(ZoopBoingSlowHandler())
+    server.run()
@@ -0,0 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@			1	SOA	ns3.bad. hostmaster.arpa. 2018050100 1 1 1 1
+@			1	NS	ns3.bad.
+icky.ptang		1	NS	a.bit.longer.ns.name.bad.
@@ -0,0 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@			1	SOA	ns3.good. hostmaster.arpa. 2018050100 1 1 1 1
+@			1	NS	ns3.good.
+icky.ptang		1	NS	a.bit.longer.ns.name.good.
@@ -0,0 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@			1	SOA	ns3.slow. hostmaster.arpa. 2018050100 1 1 1 1
+@			1	NS	ns3.slow.
+icky.ptang		1	NS	a.bit.longer.ns.name.slow.
@@ -0,0 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@			1	SOA	ns3.ugly. hostmaster.arpa. 2018050100 1 1 1 1
+@			1	NS	ns3.ugly.
+icky.ptang		1	NS	a.bit.longer.ns.name.ugly.
@@ -0,0 +1,15 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@		30	SOA	ns4.good. hostmaster.arpa. 2018050100 1 1 1 1
+@		30	NS	ns4.good.
+
+test1.test2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.9.0.9.4 1 TXT "long_ip6_name"
@@ -0,0 +1,15 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@	1	SOA	ns hostmaster.a.b.stale. 1 2 3 4 5
+@	1	NS	ns
+ns	1	A	10.53.0.4
+@	1	TXT	"hooray"
@@ -1,344 +1,93 @@
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# SPDX-License-Identifier: MPL-2.0
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0.  If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
+"""
+Copyright (C) Internet Systems Consortium, Inc. ("ISC")

-from __future__ import print_function
-import os
-import sys
-import signal
-import socket
-import select
-from datetime import datetime, timedelta
-import time
-import functools
+SPDX-License-Identifier: MPL-2.0

-import dns, dns.message, dns.query, dns.flags
-from dns.rdatatype import *
-from dns.rdataclass import *
-from dns.rcode import *
-from dns.name import *
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+"""
+
+from typing import AsyncGenerator
+
+import dns.rcode
+
+from isctest.asyncserver import (
+    AsyncDnsServer,
+    DnsResponseSend,
+    DomainHandler,
+    QueryContext,
+    ResponseAction,
+)
+
+from qmin_ans import DelayedResponseHandler, EntRcodeChanger, QueryLogHandler, log_query


-# Log query to file
-def logquery(type, qname):
-    with open("qlog", "a") as f:
-        f.write("%s %s\n", type, qname)
+class QueryLogger(QueryLogHandler):
+    domains = [
+        "1.1.1.1.8.2.6.0.1.0.0.2.ip6.arpa.",
+        "icky.ptang.zoop.boing.good.",
+    ]


-def endswith(domain, labels):
-    return domain.endswith("." + labels) or domain == labels
+class StaleHandler(DomainHandler):
+    """
+    The test code relies on this server returning non-minimal (i.e. including
+    address records in the ADDITIONAL section) responses to NS queries for
+    `b.stale` and `a.b.stale`.  While this logic (returning non-minimal
+    responses to NS queries) could be implemented in AsyncDnsServer itself,
+    doing so breaks a lot of other checks in this system test.  Therefore, only
+    these two zones behave in this particular way, thanks to a custom response
+    handler implemented below.
+    """
+
+    domains = ["b.stale", "a.b.stale"]
+
+    async def get_responses(
+        self, qctx: QueryContext
+    ) -> AsyncGenerator[ResponseAction, None]:
+        log_query(qctx)
+
+        if qctx.qtype == dns.rdatatype.NS:
+            assert qctx.zone
+            assert qctx.response.answer[0]
+
+            for nameserver in qctx.response.answer[0]:
+                if not nameserver.target.is_subdomain(qctx.response.answer[0].name):
+                    continue
+                glue_a = qctx.zone.get_rrset(nameserver.target, dns.rdatatype.A)
+                if glue_a:
+                    qctx.response.additional.append(glue_a)
+                glue_aaaa = qctx.zone.get_rrset(nameserver.target, dns.rdatatype.AAAA)
+                if glue_aaaa:
+                    qctx.response.additional.append(glue_aaaa)
+
+        yield DnsResponseSend(qctx.response)


-############################################################################
-# Respond to a DNS query.
-# For good. it serves:
-# icky.ptang.zoop.boing.good. NS a.bit.longer.ns.name.
-# icky.icky.icky.ptang.zoop.boing.good. A 192.0.2.1
-# more.icky.icky.icky.ptang.zoop.boing.good. A 192.0.2.2
-# it responds properly (with NODATA empty response) to non-empty terminals
-#
-# For slow. it works the same as for good., but each response is delayed by 400 milliseconds
-#
-# For bad. it works the same as for good., but returns NXDOMAIN to non-empty terminals
-#
-# For ugly. it works the same as for good., but returns garbage to non-empty terminals
-#
-# For stale. it serves:
-# a.b.stale. IN TXT hooray (resolver did do qname minimization)
-############################################################################
-def create_response(msg):
-    m = dns.message.from_wire(msg)
-    qname = m.question[0].name.to_text()
-    lqname = qname.lower()
-    labels = lqname.split(".")
-    suffix = ""
-
-    # get qtype
-    rrtype = m.question[0].rdtype
-    typename = dns.rdatatype.to_text(rrtype)
-    if typename == "A" or typename == "AAAA":
-        typename = "ADDR"
-    bad = False
-    slow = False
-    ugly = False
-
-    # log this query
-    with open("query.log", "a") as f:
-        f.write("%s %s\n" % (typename, lqname))
-        print("%s %s" % (typename, lqname), end=" ")
-
-    r = dns.message.make_response(m)
-    r.set_rcode(NOERROR)
-
-    ip6req = False
-
-    if endswith(lqname, "bad."):
-        bad = True
-        suffix = "bad."
-        lqname = lqname[:-4]
-    elif endswith(lqname, "ugly."):
-        ugly = True
-        suffix = "ugly."
-        lqname = lqname[:-5]
-    elif endswith(lqname, "good."):
-        suffix = "good."
-        lqname = lqname[:-5]
-    elif endswith(lqname, "slow."):
-        slow = True
-        suffix = "slow."
-        lqname = lqname[:-5]
-    elif endswith(lqname, "1.1.1.1.8.2.6.0.1.0.0.2.ip6.arpa."):
-        ip6req = True
-    elif endswith(lqname, "b.stale."):
-        if lqname == "a.b.stale.":
-            r.flags |= dns.flags.AA
-            if rrtype == TXT:
-                # Direct query.
-                r.answer.append(dns.rrset.from_text(lqname, 1, IN, TXT, "hooray"))
-            elif rrtype == NS:
-                # NS a.b.
-                r.answer.append(dns.rrset.from_text(lqname, 1, IN, NS, "ns.a.b.stale."))
-                r.additional.append(
-                    dns.rrset.from_text("ns.a.b.stale.", 1, IN, A, "10.53.0.3")
-                )
-            elif rrtype == SOA:
-                # SOA a.b.
-                r.answer.append(
-                    dns.rrset.from_text(
-                        lqname, 1, IN, SOA, "a.b.stale. hostmaster.a.b.stale. 1 2 3 4 5"
-                    )
-                )
-            else:
-                # NODATA.
-                r.authority.append(
-                    dns.rrset.from_text(
-                        lqname, 1, IN, SOA, "a.b.stale. hostmaster.a.b.stale. 1 2 3 4 5"
-                    )
-                )
-        elif lqname == "ns.a.b.stale.":
-            r.flags |= dns.flags.AA
-            if rrtype == A:
-                r.answer.append(
-                    dns.rrset.from_text("ns.a.b.stale.", 1, IN, A, "10.53.0.3")
-                )
-            else:
-                # NODATA.
-                r.authority.append(
-                    dns.rrset.from_text(
-                        lqname, 1, IN, SOA, "a.b.stale. hostmaster.a.b.stale. 1 2 3 4 5"
-                    )
-                )
-        elif lqname == "b.stale.":
-            r.flags |= dns.flags.AA
-            if rrtype == NS:
-                # NS b.
-                r.answer.append(dns.rrset.from_text(lqname, 1, IN, NS, "ns.b.stale."))
-                r.additional.append(
-                    dns.rrset.from_text("ns.b.stale.", 1, IN, A, "10.53.0.4")
-                )
-            elif rrtype == SOA:
-                # SOA b.
-                r.answer.append(
-                    dns.rrset.from_text(
-                        lqname, 1, IN, SOA, "b.stale. hostmaster.b.stale. 1 2 3 4 5"
-                    )
-                )
-            else:
-                # NODATA.
-                r.authority.append(
-                    dns.rrset.from_text(
-                        lqname, 1, IN, SOA, "b.stale. hostmaster.b.stale. 1 2 3 4 5"
-                    )
-                )
-        elif lqname == "ns.b.stale.":
-            r.flags |= dns.flags.AA
-            if rrtype == A:
-                # SOA a.b.
-                r.answer.append(
-                    dns.rrset.from_text("ns.a.b.stale.", 1, IN, A, "10.53.0.4")
-                )
-            else:
-                # NODATA.
-                r.authority.append(
-                    dns.rrset.from_text(
-                        lqname, 1, IN, SOA, "b.stale. hostmaster.b.stale. 1 2 3 4 5"
-                    )
-                )
-        else:
-            r.authority.append(
-                dns.rrset.from_text(
-                    lqname, 1, IN, SOA, "b.stale. hostmaster.b.stale. 1 2 3 4 5"
-                )
-            )
-            r.set_rcode(NXDOMAIN)
-            # NXDOMAIN.
-        return r
-    else:
-        r.set_rcode(REFUSED)
-        return r
-
-    # Good/bad differs only in how we treat non-empty terminals
-    if lqname == "icky.icky.icky.ptang.zoop.boing." and rrtype == A:
-        r.answer.append(dns.rrset.from_text(lqname + suffix, 1, IN, A, "192.0.2.1"))
-        r.flags |= dns.flags.AA
-    elif lqname == "more.icky.icky.icky.ptang.zoop.boing." and rrtype == A:
-        r.answer.append(dns.rrset.from_text(lqname + suffix, 1, IN, A, "192.0.2.2"))
-        r.flags |= dns.flags.AA
-    elif lqname == "icky.ptang.zoop.boing." and rrtype == NS:
-        r.answer.append(
-            dns.rrset.from_text(
-                lqname + suffix, 1, IN, NS, "a.bit.longer.ns.name." + suffix
-            )
-        )
-        r.flags |= dns.flags.AA
-    elif endswith(lqname, "icky.ptang.zoop.boing."):
-        r.authority.append(
-            dns.rrset.from_text(
-                "icky.ptang.zoop.boing." + suffix,
-                1,
-                IN,
-                SOA,
-                "ns2." + suffix + " hostmaster.arpa. 2018050100 1 1 1 1",
-            )
-        )
-        if bad or not endswith("more.icky.icky.icky.ptang.zoop.boing.", lqname):
-            r.set_rcode(NXDOMAIN)
-        if ugly:
-            r.set_rcode(FORMERR)
-    elif ip6req:
-        r.flags |= dns.flags.AA
-        if (
-            lqname
-            == "test1.test2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.9.0.9.4.1.1.1.1.8.2.6.0.1.0.0.2.ip6.arpa."
-            and rrtype == TXT
-        ):
-            r.answer.append(
-                dns.rrset.from_text(
-                    "test1.test2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.9.0.9.4.1.1.1.1.8.2.6.0.1.0.0.2.ip6.arpa.",
-                    1,
-                    IN,
-                    TXT,
-                    "long_ip6_name",
-                )
-            )
-        elif endswith(
-            "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.9.0.9.4.1.1.1.1.8.2.6.0.1.0.0.2.ip6.arpa.",
-            lqname,
-        ):
-            # NODATA answer
-            r.authority.append(
-                dns.rrset.from_text(
-                    "1.1.1.1.8.2.6.0.1.0.0.2.ip6.arpa.",
-                    60,
-                    IN,
-                    SOA,
-                    "ns4.good. hostmaster.arpa. 2018050100 120 30 320 16",
-                )
-            )
-        else:
-            # NXDOMAIN
-            r.authority.append(
-                dns.rrset.from_text(
-                    "1.1.1.1.8.2.6.0.1.0.0.2.ip6.arpa.",
-                    60,
-                    IN,
-                    SOA,
-                    "ns4.good. hostmaster.arpa. 2018050100 120 30 320 16",
-                )
-            )
-            r.set_rcode(NXDOMAIN)
-    else:
-        r.set_rcode(REFUSED)
-
-    if slow:
-        time.sleep(0.4)
-    return r
+class IckyPtangZoopBoingBadHandler(EntRcodeChanger):
+    domains = ["icky.ptang.zoop.boing.bad."]
+    rcode = dns.rcode.NXDOMAIN


-def sigterm(signum, frame):
-    print("Shutting down now...")
-    os.remove("ans.pid")
-    running = False
-    sys.exit(0)
+class IckyPtangZoopBoingUglyHandler(EntRcodeChanger):
+    domains = ["icky.ptang.zoop.boing.ugly."]
+    rcode = dns.rcode.FORMERR


-############################################################################
-# Main
-#
-# Set up responder and control channel, open the pid file, and start
-# the main loop, listening for queries on the query channel or commands
-# on the control channel and acting on them.
-############################################################################
-ip4 = "10.53.0.4"
-ip6 = "fd92:7065:b8e:ffff::4"
+class IckyPtangZoopBoingSlowHandler(DelayedResponseHandler):
+    domains = ["icky.ptang.zoop.boing.slow."]
+    delay = 0.4

-try:
-    port = int(os.environ["PORT"])
-except:
-    port = 5300

-query4_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
-query4_socket.bind((ip4, port))
-
-havev6 = True
-try:
-    query6_socket = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)
-    try:
-        query6_socket.bind((ip6, port))
-    except:
-        query6_socket.close()
-        havev6 = False
-except:
-    havev6 = False
-
-signal.signal(signal.SIGTERM, sigterm)
-
-f = open("ans.pid", "w")
-pid = os.getpid()
-print(pid, file=f)
-f.close()
-
-running = True
-
-print("Listening on %s port %d" % (ip4, port))
-if havev6:
-    print("Listening on %s port %d" % (ip6, port))
-print("Ctrl-c to quit")
-
-if havev6:
-    input = [query4_socket, query6_socket]
-else:
-    input = [query4_socket]
-
-while running:
-    try:
-        inputready, outputready, exceptready = select.select(input, [], [])
-    except select.error as e:
-        break
-    except socket.error as e:
-        break
-    except KeyboardInterrupt:
-        break
-
-    for s in inputready:
-        if s == query4_socket or s == query6_socket:
-            print(
-                "Query received on %s" % (ip4 if s == query4_socket else ip6), end=" "
-            )
-            # Handle incoming queries
-            msg = s.recvfrom(65535)
-            rsp = create_response(msg[0])
-            if rsp:
-                print(dns.rcode.to_text(rsp.rcode()))
-                s.sendto(rsp.to_wire(), msg[1])
-            else:
-                print("NO RESPONSE")
-    if not running:
-        break
+if __name__ == "__main__":
+    server = AsyncDnsServer()
+    server.install_response_handler(QueryLogger())
+    server.install_response_handler(StaleHandler())
+    server.install_response_handler(IckyPtangZoopBoingBadHandler())
+    server.install_response_handler(IckyPtangZoopBoingUglyHandler())
+    server.install_response_handler(IckyPtangZoopBoingSlowHandler())
+    server.run()
@@ -0,0 +1,16 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@	1	SOA	ns hostmaster.b.stale. 1 2 3 4 5
+@	1	NS	ns
+ns	1	A	10.53.0.4
+a	1	NS	ns.a
+ns.a	1	A	10.53.0.4
--- a/Show More
+++ b/Show More