Fix issues/races in RPZ code when shutting down.

Lock maint_lock on rpzs when detaching from an rpz, to make sure nobody changes anything. We set 'updaterunning' only after the first event was fired. We could have a race when we: 1. send the event to updater task, updatepending=true, updaterunning=false 2. shutdown, since updaterunning == false we don't purge events from task and free task structure that's enqueued 3. task processed the, now freed, event, crash Fixed it by purging the event if it's linked. We detached updater task before all the events have been processed, now detach it only after all rpzs have been detached.
Merge branch 'ckb-statistics-test-nit' into 'master'
2019-03-07 18:43:58 -08:00 · 2019-03-07 20:32:49 -05:00 · 2019-03-07 20:15:14 -05:00 · 2019-03-07 20:11:53 -05:00 · 2019-03-07 16:45:04 +11:00 · 2019-03-07 00:16:42 -05:00
1296 changed files with 35136 additions and 156266 deletions
@@ -0,0 +1,64 @@
+;;; Directory Local Variables
+;;; For more information see (info "(emacs) Directory Variables")
+
+((c-mode .
+  ((eval .
+	 (set (make-local-variable 'directory-of-current-dir-locals-file)
+	      (file-name-directory (locate-dominating-file default-directory ".dir-locals.el"))
+	      )
+	 )
+   (eval .
+	 (set (make-local-variable 'include-directories)
+	      (list
+
+	       ;; top directory
+	       (expand-file-name
+		(concat directory-of-current-dir-locals-file "./"))
+
+	       ;; current directory
+	       (expand-file-name (concat default-directory "./"))
+
+	       ;; libisc
+	       (expand-file-name
+		(concat directory-of-current-dir-locals-file "lib/isc/unix/include"))
+	       (expand-file-name
+		(concat directory-of-current-dir-locals-file "lib/isc/pthreads/include"))
+	       (expand-file-name
+		(concat directory-of-current-dir-locals-file "lib/isc/include"))
+
+	       ;; libdns
+
+	       (expand-file-name
+		(concat directory-of-current-dir-locals-file "lib/dns/include"))
+
+	       ;; libisccc
+	       (expand-file-name
+		(concat directory-of-current-dir-locals-file "lib/isccc/include"))
+
+	       ;; libisccfg
+	       (expand-file-name
+		(concat directory-of-current-dir-locals-file "lib/isccfg/include"))
+
+	       ;; libns
+	       (expand-file-name
+		(concat directory-of-current-dir-locals-file "lib/ns/include"))
+
+	       ;; libirs
+	       (expand-file-name
+		(concat directory-of-current-dir-locals-file "lib/irs/include"))
+
+	       ;; libbind9
+	       (expand-file-name
+		(concat directory-of-current-dir-locals-file "lib/bind9/include"))
+
+	       (expand-file-name "/usr/local/opt/openssl@1.1/include")
+	       (expand-file-name "/usr/local/opt/libxml2/include/libxml2")
+	       (expand-file-name "/usr/local/include")
+	       )
+	      )
+	 )
+
+   (eval setq flycheck-clang-include-path include-directories)
+   (eval setq flycheck-cppcheck-include-path include-directories)
+   )
+  ))
@@ -27,35 +27,6 @@ gen.dSYM/
 .deps/
 .dirstamp
 .libs/
-unit/atf-src/atf-c++/atf-c++.pc
-unit/atf-src/atf-c/atf-c.pc
-unit/atf-src/atf-c/defs.h
-unit/atf-src/atf-c/detail/process_helpers
-unit/atf-src/atf-config/atf-config
-unit/atf-src/atf-report/atf-report
-unit/atf-src/atf-report/fail_helper
-unit/atf-src/atf-report/misc_helpers
-unit/atf-src/atf-report/pass_helper
-unit/atf-src/atf-run/atf-run
-unit/atf-src/atf-run/bad_metadata_helper
-unit/atf-src/atf-run/expect_helpers
-unit/atf-src/atf-run/misc_helpers
-unit/atf-src/atf-run/pass_helper
-unit/atf-src/atf-run/several_tcs_helper
-unit/atf-src/atf-run/zero_tcs_helper
-unit/atf-src/atf-sh/atf-check
-unit/atf-src/atf-sh/atf-sh
-unit/atf-src/atf-sh/misc_helpers
-unit/atf-src/atf-version/atf-version
-unit/atf-src/atf-version/revision.h
-unit/atf-src/atf-version/revision.h.stamp
-unit/atf-src/bconfig.h
-unit/atf-src/bootstrap/atconfig
-unit/atf-src/doc/atf.7
-unit/atf-src/stamp-h1
-unit/atf-src/test-programs/c_helpers
-unit/atf-src/test-programs/cpp_helpers
-unit/atf-src/test-programs/sh_helpers
 # ccc-analyzer store its results in .plist directories
 *.plist/
 *~
@@ -1,7 +1,9 @@
 variables:
+  # Not normally needed, but may be if some script uses `apt-get install`.
  DEBIAN_FRONTEND: noninteractive
+  # Locale settings do not affect the build, but might affect tests.
  LC_ALL: C
-  DOCKER_DRIVER: overlay2
+
  CI_REGISTRY_IMAGE: registry.gitlab.isc.org/isc-projects/images/bind9
  CCACHE_DIR: "/ccache"
  SOFTHSM2_CONF: "/var/tmp/softhsm2/softhsm2.conf"
@@ -12,129 +14,111 @@ stages:
  - test
  - push

-.centos-centos6-amd64: &centos_centos6_amd64_image
-  image: "$CI_REGISTRY_IMAGE:centos-centos6-amd64"
+### Runner Tag Templates
+
+.linux-amd64: &linux_amd64
  tags:
    - linux
-    - docker
    - amd64

+.linux-i386: &linux_i386
+  tags:
+    - linux
+    - i386
+
+### Docker Image Templates
+
+# CentOS
+
+.centos-centos6-amd64: &centos_centos6_amd64_image
+  image: "$CI_REGISTRY_IMAGE:centos-centos6-amd64"
+  <<: *linux_amd64
+
 .centos-centos7-amd64: &centos_centos7_amd64_image
  image: "$CI_REGISTRY_IMAGE:centos-centos7-amd64"
-  tags:
-    - linux
-    - docker
-    - amd64
+  <<: *linux_amd64
+
+# Debian

 .debian-jessie-amd64: &debian_jessie_amd64_image
  image: "$CI_REGISTRY_IMAGE:debian-jessie-amd64"
-  tags:
-    - linux
-    - docker
-    - amd64
+  <<: *linux_amd64

 .debian-jessie-i386: &debian_jessie_i386_image
  image: "$CI_REGISTRY_IMAGE:debian-jessie-i386"
-  tags:
-    - linux
-    - docker
-    - i386
+  <<: *linux_i386

 .debian-stretch-amd64: &debian_stretch_amd64_image
  image: "$CI_REGISTRY_IMAGE:debian-stretch-amd64"
-  tags:
-    - linux
-    - docker
-    - amd64
+  <<: *linux_amd64

-.debian-stretch-i386:: &debian_stretch_i386_image
+.debian-stretch-i386: &debian_stretch_i386_image
  image: "$CI_REGISTRY_IMAGE:debian-stretch-i386"
-  tags:
-    - linux
-    - docker
-    - i386
-
-.debian-buster-amd64: &debian_buster_amd64_image
-  image: "$CI_REGISTRY_IMAGE:debian-buster-amd64"
-  tags:
-    - linux
-    - docker
-    - amd64
-
-.debian-buster-i386:: &debian_buster_i386_image
-  image: "$CI_REGISTRY_IMAGE:debian-buster-i386"
-  tags:
-    - linux
-    - docker
-    - i386
+  <<: *linux_i386

 .debian-sid-amd64: &debian_sid_amd64_image
  image: "$CI_REGISTRY_IMAGE:debian-sid-amd64"
-  tags:
-    - linux
-    - docker
-    - amd64
+  <<: *linux_amd64

 .debian-sid-i386: &debian_sid_i386_image
  image: "$CI_REGISTRY_IMAGE:debian-sid-i386"
-  tags:
-    - linux
-    - docker
-    - i386
+  <<: *linux_i386

-.ubuntu-trusty-amd64: &ubuntu_trusty_amd64_image
-  image: "$CI_REGISTRY_IMAGE:ubuntu-trusty-amd64"
-  tags:
-    - linux
-    - docker
-    - amd64
+# Fedora

-.ubuntu-trusty-i386: &ubuntu_trusty_i386_image
-  image: "$CI_REGISTRY_IMAGE:ubuntu-trusty-i386"
-  tags:
-    - linux
-    - docker
-    - i386
+.fedora-29-amd64: &fedora_29_amd64_image
+  image: "$CI_REGISTRY_IMAGE:fedora-29-amd64"
+  <<: *linux_amd64
+
+# Ubuntu

 .ubuntu-xenial-amd64: &ubuntu_xenial_amd64_image
  image: "$CI_REGISTRY_IMAGE:ubuntu-xenial-amd64"
-  tags:
-    - linux
-    - docker
-    - amd64
+  <<: *linux_amd64

 .ubuntu-xenial-i386: &ubuntu_xenial_i386_image
  image: "$CI_REGISTRY_IMAGE:ubuntu-xenial-i386"
-  tags:
-    - linux
-    - docker
-    - i386
+  <<: *linux_i386
+
+.ubuntu-bionic-amd64: &ubuntu_bionic_amd64_image
+  image: "$CI_REGISTRY_IMAGE:ubuntu-bionic-amd64"
+  <<: *linux_amd64
+
+.ubuntu-bionic-i386: &ubuntu_bionic_i386_image
+  image: "$CI_REGISTRY_IMAGE:ubuntu-bionic-i386"
+  <<: *linux_i386
+
+### Job Templates
+
+.default-triggering-rules: &default_triggering_rules
+  only:
+    - merge_requests
+    - tags
+    - web
+
+.precheck: &precheck_job
+  <<: *default_triggering_rules
+  <<: *debian_sid_amd64_image
+  stage: precheck

 .build: &build_job
+  <<: *default_triggering_rules
  stage: build
  before_script:
    - test -w "${CCACHE_DIR}" && export PATH="/usr/lib/ccache:${PATH}"
-#    - ./autogen.sh
  script:
-    - ./configure --enable-developer --with-libtool --disable-static --with-atf=/usr --prefix=$HOME/.local --without-make-clean $EXTRA_CONFIGURE || cat config.log
-    - make -j${PARALLEL_JOBS_BUILD:-1} -k all V=1
+    - ./configure --enable-developer --with-libtool --disable-static --with-cmocka --prefix=$HOME/.local --without-make-clean $EXTRA_CONFIGURE || cat config.log
+    - make -j${BUILD_PARALLEL_JOBS:-1} -k all V=1
+    - test -z "${RUN_MAKE_INSTALL}" || make install
  artifacts:
-    paths:
-    - doc/
-    expire_in: '1 hour'
    untracked: true
-
-.install_test: &install_test_job
-  stage: test
-  before_script:
-    - mkdir $HOME/.local
-  script:
-    - make install
+    expire_in: "1 hour"

 .system_test: &system_test_job
+  <<: *default_triggering_rules
  stage: test
+  retry: 2
  before_script:
-    - rm -rf .ccache
    - bash -x bin/tests/system/ifconfig.sh up
    - bash -x util/prepare-softhsm2.sh
  script:
@@ -142,10 +126,11 @@ stages:
    - test -s bin/tests/system/systests.output
  artifacts:
    untracked: true
-    expire_in: '1 week'
+    expire_in: "1 week"
    when: on_failure

 .unit_test: &unit_test_job
+  <<: *default_triggering_rules
  stage: test
  before_script:
    - export KYUA_RESULT="$CI_PROJECT_DIR/kyua.results"
@@ -156,18 +141,24 @@ stages:
    - kyua report-html --force --results-file kyua.results --results-filter "" --output kyua_html
  artifacts:
    paths:
-    - atf.out
-    - kyua.log
-    - kyua.results
-    - kyua_html/
-    expire_in: '1 week'
+      - kyua.log
+      - kyua.results
+      - kyua_html/
+    expire_in: "1 week"
    when: on_failure

-precheck:debian:sid:amd64:
-  <<: *debian_sid_amd64_image
-  stage: precheck
+### Job Definitions
+
+# Jobs in the precheck stage
+
+misc:sid:amd64:
+  <<: *precheck_job
  script:
+    - sh util/check-ans-prereq.sh
    - sh util/checklibs.sh > checklibs.out
+    - sh util/tabify-changes < CHANGES > CHANGES.tmp
+    - diff -urNap CHANGES CHANGES.tmp
+    - rm CHANGES.tmp
    - perl util/check-changes CHANGES
    - perl -w util/merge_copyrights
    - diff -urNap util/copyrights util/newcopyrights
@@ -176,27 +167,39 @@ precheck:debian:sid:amd64:
    - if test "$(git status --porcelain | grep -Ev '\?\?' | wc -l)" -gt "0"; then git status --short; exit 1; fi
    - xmllint --noout --nonet `git ls-files '*.xml' '*.docbook'`
    - xmllint --noout --nonet --html `git ls-files '*.html'`
+    - sh util/check-win32util-configure
  artifacts:
    paths:
-    - util/newcopyrights
-    - checklibs.out
-    expire_in: '1 week'
+      - util/newcopyrights
+      - checklibs.out
+    expire_in: "1 week"
    when: on_failure

-docs:debian:sid:amd64:
+🐞:sid:amd64:
+  <<: *precheck_job
+  script: util/check-cocci
+
+# Jobs for doc builds on Debian Sid (amd64)
+
+docs:sid:amd64:
  <<: *debian_sid_amd64_image
-  stage: test
-  dependencies:
-    - build:debian:sid:amd64
+  stage: build
  script:
+    - ./configure || cat config.log
    - make -C doc/misc docbook
    - make -C doc/arm Bv9ARM.html
  artifacts:
    paths:
-    - doc/arm/
-    expire_in: '1 month'
+      - doc/arm/
+    expire_in: "1 month"
+  only:
+    - merge_requests
+    - tags
+    - web
+    - master@isc-projects/bind9
+    - /^v9_[1-9][0-9]$/@isc-projects/bind9

-push:docs:
+push:docs:sid:amd64:
  <<: *debian_sid_amd64_image
  stage: push
  dependencies: []
@@ -204,33 +207,11 @@ push:docs:
    - curl -X POST -F token=$GITLAB_PAGES_DOCS_TRIGGER_TOKEN -F ref=master $GITLAB_PAGES_DOCS_TRIGGER_URL
  only:
    - master@isc-projects/bind9
-    - /^v9_.*$/@isc-projects/bind9
+    - /^v9_[1-9][0-9]$/@isc-projects/bind9

-#build:debian:jessie:amd64:
-#  <<: *debian_jessie_amd64_image
-#  <<: *build_job
-#
-#build:debian:jessie:i386:
-#  <<: *debian_jessie_i386_image
-#  <<: *build_job
-#
-#build:debian:stretch:amd64:
-#  <<: *debian_stretch_amd64_image
-#  <<: *build_job
-#
-#build:debian:buster:i386:
-#  <<: *debian_buster_i386_image
-#  <<: *build_job
-#
-#build:ubuntu:trusty:amd64:
-#  <<: *ubuntu_trusty_amd64_image
-#  <<: *build_job
-#
-#build:ubuntu:xenial:i386:
-#  <<: *ubuntu_xenial_i386_image
-#  <<: *build_job
+# Jobs for regular GCC builds on CentOS 6 (amd64)

-build:centos:centos6:amd64:
+gcc:centos6:amd64:
  variables:
    CC: gcc
    CFLAGS: "-Wall -Wextra -O2 -g"
@@ -238,7 +219,21 @@ build:centos:centos6:amd64:
  <<: *centos_centos6_amd64_image
  <<: *build_job

-build:centos:centos7:amd64:
+system:gcc:centos6:amd64:
+  <<: *centos_centos6_amd64_image
+  <<: *system_test_job
+  dependencies:
+    - gcc:centos6:amd64
+
+unit:gcc:centos6:amd64:
+  <<: *centos_centos6_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - gcc:centos6:amd64
+
+# Jobs for regular GCC builds on CentOS 7 (amd64)
+
+gcc:centos7:amd64:
  variables:
    CC: gcc
    CFLAGS: "-Wall -Wextra -O2 -g"
@@ -246,136 +241,223 @@ build:centos:centos7:amd64:
  <<: *centos_centos7_amd64_image
  <<: *build_job

-build:clang:debian:stretch:amd64:
-  variables:
-    CC: clang
-    CFLAGS: "-Wall -Wextra -Wenum-conversion -O2 -g"
-  <<: *debian_stretch_amd64_image
-  <<: *build_job
+system:gcc:centos7:amd64:
+  <<: *centos_centos7_amd64_image
+  <<: *system_test_job
+  dependencies:
+    - gcc:centos7:amd64

-build:debian:jessie:amd64:
+unit:gcc:centos7:amd64:
+  <<: *centos_centos7_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - gcc:centos7:amd64
+
+# Jobs for regular GCC builds on Debian 8 Jessie (amd64)
+
+gcc:jessie:amd64:
  variables:
    CC: gcc
    CFLAGS: "-Wall -Wextra -O2 -g"
-    EXTRA_CONFIGURE: --without-cmocka
+    EXTRA_CONFIGURE: "--without-cmocka --with-python"
  <<: *debian_jessie_amd64_image
  <<: *build_job

-build:debian:stretch:amd64:
+system:gcc:jessie:amd64:
+  <<: *debian_jessie_amd64_image
+  <<: *system_test_job
+  dependencies:
+    - gcc:jessie:amd64
+
+unit:gcc:jessie:amd64:
+  <<: *debian_jessie_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - gcc:jessie:amd64
+
+# Jobs for regular GCC builds on Debian 9 Stretch (amd64)
+
+gcc:stretch:amd64:
  variables:
    CC: gcc
    CFLAGS: "-Wall -Wextra -O2 -g"
  <<: *debian_stretch_amd64_image
  <<: *build_job

-build:debian:sid:amd64:
+system:gcc:stretch:amd64:
+  <<: *debian_stretch_amd64_image
+  <<: *system_test_job
+  dependencies:
+    - gcc:stretch:amd64
+
+unit:gcc:stretch:amd64:
+  <<: *debian_stretch_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - gcc:stretch:amd64
+
+# Jobs for regular GCC builds on Debian Sid (amd64)
+
+gcc:sid:amd64:
  variables:
    CC: gcc
    CFLAGS: "-Wall -Wextra -O2 -g"
    EXTRA_CONFIGURE: "--with-libidn2"
+    RUN_MAKE_INSTALL: 1
  <<: *debian_sid_amd64_image
  <<: *build_job

-build:clang:debian:stretch:i386:
+system:gcc:sid:amd64:
+  <<: *debian_sid_amd64_image
+  <<: *system_test_job
+  dependencies:
+    - gcc:sid:amd64
+
+unit:gcc:sid:amd64:
+  <<: *debian_sid_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - gcc:sid:amd64
+
+# Jobs for regular GCC builds on Debian Sid (i386)
+
+gcc:sid:i386:
+  variables:
+    CC: gcc
+    CFLAGS: "-Wall -Wextra -O2 -g"
+    EXTRA_CONFIGURE: "--with-libidn2 --without-python"
+  <<: *debian_sid_i386_image
+  <<: *build_job
+
+system:gcc:sid:i386:
+  <<: *debian_sid_i386_image
+  <<: *system_test_job
+  dependencies:
+    - gcc:sid:i386
+
+unit:gcc:sid:i386:
+  <<: *debian_sid_i386_image
+  <<: *unit_test_job
+  dependencies:
+    - gcc:sid:i386
+
+# Jobs for regular GCC builds on Fedora 29 (amd64)
+
+gcc:fedora29:amd64:
+  variables:
+    CC: gcc
+    CFLAGS: "-Wall -Wextra -O2 -g"
+    EXTRA_CONFIGURE: "--with-libidn2"
+  <<: *fedora_29_amd64_image
+  <<: *build_job
+
+system:gcc:fedora29:amd64:
+  <<: *fedora_29_amd64_image
+  <<: *system_test_job
+  dependencies:
+    - gcc:fedora29:amd64
+
+unit:gcc:fedora29:amd64:
+  <<: *fedora_29_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - gcc:fedora29:amd64
+
+# Jobs for regular GCC builds on Ubuntu 16.04 Xenial Xerus (amd64)
+
+gcc:xenial:amd64:
+  variables:
+    CC: gcc
+    CFLAGS: "-Wall -Wextra -O2 -g"
+  <<: *ubuntu_xenial_amd64_image
+  <<: *build_job
+
+system:gcc:xenial:amd64:
+  <<: *ubuntu_xenial_amd64_image
+  <<: *system_test_job
+  dependencies:
+    - gcc:xenial:amd64
+
+unit:gcc:xenial:amd64:
+  <<: *ubuntu_xenial_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - gcc:xenial:amd64
+
+# Jobs for regular GCC builds on Ubuntu 18.04 Bionic Beaver (amd64)
+
+gcc:bionic:amd64:
+  variables:
+    CC: gcc
+    CFLAGS: "-Wall -Wextra -O2 -g"
+    EXTRA_CONFIGURE: "--with-libidn2"
+  <<: *ubuntu_bionic_amd64_image
+  <<: *build_job
+
+system:gcc:bionic:amd64:
+  <<: *ubuntu_bionic_amd64_image
+  <<: *system_test_job
+  dependencies:
+    - gcc:bionic:amd64
+
+unit:gcc:bionic:amd64:
+  <<: *ubuntu_bionic_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - gcc:bionic:amd64
+
+# Jobs for GCC builds with ASAN enabled on Debian Sid (amd64)
+
+asan:sid:amd64:
+  variables:
+    CC: gcc
+    CFLAGS: "-Wall -Wextra -O2 -g -fsanitize=address,undefined -DISC_MEM_USE_INTERNAL_MALLOC=0"
+    LDFLAGS: "-fsanitize=address,undefined"
+    EXTRA_CONFIGURE: "--with-libidn2"
+  <<: *debian_sid_amd64_image
+  <<: *build_job
+
+system:asan:sid:amd64:
+  <<: *debian_sid_amd64_image
+  <<: *system_test_job
+  dependencies:
+    - asan:sid:amd64
+
+unit:asan:sid:amd64:
+  <<: *debian_sid_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - asan:sid:amd64
+
+# Jobs for Clang builds on Debian Stretch (amd64)
+
+clang:stretch:amd64:
  variables:
    CC: clang
    CFLAGS: "-Wall -Wextra -Wenum-conversion -O2 -g"
+    EXTRA_CONFIGURE: "--with-python=python3"
+  <<: *debian_stretch_amd64_image
+  <<: *build_job
+
+unit:clang:stretch:amd64:
+  <<: *debian_stretch_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - clang:stretch:amd64
+
+# Jobs for Clang builds on Debian Stretch (i386)
+
+clang:stretch:i386:
+  variables:
+    CC: clang
+    CFLAGS: "-Wall -Wextra -Wenum-conversion -O2 -g"
+    EXTRA_CONFIGURE: "--with-python=python2"
  <<: *debian_stretch_i386_image
  <<: *build_job

-build:debian:sid:i386:
-  variables:
-    CC: gcc
-    CFLAGS: "-Wall -Wextra -O2 -g"
-    EXTRA_CONFIGURE: "--with-libidn2"
-  <<: *debian_sid_i386_image
-  <<: *build_job
+# Jobs for PKCS#11-enabled GCC builds on Debian Sid (amd64)

-unittest:centos:centos6:amd64:
-  <<: *centos_centos6_amd64_image
-  <<: *unit_test_job
-  dependencies:
-    - build:centos:centos6:amd64
-
-unittest:centos:centos7:amd64:
-  <<: *centos_centos7_amd64_image
-  <<: *unit_test_job
-  dependencies:
-    - build:centos:centos7:amd64
-
-unittest:debian:jessie:amd64:
-  <<: *debian_jessie_amd64_image
-  <<: *unit_test_job
-  dependencies:
-    - build:debian:jessie:amd64
-
-unittest:debian:stretch:amd64:
-  <<: *debian_stretch_amd64_image
-  <<: *unit_test_job
-  dependencies:
-    - build:debian:stretch:amd64
-
-unittest:debian:sid:amd64:
-  <<: *debian_sid_amd64_image
-  <<: *unit_test_job
-  dependencies:
-    - build:debian:sid:amd64
-
-unittest:clang:debian:stretch:amd64:
-  <<: *debian_stretch_amd64_image
-  <<: *unit_test_job
-  dependencies:
-    - build:clang:debian:stretch:amd64
-
-unittest:debian:sid:i386:
-  <<: *debian_sid_i386_image
-  <<: *unit_test_job
-  dependencies:
-    - build:debian:sid:i386
-
-systemtest:centos:centos6:amd64:
-  <<: *centos_centos6_amd64_image
-  <<: *system_test_job
-  dependencies:
-    - build:centos:centos6:amd64
-
-systemtest:centos:centos7:amd64:
-  <<: *centos_centos7_amd64_image
-  <<: *system_test_job
-  dependencies:
-    - build:centos:centos7:amd64
-
-systemtest:debian:jessie:amd64:
-  <<: *debian_jessie_amd64_image
-  <<: *system_test_job
-  dependencies:
-    - build:debian:jessie:amd64
-
-systemtest:debian:stretch:amd64:
-  <<: *debian_stretch_amd64_image
-  <<: *system_test_job
-  dependencies:
-    - build:debian:stretch:amd64
-
-systemtest:debian:sid:amd64:
-  <<: *debian_sid_amd64_image
-  <<: *system_test_job
-  dependencies:
-    - build:debian:sid:amd64
-
-systemtest:debian:sid:i386:
-  <<: *debian_sid_i386_image
-  <<: *system_test_job
-  dependencies:
-    - build:debian:sid:i386
-
-install:debian:sid:amd64:
-  <<: *debian_sid_amd64_image
-  <<: *install_test_job
-  dependencies:
-    - build:debian:sid:amd64
-
-pkcs11:build:debian:sid:amd64:
+pkcs11:sid:amd64:
  variables:
    CC: gcc
    CFLAGS: "-Wall -Wextra -O2 -g"
@@ -383,14 +465,14 @@ pkcs11:build:debian:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *build_job

-pkcs11:unittest:debian:sid:amd64:
-  <<: *debian_sid_amd64_image
-  <<: *unit_test_job
-  dependencies:
-    - pkcs11:build:debian:sid:amd64
-
-pkcs11:systemtest:debian:sid:amd64:
+system:pkcs11:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *system_test_job
  dependencies:
-    - pkcs11:build:debian:sid:amd64
+    - pkcs11:sid:amd64
+
+unit:pkcs11:sid:amd64:
+  <<: *debian_sid_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - pkcs11:sid:amd64
@@ -1,19 +1,21 @@
 ## Release Checklist

- - [ ] (Manager) Check for the presence of a milestone for the release.
+ - [ ] (Manager) Check for the presence of a milestone for the release:
    - If there is a milestone, are all the issues for the milestone resolved? (other than this checklist).
 - [ ] (Manager) Inform Support/Marketing of impending release (and give estimated release dates).
- - (SwEng) Prepare the sources for tarball generation.
+ - (SwEng) Prepare the sources for tarball generation:
+   - [ ] Check perflab to ensure there has been no unexplained drop in performance for the version being released.
   - [ ] Ensure that there are no outstanding merge requests in the private repository (subscription version only).
   - [ ] Update API files for libraries with new version information.
   - [ ] Change software version and library versions in configure.in (new major release only).
-   - [ ] Ensure Kyua and ATF files are correct.
   - [ ] Rebuild configure using autoconf on docs.isc.org.
   - [ ] Update CHANGES.
   - [ ] Update CHANGES.SE (subscription branch only).
   - [ ] Update "version".
   - [ ] Update "readme.md".
-   - [ ] Ensure the release notes are correct for this release (content, formatting, etc.).
+   - Check the release notes are correct:
+     - [ ] Compare content with merge requests for the release.
+     - [ ] Check formatting.
   - [ ] Build documentation on docs.isc.org.
   - [ ] Commit changes and make sure the gitlab-ci tests are passing.
   - [ ] Push the changes and tag ("alphatag" is an optional string such as "b1", "rc1" etc.). (```git tag -u <DEVELOPER_KEYID> -a -s -m "BIND 9.X.Y[alphatag]" v9_X_Y[alphatag]```)
@@ -24,9 +26,19 @@
 - [ ] (QA) Request the signature on the tarballs.
 - [ ] (QA) Check signatures on tarballs.
 - [ ] (QA) Tell Support to handle notification of release.
- - [ ] (Support) Make tarballs and signatures available to download.
- - [ ] (Manager) Update [https://wiki.isc.org/bin/view/Main/BindReleaseDates](BIND release dates page) when public announcement has been made.
- - [ ] (Manager) Inform marketing of the release
+ - [ ] (Manager) Inform Marketing of the release
+ - [ ] (Manager) Update the internal [BIND release dates wiki page](https://wiki.isc.org/bin/view/Main/BindReleaseDates) when public announcement has been made.

 - [ ] (SwEng) Update DEB and RPM packages
 - [ ] (SwEng) Merge the automatically prepared `prep 9.X.Y` commit which updates `version` and documentation on the release branch into the relevant maintenance branch (`v9_X`)
+
+## Support
+ - [ ] Make tarballs and signatures available to download.
+ - [ ] Write release email to bind9-announce.
+ - [ ] Write email to bind9-users (if a major release).
+ - [ ] Update tickets in case of waiting support customers.
+
+## Marketing
+ - [ ] Post short note to Twitter.
+ - [ ] Update [Wikipedia entry for BIND](http://en.wikipedia.org/wiki/BIND).
+ - [ ] Write blog article (if a major release).
@@ -1,5 +0,0 @@
-Content-Type: application/X-atf-atffile; version="1"
-
-prop: test-suite = bind9
-
-tp: lib
@@ -1,3 +1,340 @@
+5178.	[bug]		Fix issues in RPZ code during shutdown. [GL !1346]
+
+5177.	[func]		Add the ability to specify in named.conf whether a
+			response-policy zone's SOA record should be added
+			to the additional section (add-soa yes/no). [GL #865]
+
+5176.	[tests]		Remove a dependency on libxml in statschannel system
+			test. [GL #926]
+
+5175.	[bug]		Fixed a problem with file input in dnssec-keymgr,
+			dnssec-coverage and dnssec-checkds when using
+			python3. [GL #882]
+
+5174.	[doc]		Tidy dnssec-keygen manual. [GL !1557]
+
+5173.	[bug]		Fixed a race in socket code that could occur when
+			accept, send, or recv were called from an event
+			loop but the socket had been closed by another
+			thread. [RT #874]
+
+5172.	[bug]		nsupdate now honors the operating system's preferred
+			ephemeral port range. [GL #905]
+
+5171.	[func]		named plugins are now installed into a separate
+			directory.  Supplying a filename (a string without path
+			separators) in a "plugin" configuration stanza now
+			causes named to look for that plugin in that directory.
+			[GL #878]
+
+5170.	[test]		Added --with-dlz-filesystem to feature-test. [GL !1587]
+
+5169.	[bug]		The presence of certain types in an otherwise
+			empty node could cause a crash while processing a
+			type ANY query. [GL #901]
+
+5168.	[bug]		Do not crash on shutdown when RPZ fails to load.  Also,
+			keep previous version of the database if RPZ fails to
+			load. [GL #813]
+
+5167.	[bug]		nxdomain-redirect could sometimes lookup the wrong
+			redirect name. [GL #892]
+
+5166.	[placeholder]
+
+5165.	[contrib]	Removed SDB drivers from contrib; they're obsolete.
+			[GL #428]
+
+5164.	[bug]		Correct errno to result translation in dlz filesystem
+			modules. [GL #884]
+
+5163.	[cleanup]	Out-of-tree builds failed --enable-dnstap. [GL #836]
+
+5162.	[cleanup]	Improve dnssec-keymgr manual. Thanks to Tony Finch.
+			[GL !1518]
+
+5161.	[bug]		Do not require the SEP bit to be set for mirror zone
+			trust anchors. [GL #873]
+
+5160.	[contrib]	Added DNAME support to the DLZ LDAP schema. Also
+			fixed a compilation bug affecting several DLZ
+			modules. [GL #872]
+
+5159.	[bug]		dnssec-coverage was incorrectly ignoring
+			names specified on the command line without
+			trailing dots. [GL !1478]
+
+5158.	[protocol]	Add support for AMTRELAY and ZONEMD. [GL #867]
+
+5157.	[bug]		Nslookup now errors out if there are extra command
+			line arguments. [GL #207]
+
+5156.	[doc]		Extended and refined the section of the ARM describing
+			mirror zones. [GL #774]
+
+5155.	[func]		"named -V" now outputs the default paths to
+			named.conf, rndc.conf, bind.keys, and other
+			files used or created by named and other tools, so
+			that the correct paths to these files can quickly be
+			determined regardless of the configure settings
+			used when BIND was built. [GL #859]
+
+5154.	[bug]		dig: process_opt could be called twice on the same
+			message leading to a assertion failure. [GL #860]
+
+5153.	[func]		Zone transfer statistics (size, number of records, and
+			number of messages) are now logged for outgoing
+			transfers as well as incoming ones. [GL #513]
+
+5152.	[func]		Improved logging of DNSSEC key events:
+			- Zone signing and DNSKEY maintenance events are
+			  now logged to the "dnssec" category
+			- Messages are now logged when DNSSEC keys are
+			  published, activated, inactivated, deleted,
+			  or revoked.
+			[GL #714]
+
+5151.	[func]		Options that have been been marked as obsolete in
+			named.conf for a very long time are now fatal
+			configuration errors. [GL #358]
+
+5150.	[cleanup]	Remove the ability to compile BIND with assertions
+			disabled. [GL #735]
+
+5149.	[func]		"rndc dumpdb" now prints a line above a stale RRset
+			indicating how long the data will be retained in the
+			cache for emergency use. [GL #101]
+
+5148.	[bug]		named did not sign the TKEY response. [GL #821]
+
+5147.	[bug]		dnssec-keymgr: Add a five-minute margin to better
+			handle key events close to 'now'. [GL #848]
+
+5146.	[placeholder]
+
+5145.	[func]		Use atomics instead of locked variables for isc_quota
+			and isc_counter. [GL !1389]
+
+5144.	[bug]		dig now returns a non-zero exit code when a TCP
+			connection is prematurely closed by a peer more than
+			once for the same lookup.  [GL #820]
+
+5143.	[bug]		dnssec-keymgr and dnssec-coverage failed to find
+			key files for zone names ending in ".". [GL #560]
+
+5142.	[cleanup]	Removed "configure --disable-rpz-nsip" and
+			"--disable-rpz-nsdname" options. "nsip-enable"
+			and "nsdname-enable" both now default to yes,
+			regardless of compile-time settings. [GL #824]
+
+5141.	[security]	Zone transfer controls for writable DLZ zones were
+			not effective as the allowzonexfr method was not being
+			called for such zones. (CVE-2019-6465) [GL #790]
+
+5140.	[bug]		Don't immediately mark existing keys as inactive and
+			deleted when running dnssec-keymgr for the first
+			time. [GL #117]
+
+5139.	[bug]		If possible, don't use forwarders when priming.
+			This ensures we can get root server IP addresses
+			from priming query response glue, which may not
+			be present if the forwarding server is returning
+			minimal responses. [GL #752]
+
+5138.	[bug]		Under some circumstances named could hit an assertion
+			failure when doing qname minimization when using
+			forwarders. [GL #797]
+
+5137.	[func]		named now logs messages whenever a mirror zone becomes
+			usable or unusable for resolution purposes. [GL #818]
+
+5136.	[cleanup]	Check in named-checkconf that allow-update and
+			allow-update-forwarding are not set at the
+			view/options level; fix documentation. [GL #512]
+
+5135.	[port]		sparc: Use smt_pause() instead of pause. [GL #816]
+
+5134.	[bug]		win32: WSAStartup was not called before getservbyname
+			was called. [GL #590]
+
+5133.	[bug]		'rndc managed-keys' didn't handle class and view
+			correctly and failed to add new lines between each
+			view. [GL !1327]
+
+5132.	[bug]		Fix race condition in cleanup part of dns_dt_create().
+			[GL !1323]
+
+5131.	[cleanup]	Address Coverity warnings. [GL #801]
+
+5130.	[cleanup]	Remove support for l10n message catalogs. [GL #709]
+
+5129.	[contrib]	sdlz_helper.c:build_querylist was not properly
+			splitting the query string. [GL #798]
+
+5128.	[bug]		Refreshkeytime was not being updated for managed
+			keys zones. [GL #784]
+
+5127.	[bug]		rcode.c:maybe_numeric failed to handle NUL in text
+			regions. [GL #807]
+
+5126.	[bug]		Named incorrectly accepted empty base64 and hex encoded
+			fields when reading master files. [GL #807]
+
+5125.	[bug]		Allow for up to 100 records or 64k of data when caching
+			a negative response. [GL #804]
+
+5124.	[bug]		Named could incorrectly return FORMERR rather than
+			SERVFAIL. [GL #804]
+
+5123.	[bug]		dig could hang indefinitely after encountering an error
+			before creating a TCP socket. [GL #692]
+
+5122.	[bug]		In a "forward first;" configuration, a forwarder
+			timeout did not prevent that forwarder from being
+			queried again after falling back to full recursive
+			resolution. [GL #315]
+
+5121.	[contrib]	dlz_stub_driver.c fails to return ISC_R_NOTFOUND on none
+			matching zone names. [GL !1299]
+
+5120.	[placeholder]
+
+5119.	[placeholder]
+
+5118.	[security]	Named could crash if it is managing a key with
+			`managed-keys` and the authoritative zone is rolling
+			the key to an unsupported algorithm. (CVE-2018-5745)
+			[GL #780]
+
+5117.	[placeholder]
+
+5116.	[bug]		Named/named-checkconf triggered a assertion when
+			a mirror zone's name is bad. [GL #778]
+
+5115.	[bug]		Allow unsupported algorithms in zone when not used for
+			signing with dnssec-signzone. [GL #783]
+
+5114.	[func]		Include a 'reconfig/reload in progress' status line
+			in rndc status, use it in tests.
+
+5113.	[port]		Fixed a Windows build error.
+
+5112.	[bug]		Named/named-checkconf could dump core if there was
+			a missing masters clause and a bad notify clause.
+			[GL #779]
+
+5111.	[bug]		Occluded DNSKEY records could make it into the
+			delegating NSEC/NSEC3 bitmap. [GL #742]
+
+5110.	[security]	Named leaked memory if there were multiple Key Tag
+			EDNS options present. (CVE-2018-5744) [GL #772]
+
+5109.	[cleanup]	Remove support for RSAMD5 algorithm. [GL #628]
+
+	--- 9.13.5 released ---
+
+5108.	[bug]		Named could fail to determine bottom of zone when
+			removing out of date keys leading to invalid NSEC
+			and NSEC3 records being added to the zone. [GL #771]
+
+5107.	[bug]		'host -U' did not work. [GL #769]
+
+5106.	[experimental]	A new "plugin" mechanism has been added to allow
+			extension of query processing functionality through
+			the use of dynamically loadable libraries. A
+			"filter-aaaa.so" plugin has been implemented,
+			replacing the filter-aaaa feature that was formerly
+			implemented as a native part of BIND.
+
+			The "filter-aaaa", "filter-aaaa-on-v4" and
+			"filter-aaaa-on-v6" options can no longer be
+			configured using native named.conf syntax. However,
+			loading the filter-aaaa.so plugin and setting its
+			parameters provides identical functionality.
+
+			Note that the plugin API is a work in progress and
+			is likely to evolve as further plugins are
+			implemented. [GL #15]
+
+5105.	[bug]		Fix a race between process_fd and socketclose in
+			unix socket code. [GL #744]
+
+5104.	[cleanup]	Log clearer informational message when a catz zone
+			is overridden by a zone in named.conf.
+			Thanks to Tony Finch. [GL !1157]
+
+5103.	[bug]		Add missing design by contract tests to dns_catz*.
+			[GL #748]
+
+5102.	[bug]		dnssec-coverage failed to use the default TTL when
+			checking KSK deletion times leading to a exception.
+			[GL #585]
+
+5101.	[bug]		Fix default installation path for Python modules and
+			remove the dnspython dependency accidentally introduced
+			by change 4970. [GL #730]
+
+5100.	[func]		Pin resolver tasks to specific task queues. [GL !1117]
+
+5099.	[func]		Failed mutex and conditional creations are always
+			fatal. [GL #674]
+
+	--- 9.13.4 released ---
+
+5098.	[func]		Failed memory allocations are now fatal. [GL #674]
+
+5097.	[cleanup]	Remove embedded ATF unit testing framework
+			from BIND source distribution.  [GL !875]
+
+5096.	[func]		Use multiple event loops in socket code, and
+			make network threads CPU-affinitive.  This
+			significantly improves performance on large
+			systems. [GL #666]
+
+5095.	[test]		Converted all unit tests from ATF to CMocka;
+			removed the source code for the ATF libraries.
+			Build with "configure --with-cmocka" to enable
+			unit testing. [GL #620]
+
+5094.	[func]		Add 'dig -r' to disable reading of .digrc. [GL !970]
+
+5093.	[bug]		Log lame qname-minimization servers only if they're
+			really lame. [GL #671]
+
+5092.	[bug]		Address memory leak on SIGTERM in nsupdate when using
+			GSS-TSIG. [GL #558]
+
+5091.	[func]		Two new global and per-view options min-cache-ttl
+			and min-ncache-ttl [GL #613]
+
+5090.	[bug]		dig and mdig failed to properly pre-parse dash value
+			pairs when value was a separate argument and started
+			with a dash. [GL #584]
+
+5089.	[bug]		Restore localhost fallback in dig and host which is
+			used when no nameserver addresses present in
+			/etc/resolv.conf are usable due to the requested
+			address family restrictions. [GL #433]
+
+5088.	[bug]		dig/host/nslookup could crash when interrupted close to
+			a query timeout. [GL #599]
+
+5087.	[test]		Check that result tables are complete. [GL #676]
+
+5086.	[func]		Log of RPZ now includes the QTYPE and QCLASS. [GL #623]
+
+5085.	[bug]		win32: Restore looking up nameservers, search list,
+			etc. [GL #186]
+
+5084.	[placeholder]
+
+5083.	[func]		Add autoconf macro AX_POSIX_SHELL, so we
+			can use POSIX-compatible shell features
+			in the scripts.
+
+5082.	[bug]		Fixed a race that could cause a crash in
+			dig/host/nslookup. [GL #650]
+
 5081.	[func]		Use per-worker queues in task manager, make task
 			runners CPU-affine. [GL #659]

@@ -37,7 +374,7 @@
 5072.	[bug]		Add unit tests for isc_buffer_copyregion() and fix its
 			behavior for auto-reallocated buffers. [GL #644]

-5071.	[bug]		Comparision of NXT records was broken. [GL #631]
+5071.	[bug]		Comparison of NXT records was broken. [GL #631]

 5070.	[bug]		Record types which support a empty rdata field were
 			not handling the empty rdata field case. [GL #638]
@@ -56,7 +393,7 @@

 5065.	[bug]		Only set IPV6_USE_MIN_MTU on IPv6. [GL #553]

-5064.	[test]		Initalize TZ environment variable before calling
+5064.	[test]		Initialize TZ environment variable before calling
 			dns_test_begin in dnstap_test. [GL #624]

 5063.	[test]		In statschannel test try a few times before failing
@@ -282,7 +619,7 @@
 5001.	[bug]		Fix refcount errors on error paths. [GL !563]

 5000.	[bug]		named_server_servestale() could leave the server in
-			exclusive mode if an error occured. [GL #441]
+			exclusive mode if an error occurred. [GL #441]

 4999.	[cleanup]	Remove custom printf implementation in lib/isc/print.c.
 			[GL #261]
@@ -1,4 +1,4 @@
-Copyright (C) 1996-2018  Internet Systems Consortium, Inc. ("ISC")
+Copyright (C) 1996-2019  Internet Systems Consortium, Inc. ("ISC")

 This Source Code Form is subject to the terms of the Mozilla Public
 License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,5 +1,79 @@
 Functional enhancements from prior major releases of BIND 9

+BIND 9.14
+
+BIND 9.14 (a stable branch based on the 9.13 development branch) includes
+a number of changes from BIND 9.12 and earlier releases. New features
+include:
+
+  * A new "plugin" mechanism has been added to allow query functionality
+    to be extended using dynamically loadable libraries. The "filter-aaaa"
+    feature has been removed from named and is now implemented as a
+    plugin.
+  * Socket and task code has been refactored to improve performance.
+  * QNAME minimization, as described in RFC 7816, is now supported.
+  * "Root key sentinel" support, enabling validating resolvers to indicate
+    via a special query which trust anchors are configured for the root
+    zone.
+  * Secondary zones can now be configured as "mirror" zones; their
+    contents are transferred in as with traditional slave zones, but are
+    subject to DNSSEC validation and are not treated as authoritative data
+    when answering. This makes it easier to configure a local copy of the
+    root zone as described in RFC 7706.
+  * The "validate-except" option allows configuration of domains below
+    which DNSSEC validation should not be performed.
+  * The default value of "dnssec-validation" is now "auto".
+  * IDNA2008 is now supported when linking with libidn2.
+  * "named -V" now outputs the default paths for files used by named and
+    other tools.
+
+In addition, workarounds that were formerly in place to enable resolution
+of domains whose authoritative servers did not respond to EDNS queries
+have been removed. See https://dnsflagday.net for more details.
+
+Cryptographic support has been modernized. BIND now uses the best
+available pseudo-random number generator for the platform on which it's
+built. Very old versions of OpenSSL are no longer supported. Cryptography
+is now mandatory: building BIND without DNSSEC is no longer supported.
+
+Special code to support certain legacy operating systems has also been
+removed; see the file PLATFORMS.md for details of supported platforms. In
+addition to OpenSSL, BIND now requires support for IPv6, threads, and
+standard atomic operations provided by the C compiler.
+
+BIND 9.12
+
+BIND 9.12 includes a number of changes from BIND 9.11 and earlier
+releases. New features include:
+
+  * named and related libraries have been substantially refactored for
+    improved query performance -- particularly on delegation heavy zones
+    -- and for improved readability, maintainability, and testability.
+  * Code implementing the name server query processing logic has been
+    moved into a new libns library, for easier testing and use in tools
+    other than named.
+  * Cached, validated NSEC and other records can now be used to synthesize
+    NXDOMAIN responses.
+  * The DNS Response Policy Service API (DNSRPS) is now supported.
+  * Setting 'max-journal-size default' now limits the size of journal
+    files to twice the size of the zone.
+  * dnstap-read -x prints a hex dump of the wire format of each logged DNS
+    message.
+  * dnstap output files can now be configured to roll automatically when
+    reaching a given size.
+  * Log file timestamps can now also be formatted in ISO 8601 (local) or
+    ISO 8601 (UTC) formats.
+  * Logging channels and dnstap output files can now be configured to use
+    a timestamp as the suffix when rolling to a new file.
+  * 'named-checkconf -l' lists zones found in named.conf.
+  * Added support for the EDNS Padding and Keepalive options.
+  * 'new-zones-directory' option sets the location where the configuration
+    data for zones added by rndc addzone is stored.
+  * The default key algorithm in rndc-confgen is now hmac-sha256.
+  * filter-aaaa-on-v4 and filter-aaaa-on-v6 options are now available by
+    default without a configure option.
+  * The obsolete isc-hmac-fixup command has been removed.
+
 BIND 9.11

 BIND 9.11.0 includes a number of changes from BIND 9.10 and earlier
@@ -10,6 +10,81 @@
 -->
 ### Functional enhancements from prior major releases of BIND 9

+#### BIND 9.14
+
+BIND 9.14 (a stable branch based on the 9.13 development branch)
+includes a number of changes from BIND 9.12 and earlier releases.
+New features include:
+
+* A new "plugin" mechanism has been added to allow query functionality
+  to be extended using dynamically loadable libraries. The "filter-aaaa"
+  feature has been removed from named and is now implemented as a plugin.
+* Socket and task code has been refactored to improve performance.
+* QNAME minimization, as described in RFC 7816, is now supported.
+* "Root key sentinel" support, enabling validating resolvers to indicate
+  via a special query which trust anchors are configured for the root zone.
+* Secondary zones can now be configured as "mirror" zones; their contents
+  are transferred in as with traditional slave zones, but are subject to
+  DNSSEC validation and are not treated as authoritative data when
+  answering. This makes it easier to configure a local copy of the root
+  zone as described in RFC 7706.
+* The "validate-except" option allows configuration of domains below which
+  DNSSEC validation should not be performed.
+* The default value of "dnssec-validation" is now "auto".
+* IDNA2008 is now supported when linking with `libidn2`.
+* "named -V" now outputs the default paths for files used by named
+  and other tools.
+
+In addition, workarounds that were formerly in place to enable resolution
+of domains whose authoritative servers did not respond to EDNS queries
+have been removed. See [https://dnsflagday.net](https://dnsflagday.net)
+for more details.
+
+Cryptographic support has been modernized. BIND now uses the
+best available pseudo-random number generator for the platform on which
+it's built. Very old versions of OpenSSL are no longer supported.
+Cryptography is now mandatory: building BIND without DNSSEC is no
+longer supported.
+
+Special code to support certain legacy operating systems has also
+been removed; see the file [PLATFORMS.md](PLATFORMS.md) for details
+of supported platforms. In addition to OpenSSL, BIND now requires
+support for IPv6, threads, and standard atomic operations provided
+by the C compiler.
+
+#### BIND 9.12
+
+BIND 9.12 includes a number of changes from BIND 9.11 and earlier releases.
+New features include:
+
+* `named` and related libraries have been substantially refactored for
+  improved query performance -- particularly on delegation heavy zones --
+  and for improved readability, maintainability, and testability.
+* Code implementing the name server query processing logic has been moved
+  into a new `libns` library, for easier testing and use in tools other
+  than `named`.
+* Cached, validated NSEC and other records can now be used to synthesize
+  NXDOMAIN responses.
+* The DNS Response Policy Service API (DNSRPS) is now supported.
+* Setting `'max-journal-size default'` now limits the size of journal files
+  to twice the size of the zone.
+* `dnstap-read -x` prints a hex dump of the wire format of each logged
+  DNS message.
+* `dnstap` output files can now be configured to roll automatically when
+  reaching a given size.
+* Log file timestamps can now also be formatted in ISO 8601 (local) or ISO
+  8601 (UTC) formats.
+* Logging channels and `dnstap` output files can now be configured to use a
+  timestamp as the suffix when rolling to a new file.
+* `'named-checkconf -l'` lists zones found in `named.conf`.
+* Added support for the EDNS Padding and Keepalive options.
+* 'new-zones-directory' option sets the location where the configuration
+  data for zones added by rndc addzone is stored.
+* The default key algorithm in `rndc-confgen` is now hmac-sha256.
+* `filter-aaaa-on-v4` and `filter-aaaa-on-v6` options are now available
+  by default without a configure option.
+* The obsolete `isc-hmac-fixup` command has been removed.
+
 #### BIND 9.11

 BIND 9.11.0 includes a number of changes from BIND 9.10 and earlier
@@ -14,7 +14,7 @@ top_builddir =  @top_builddir@

 VERSION=@BIND9_VERSION@

-SUBDIRS =	make unit lib fuzz bin doc
+SUBDIRS =	make lib fuzz bin doc
 TARGETS =
 PREREQS =	bind.keys.h

@@ -13,49 +13,78 @@ offer support on a "best effort" basis for some.

 Regularly tested platforms

-As of May 2018, BIND 9.13 is tested on the following systems:
+As of Feb 2019, BIND 9.15 is fully supported and regularly tested on the
+following systems:

-  * Debian 8, 9
+  * Debian 8, 9, 10
  * Ubuntu 16.04, 18.04
-  * Fedora 27, 28
-  * Red Hat/CentOS 6, 7
-  * FreeBSD 10.x, 11.x
-  * OpenBSD 6.3
+  * Fedora 28, 29
+  * Red Hat Enterprise Linux / CentOS 6, 7
+  * FreeBSD 11.x
+  * OpenBSD 6.2, 6.3

 The amd64, i386, armhf and arm64 CPU architectures are all fully
 supported.

 Best effort

-The following are platforms on which BIND is known to build and run, but
-on which it is not routinely tested. ISC makes every effort to fix bugs on
-these platforms, but may be unable to do so quickly due to lack of
-hardware, less familiarity on the part of engineering staff, and other
-constraints.
+The following are platforms on which BIND is known to build and run. ISC
+makes every effort to fix bugs on these platforms, but may be unable to do
+so quickly due to lack of hardware, less familiarity on the part of
+engineering staff, and other constraints. With the exception of Windows
+Server 2012 R2, none of these are tested regularly by ISC.

-  * Windows 10 / x64
  * Windows Server 2012 R2, 2016 / x64
+  * Windows 10 / x64
  * macOS 10.12+
-  * Solaris 10
-  * FreeBSD 12+
-  * OpenBSD 6.2
+  * Solaris 11
+  * FreeBSD 10.x, 12.0+
+  * OpenBSD 6.4+
  * NetBSD
-  * Older or less popular Linux distributions still supported by their
-    vendors, such as:
+  * Other Linux distributions still supported by their vendors, such as:
      + Ubuntu 14.04, 18.10+
      + Gentoo
-      + ArchLinux
+      + Arch Linux
      + Alpine Linux
-  * OpenWRT/LEDE 17.0
+  * OpenWRT/LEDE 17.01+
  * Other CPU architectures (mips, mipsel, sparc, ...)

 Unsupported platforms

-These are platforms on which BIND is known not to build or run:
+These are platforms on which BIND 9.15 is known not to build or run:

  * Platforms without at least OpenSSL 1.0.2
  * Windows 10 / x86
  * Windows Server 2012 and older
+  * Solaris 10 and older
  * Platforms that don't support IPv6 Advanced Socket API (RFC 3542)
  * Platforms that don't support atomic operations (via compiler or
    library)
+  * Linux without NPTL (Native POSIX Thread Library)
+
+Platform quirks
+
+ARM
+
+If the compilation ends with following error:
+
+Error: selected processor does not support `yield' in ARM mode
+
+You will need to set -march compiler option to native, so the compiler
+recognizes yield assembler instruction. The proper way to set -march=
+native would be to put it into CFLAGS, e.g. run ./configure like this:
+CFLAGS="-march=native -Os -g" ./configure plus your usual options.
+
+If that doesn't work, you can enforce the minimum CPU and FPU (taken from
+Debian armhf documentation):
+
+  * The lowest worthwhile CPU implementation is Armv7-A, therefore the
+    recommended build option is -march=armv7-a.
+
+  * FPU should be set at VFPv3-D16 as they represent the minimum
+    specification of the processors to support here, therefore the
+    recommended build option is -mfpu=vfpv3-d16.
+
+The configure command should look like this:
+
+CFLAGS="-march=armv7-a -mfpu=vfpv3-d16 -Os -g" ./configure
@@ -23,47 +23,49 @@ offer support on a "best effort" basis for some.

 ### Regularly tested platforms

-As of May 2018, BIND 9.13 is tested on the following systems:
+As of Feb 2019, BIND 9.15 is fully supported and regularly tested on the
+following systems:

-* Debian 8, 9
+* Debian 8, 9, 10
 * Ubuntu 16.04, 18.04
-* Fedora 27, 28
-* Red Hat/CentOS 6, 7
-* FreeBSD 10.x, 11.x
-* OpenBSD 6.3
+* Fedora 28, 29
+* Red Hat Enterprise Linux / CentOS 6, 7
+* FreeBSD 11.x
+* OpenBSD 6.2, 6.3

 The amd64, i386, armhf and arm64 CPU architectures are all fully supported.

 ### Best effort

-The following are platforms on which BIND is known to build and run,
-but on which it is not routinely tested. ISC makes every effort to fix bugs
-on these platforms, but may be unable to do so quickly due to lack of
-hardware, less familiarity on the part of engineering staff, and other
-constraints.
+The following are platforms on which BIND is known to build and run.
+ISC makes every effort to fix bugs on these platforms, but may be unable to
+do so quickly due to lack of hardware, less familiarity on the part of
+engineering staff, and other constraints. With the exception of Windows
+Server 2012 R2, none of these are tested regularly by ISC.

-* Windows 10 / x64
 * Windows Server 2012 R2, 2016 / x64
+* Windows 10 / x64
 * macOS 10.12+
-* Solaris 10
-* FreeBSD 12+
-* OpenBSD 6.2
+* Solaris 11
+* FreeBSD 10.x, 12.0+
+* OpenBSD 6.4+
 * NetBSD
-* Older or less popular Linux distributions still supported by their vendors, such as:
+* Other Linux distributions still supported by their vendors, such as:
    * Ubuntu 14.04, 18.10+
    * Gentoo
-    * ArchLinux
+    * Arch Linux
    * Alpine Linux
-* OpenWRT/LEDE 17.0
+* OpenWRT/LEDE 17.01+
 * Other CPU architectures (mips, mipsel, sparc, ...)

 ## Unsupported platforms

-These are platforms on which BIND is known *not* to build or run:
+These are platforms on which BIND 9.15 is known *not* to build or run:

 * Platforms without at least OpenSSL 1.0.2
 * Windows 10 / x86
 * Windows Server 2012 and older
+* Solaris 10 and older
 * Platforms that don't support IPv6 Advanced Socket API (RFC 3542)
 * Platforms that don't support atomic operations (via compiler or library)
 * Linux without NPTL (Native POSIX Thread Library)
@@ -89,12 +91,22 @@ armhf documentation):
 * The lowest worthwhile CPU implementation is Armv7-A, therefore the recommended
  build option is `-march=armv7-a`.

-* FPU should be set at VFPv3-D16 as they represent the miminum specification of
+* FPU should be set at VFPv3-D16 as they represent the minimum specification of
  the processors to support here, therefore the recommended build option is
  `-mfpu=vfpv3-d16`.

-The configure command should look like this:
+The `configure` command should look like this:

 ```
 CFLAGS="-march=armv7-a -mfpu=vfpv3-d16 -Os -g" ./configure
 ```
+
+### NetBSD 6 i386
+
+The i386 build of NetBSD requires the `libatomic` library, available from
+the `gcc5-libs` package.  Because this library is in a non-standard path,
+its location must be specified in the `configure` command line:
+
+```
+LDFLAGS="-L/usr/pkg/gcc5/i486--netbsdelf/lib/ -Wl,-R/usr/pkg/gcc5/i486--netbsdelf/lib/" ./configure
+```
@@ -5,14 +5,15 @@ Contents
 1. Introduction
 2. Reporting bugs and getting help
 3. Contributing to BIND
- 4. BIND 9.13 features
+ 4. BIND 9.15 features
 5. Building BIND
 6. macOS
- 7. Compile-time options
- 8. Automated testing
- 9. Documentation
-10. Change log
-11. Acknowledgments
+ 7. Dependencies
+ 8. Compile-time options
+ 9. Automated testing
+10. Documentation
+11. Change log
+12. Acknowledgments

 Introduction

@@ -99,38 +100,12 @@ If you prefer, you may also submit code by opening a GitLab Issue and
 including your patch as an attachment, preferably generated by git
 format-patch.

-BIND 9.13 features
+BIND 9.15 features

-BIND 9.13 is the newest development branch of BIND 9. It includes a number
-of changes from BIND 9.12 and earlier releases. New features include:
+BIND 9.15 is the newest development branch of BIND 9. It includes a number
+of changes from BIND 9.14 and earlier releases. New features include:

-  * QNAME minimization, as described in RFC 7816, is now supported.
-  * "Root key sentinel" support, enabling validating resolvers to indicate
-    via a special query which trust anchors are configured for the root
-    zone.
-  * Secondary zones can now be configured as "mirror" zones; their
-    contents are transferred in as with traditional slave zones, but are
-    subject to DNSSEC validation and are not treated as authoritative data
-    when answering. This makes it easier to configure a local copy of the
-    root zone as described in RFC 7706.
-  * The "validate-except" option allows configuration of domains below
-    which DNSSEC validation should not be performed.
-  * The default value of "dnssec-validation" is now "auto".
-  * IDNA2008 is now supported when linking with libidn2.
-
-In addition, workarounds that were formerly in place to enable resolution
-of domains whose authoritative servers did not respond to EDNS queries
-have been removed. See https://dnsflagday.net for more details.
-
-Cryptographic support has been modernized. BIND now uses the best
-available pseudo-random number generator for the platform on which it's
-built. Very old versions of OpenSSL are no longer supported. Cryptography
-is now mandatory: building BIND without DNSSEC is now longer supported.
-
-Special code to support certain legacy operating systems has also been
-removed; see the file PLATFORMS.md for details of supported platforms. In
-addition to OpenSSL, BIND now requires support for IPv6, threads, and
-standard atomic operations provided by the C compiler.
+  * TBD

 Building BIND

@@ -189,30 +164,21 @@ if you have Xcode already installed you can run "xcode-select --install".
 This will add /usr/include to the system and install the compiler and
 other tools so that they can be easily found.

+Dependencies
+
+Portions of BIND that are written in Python, including dnssec-keymgr,
+dnssec-coverage, dnssec-checkds, and some of the system tests, require the
+'argparse' and 'ply' modules to be available. 'argparse' is a standard
+module as of Python 2.7 and Python 3.2. 'ply' is available from https://
+pypi.python.org/pypi/ply.
+
 Compile-time options

 To see a full list of configuration options, run configure --help.

-On most platforms, BIND 9 is built with multithreading support, allowing
-it to take advantage of multiple CPUs. You can configure this by
-specifying --enable-threads or --disable-threads on the configure command
-line. The default is to enable threads, except on some older operating
-systems on which threads are known to have had problems in the past.
-(Note: Prior to BIND 9.10, the default was to disable threads on Linux
-systems; this has now been reversed. On Linux systems, the threaded build
-is known to change BIND's behavior with respect to file permissions; it
-may be necessary to specify a user with the -u option when running named.)
-
 To build shared libraries, specify --with-libtool on the configure command
 line.

-Certain compiled-in constants and default settings can be increased to
-values better suited to large servers with abundant memory resources (e.g,
-64-bit servers with 12G or more of memory) by specifying --with-tuning=
-large on the configure command line. This can improve performance on big
-servers, but will consume more memory and may degrade performance on
-smaller systems.
-
 For the server to support DNSSEC, you need to build it with crypto
 support. To use OpenSSL, you should have OpenSSL 1.0.2e or newer
 installed. If the OpenSSL library is installed in a nonstandard location,
@@ -244,17 +210,18 @@ github.com/farsightsec/fstrm and libprotobuf-c https://
 developers.google.com/protocol-buffers, and BIND must be configured with
 --enable-dnstap.

+Certain compiled-in constants and default settings can be increased to
+values better suited to large servers with abundant memory resources (e.g,
+64-bit servers with 12G or more of memory) by specifying --with-tuning=
+large on the configure command line. This can improve performance on big
+servers, but will consume more memory and may degrade performance on
+smaller systems.
+
 On Linux, process capabilities are managed in user space using the libcap
 library, which can be installed on most Linux systems via the libcap-dev
 or libcap-devel module. Process capability support can also be disabled by
 configuring with --disable-linux-caps.

-Portions of BIND that are written in Python, including dnssec-keymgr,
-dnssec-coverage, dnssec-checkds, and some of the system tests, require the
-'argparse' and 'ply' modules to be available. 'argparse' is a standard
-module as of Python 2.7 and Python 3.2. 'ply' is available from https://
-pypi.python.org/pypi/ply.
-
 On some platforms it is necessary to explicitly request large file support
 to handle files bigger than 2GB. This can be done by using
 --enable-largefile on the configure command line.
@@ -264,6 +231,10 @@ specifying --enable-fixed-rrset or --disable-fixed-rrset on the configure
 command line. By default, fixed rrset-order is disabled to reduce memory
 footprint.

+The --enable-querytrace option causes named to log every step of
+processing every query. This should only be enabled when debugging,
+because it has a significant negative impact on query performance.
+
 make install will install named and the various BIND 9 libraries. By
 default, installation is into /usr/local, but this can be changed with the
 --prefix option when running configure.
@@ -289,8 +260,10 @@ and will be skipped if these are not available. Some tests require Python
 and the 'dnspython' module and will be skipped if these are not available.
 See bin/tests/system/README for further details.

-Unit tests are implemented using Automated Testing Framework (ATF). To run
-them, use configure --with-atf, then run make test or make unit.
+Unit tests are implemented using the CMocka unit testing framework. To
+build them, use configure --with-cmocka. Execution of tests is done by the
+Kyua test execution engine; if the kyua command is available, then unit
+tests can be run via make test or make unit.

 Documentation

@@ -15,9 +15,10 @@
 1. [Introduction](#intro)
 1. [Reporting bugs and getting help](#help)
 1. [Contributing to BIND](#contrib)
-1. [BIND 9.13 features](#features)
+1. [BIND 9.15 features](#features)
 1. [Building BIND](#build)
 1. [macOS](#macos)
+1. [Dependencies](#dependencies)
 1. [Compile-time options](#opts)
 1. [Automated testing](#testing)
 1. [Documentation](#doc)
@@ -116,41 +117,13 @@ If you prefer, you may also submit code by opening a
 including your patch as an attachment, preferably generated by
 `git format-patch`.

-### <a name="features"/> BIND 9.13 features
+### <a name="features"/> BIND 9.15 features

-BIND 9.13 is the newest development branch of BIND 9. It includes a
-number of changes from BIND 9.12 and earlier releases.  New features
+BIND 9.15 is the newest development branch of BIND 9. It includes a
+number of changes from BIND 9.14 and earlier releases.  New features
 include:

-* QNAME minimization, as described in RFC 7816, is now supported.
-* "Root key sentinel" support, enabling validating resolvers to indicate
-  via a special query which trust anchors are configured for the root zone.
-* Secondary zones can now be configured as "mirror" zones; their contents
-  are transferred in as with traditional slave zones, but are subject to
-  DNSSEC validation and are not treated as authoritative data when
-  answering. This makes it easier to configure a local copy of the root
-  zone as described in RFC 7706.
-* The "validate-except" option allows configuration of domains below which
-  DNSSEC validation should not be performed.
-* The default value of "dnssec-validation" is now "auto".
-* IDNA2008 is now supported when linking with `libidn2`.
-
-In addition, workarounds that were formerly in place to enable resolution
-of domains whose authoritative servers did not respond to EDNS queries
-have been removed. See [https://dnsflagday.net](https://dnsflagday.net)
-for more details.
-
-Cryptographic support has been modernized. BIND now uses the
-best available pseudo-random number generator for the platform on which
-it's built. Very old versions of OpenSSL are no longer supported.
-Cryptography is now mandatory: building BIND without DNSSEC is now
-longer supported.
-
-Special code to support certain legacy operating systems has also
-been removed; see the file [PLATFORMS.md](PLATFORMS.md) for details
-of supported platforms. In addition to OpenSSL, BIND now requires
-support for IPv6, threads, and standard atomic operations provided
-by the C compiler.
+* TBD

 ### <a name="build"/> Building BIND

@@ -203,31 +176,21 @@ or if you have Xcode already installed you can run "xcode-select --install".
 This will add /usr/include to the system and install the compiler and other
 tools so that they can be easily found.

+### <a name="dependencies"/> Dependencies
+
+Portions of BIND that are written in Python, including
+`dnssec-keymgr`, `dnssec-coverage`, `dnssec-checkds`, and some of the
+system tests, require the 'argparse' and 'ply' modules to be available.
+'argparse' is a standard module as of Python 2.7 and Python 3.2.
+'ply' is available from [https://pypi.python.org/pypi/ply](https://pypi.python.org/pypi/ply).

 #### <a name="opts"/> Compile-time options

 To see a full list of configuration options, run `configure --help`.

-On most platforms, BIND 9 is built with multithreading support, allowing it
-to take advantage of multiple CPUs.  You can configure this by specifying
-`--enable-threads` or `--disable-threads` on the `configure` command line.
-The default is to enable threads, except on some older operating systems on
-which threads are known to have had problems in the past.  (Note: Prior to
-BIND 9.10, the default was to disable threads on Linux systems; this has
-now been reversed.  On Linux systems, the threaded build is known to change
-BIND's behavior with respect to file permissions; it may be necessary to
-specify a user with the -u option when running `named`.)
-
 To build shared libraries, specify `--with-libtool` on the `configure`
 command line.

-Certain compiled-in constants and default settings can be increased to
-values better suited to large servers with abundant memory resources (e.g,
-64-bit servers with 12G or more of memory) by specifying
-`--with-tuning=large` on the `configure` command line. This can improve
-performance on big servers, but will consume more memory and may degrade
-performance on smaller systems.
-
 For the server to support DNSSEC, you need to build it with crypto support.
 To use OpenSSL, you should have OpenSSL 1.0.2e or newer installed.  If the
 OpenSSL library is installed in a nonstandard location, specify the prefix
@@ -262,17 +225,18 @@ and libprotobuf-c
 [https://developers.google.com/protocol-buffers](https://developers.google.com/protocol-buffers),
 and BIND must be configured with `--enable-dnstap`.

+Certain compiled-in constants and default settings can be increased to
+values better suited to large servers with abundant memory resources (e.g,
+64-bit servers with 12G or more of memory) by specifying
+`--with-tuning=large` on the `configure` command line. This can improve
+performance on big servers, but will consume more memory and may degrade
+performance on smaller systems.
+
 On Linux, process capabilities are managed in user space using
 the `libcap` library, which can be installed on most Linux systems via
 the `libcap-dev` or `libcap-devel` module. Process capability support can
 also be disabled by configuring with `--disable-linux-caps`.

-Portions of BIND that are written in Python, including
-`dnssec-keymgr`, `dnssec-coverage`, `dnssec-checkds`, and some of the
-system tests, require the 'argparse' and 'ply' modules to be available.
-'argparse' is a standard module as of Python 2.7 and Python 3.2.
-'ply' is available from [https://pypi.python.org/pypi/ply](https://pypi.python.org/pypi/ply).
-
 On some platforms it is necessary to explicitly request large file support
 to handle files bigger than 2GB.  This can be done by using
 `--enable-largefile` on the `configure` command line.
@@ -282,6 +246,10 @@ specifying `--enable-fixed-rrset` or `--disable-fixed-rrset` on the
 configure command line.  By default, fixed rrset-order is disabled to
 reduce memory footprint.

+The `--enable-querytrace` option causes `named` to log every step of
+processing every query. This should only be enabled when debugging, because
+it has a significant negative impact on query performance.
+
 `make install` will install `named` and the various BIND 9 libraries.  By
 default, installation is into /usr/local, but this can be changed with the
 `--prefix` option when running `configure`.
@@ -307,9 +275,10 @@ and will be skipped if these are not available. Some tests require Python
 and the 'dnspython' module and will be skipped if these are not available.
 See bin/tests/system/README for further details.

-Unit tests are implemented using Automated Testing Framework (ATF).
-To run them, use `configure --with-atf`, then run `make test` or
-`make unit`.
+Unit tests are implemented using the CMocka unit testing framework.
+To build them, use `configure --with-cmocka`. Execution of tests is done
+by the Kyua test execution engine; if the `kyua` command is available,
+then unit tests can be run via `make test` or `make unit`.

 ### <a name="doc"/> Documentation

@@ -289,6 +289,7 @@ AS_VAR_IF([$1], [""], [$5], [$4])dnl
 ])dnl PKG_CHECK_VAR

 m4_include([m4/ax_check_openssl.m4])
+m4_include([m4/ax_posix_shell.m4])
 m4_include([m4/ax_pthread.m4])
 m4_include([m4/libtool.m4])
 m4_include([m4/ltoptions.m4])
@@ -12,7 +12,7 @@ VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@

 SUBDIRS =	named rndc dig delv dnssec tools nsupdate check confgen \
-		@NZD_TOOLS@ @PYTHON_TOOLS@ @PKCS11_TOOLS@ tests
+		@NZD_TOOLS@ @PYTHON_TOOLS@ @PKCS11_TOOLS@ plugins tests
 TARGETS =

@BIND9_MAKE_RULES@
@@ -66,7 +66,7 @@ named-checkzone.@O@: named-checkzone.c
 named-checkconf@EXEEXT@: named-checkconf.@O@ check-tool.@O@ ${ISCDEPLIBS} \
 		${NSDEPENDLIBS} ${DNSDEPLIBS} ${ISCCFGDEPLIBS} ${BIND9DEPLIBS}
 	export BASEOBJS="named-checkconf.@O@ check-tool.@O@"; \
-	export LIBS0="${NSLIBS} ${BIND9LIBS} ${ISCCFGLIBS} ${DNSLIBS}"; \
+	export LIBS0="${BIND9LIBS} ${NSLIBS} ${ISCCFGLIBS} ${DNSLIBS}"; \
 	${FINALBUILDCMD}

 named-checkzone@EXEEXT@: named-checkzone.@O@ check-tool.@O@ ${ISCDEPLIBS} \
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -39,7 +39,7 @@
 named-checkconf \- named configuration file syntax checking tool
 .SH "SYNOPSIS"
 .HP \w'\fBnamed\-checkconf\fR\ 'u
-\fBnamed\-checkconf\fR [\fB\-hjlvz\fR] [\fB\-p\fR\ [\fB\-x\fR\ ]] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] {filename}
+\fBnamed\-checkconf\fR [\fB\-chjlvz\fR] [\fB\-p\fR\ [\fB\-x\fR\ ]] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] {filename}
 .SH "DESCRIPTION"
 .PP
 \fBnamed\-checkconf\fR
@@ -79,6 +79,13 @@ When loading a zonefile read the journal if it exists\&.
 List all the configured zones\&. Each line of output contains the zone name, class (e\&.g\&. IN), view, and type (e\&.g\&. master or slave)\&.
 .RE
 .PP
+\-c
+.RS 4
+Check "core" configuration only\&. This suppresses the loading of plugin modules, and causes all parameters to
+\fBplugin\fR
+statements to be ignored\&.
+.RE
+.PP
 \-p
 .RS 4
 Print out the
@@ -136,5 +143,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -46,6 +46,8 @@

 static const char *program = "named-checkconf";

+static bool loadplugins = true;
+
 isc_log_t *logc = NULL;

 #define CHECK(r)\
@@ -61,7 +63,7 @@ usage(void) ISC_PLATFORM_NORETURN_POST;

 static void
 usage(void) {
-	fprintf(stderr, "usage: %s [-hjlvz] [-p [-x]] [-t directory] "
+	fprintf(stderr, "usage: %s [-chjlvz] [-p [-x]] [-t directory] "
 		"[named.conf]\n", program);
 	exit(1);
 }
@@ -282,8 +284,10 @@ configure_zone(const char *vclass, const char *view,
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			zone_options &= ~DNS_ZONEOPT_CHECKDUPRR;
 			zone_options &= ~DNS_ZONEOPT_CHECKDUPRRFAIL;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	} else {
 		zone_options |= DNS_ZONEOPT_CHECKDUPRR;
 		zone_options &= ~DNS_ZONEOPT_CHECKDUPRRFAIL;
@@ -300,8 +304,10 @@ configure_zone(const char *vclass, const char *view,
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			zone_options &= ~DNS_ZONEOPT_CHECKMX;
 			zone_options &= ~DNS_ZONEOPT_CHECKMXFAIL;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	} else {
 		zone_options |= DNS_ZONEOPT_CHECKMX;
 		zone_options &= ~DNS_ZONEOPT_CHECKMXFAIL;
@@ -327,8 +333,10 @@ configure_zone(const char *vclass, const char *view,
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			zone_options |= DNS_ZONEOPT_WARNMXCNAME;
 			zone_options |= DNS_ZONEOPT_IGNOREMXCNAME;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	} else {
 		zone_options |= DNS_ZONEOPT_WARNMXCNAME;
 		zone_options &= ~DNS_ZONEOPT_IGNOREMXCNAME;
@@ -345,8 +353,10 @@ configure_zone(const char *vclass, const char *view,
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			zone_options |= DNS_ZONEOPT_WARNSRVCNAME;
 			zone_options |= DNS_ZONEOPT_IGNORESRVCNAME;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	} else {
 		zone_options |= DNS_ZONEOPT_WARNSRVCNAME;
 		zone_options &= ~DNS_ZONEOPT_IGNORESRVCNAME;
@@ -366,8 +376,10 @@ configure_zone(const char *vclass, const char *view,
 			zone_options |= DNS_ZONEOPT_CHECKSPF;
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			zone_options &= ~DNS_ZONEOPT_CHECKSPF;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	} else {
 		zone_options |= DNS_ZONEOPT_CHECKSPF;
 	}
@@ -383,8 +395,10 @@ configure_zone(const char *vclass, const char *view,
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			zone_options &= ~DNS_ZONEOPT_CHECKNAMES;
 			zone_options &= ~DNS_ZONEOPT_CHECKNAMESFAIL;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	} else {
 	       zone_options |= DNS_ZONEOPT_CHECKNAMES;
 	       zone_options |= DNS_ZONEOPT_CHECKNAMESFAIL;
@@ -394,14 +408,16 @@ configure_zone(const char *vclass, const char *view,
 	fmtobj = NULL;
 	if (get_maps(maps, "masterfile-format", &fmtobj)) {
 		const char *masterformatstr = cfg_obj_asstring(fmtobj);
-		if (strcasecmp(masterformatstr, "text") == 0)
+		if (strcasecmp(masterformatstr, "text") == 0) {
 			masterformat = dns_masterformat_text;
-		else if (strcasecmp(masterformatstr, "raw") == 0)
+		} else if (strcasecmp(masterformatstr, "raw") == 0) {
 			masterformat = dns_masterformat_raw;
-		else if (strcasecmp(masterformatstr, "map") == 0)
+		} else if (strcasecmp(masterformatstr, "map") == 0) {
 			masterformat = dns_masterformat_map;
-		else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	}

 	obj = NULL;
@@ -548,7 +564,7 @@ main(int argc, char **argv) {
 	/*
 	 * Process memory debugging argument first.
 	 */
-#define CMDLINE_FLAGS "dhjlm:t:pvxz"
+#define CMDLINE_FLAGS "cdhjlm:t:pvxz"
 	while ((c = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (c) {
 		case 'm':
@@ -573,6 +589,10 @@ main(int argc, char **argv) {

 	while ((c = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != EOF) {
 		switch (c) {
+		case 'c':
+			loadplugins = false;
+			break;
+
 		case 'd':
 			debug++;
 			break;
@@ -663,9 +683,10 @@ main(int argc, char **argv) {
 	    ISC_R_SUCCESS)
 		exit(1);

-	result = bind9_check_namedconf(config, logc, mctx);
-	if (result != ISC_R_SUCCESS)
+	result = bind9_check_namedconf(config, loadplugins, logc, mctx);
+	if (result != ISC_R_SUCCESS) {
 		exit_status = 1;
+	}

 	if (result == ISC_R_SUCCESS && (load_zones || list_zones)) {
 		result = load_zones_fromconfig(config, mctx, list_zones);
@@ -40,6 +40,7 @@
      <year>2015</year>
      <year>2016</year>
      <year>2018</year>
+      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -52,7 +53,7 @@
  <refsynopsisdiv>
    <cmdsynopsis sepchar=" ">
      <command>named-checkconf</command>
-      <arg choice="opt" rep="norepeat"><option>-hjlvz</option></arg>
+      <arg choice="opt" rep="norepeat"><option>-chjlvz</option></arg>
      <arg choice="opt" rep="norepeat"><option>-p</option>
 	<arg choice="opt" rep="norepeat"><option>-x</option>
      </arg></arg>
@@ -114,6 +115,17 @@
        </listitem>
      </varlistentry>

+      <varlistentry>
+        <term>-c</term>
+        <listitem>
+          <para>
+	    Check "core" configuration only. This suppresses the loading
+	    of plugin modules, and causes all parameters to
+	    <command>plugin</command> statements to be ignored.
+          </para>
+        </listitem>
+      </varlistentry>
+
      <varlistentry>
        <term>-p</term>
        <listitem>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -33,7 +33,7 @@
 <h2>Synopsis</h2>
    <div class="cmdsynopsis"><p>
      <code class="command">named-checkconf</code> 
-       [<code class="option">-hjlvz</code>]
+       [<code class="option">-chjlvz</code>]
       [<code class="option">-p</code>
 	 [<code class="option">-x</code>
      ]]
@@ -88,6 +88,14 @@
            (e.g. master or slave).
          </p>
        </dd>
+<dt><span class="term">-c</span></dt>
+<dd>
+          <p>
+	    Check "core" configuration only. This suppresses the loading
+	    of plugin modules, and causes all parameters to
+	    <span class="command"><strong>plugin</strong></span> statements to be ignored.
+          </p>
+        </dd>
 <dt><span class="term">-p</span></dt>
 <dd>
          <p>
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000-2002, 2004-2007, 2009-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000-2002, 2004-2007, 2009-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -325,5 +325,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000-2002, 2004-2007, 2009-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000-2002, 2004-2007, 2009-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -139,12 +139,14 @@ main(int argc, char **argv) {
 #define PROGCMP(X) \
 	(strcasecmp(prog_name, X) == 0 || strcasecmp(prog_name, X ".exe") == 0)

-	if (PROGCMP("named-checkzone"))
+	if (PROGCMP("named-checkzone")) {
 		progmode = progmode_check;
-	else if (PROGCMP("named-compilezone"))
+	} else if (PROGCMP("named-compilezone")) {
 		progmode = progmode_compile;
-	else
+	} else {
 		INSIST(0);
+		ISC_UNREACHABLE();
+	}

 	/* Compilation specific defaults */
 	if (progmode == progmode_compile) {
@@ -43,6 +43,7 @@
      <year>2015</year>
      <year>2016</year>
      <year>2018</year>
+      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000-2002, 2004-2007, 2009-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000-2002, 2004-2007, 2009-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2009, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -144,5 +144,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2009, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -125,10 +125,12 @@ main(int argc, char **argv) {
 	if (PROGCMP("tsig-keygen")) {
 		progmode = progmode_keygen;
 		quiet = true;
-	} else if (PROGCMP("ddns-confgen"))
+	} else if (PROGCMP("ddns-confgen")) {
 		progmode = progmode_confgen;
-	else
+	} else {
 		INSIST(0);
+		ISC_UNREACHABLE();
+	}

 	isc_commandline_errprint = false;

@@ -37,6 +37,7 @@
      <year>2015</year>
      <year>2016</year>
      <year>2018</year>
+      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2009, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -206,5 +206,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2001, 2003-2005, 2007, 2009, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2001, 2003-2005, 2007, 2009, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -44,6 +44,7 @@
      <year>2016</year>
      <year>2017</year>
      <year>2018</year>
+      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2014-2018 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -437,5 +437,5 @@ RFC5155\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2014-2018 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -743,8 +743,8 @@ setup_dnsseckeys(dns_client_t *client) {

 		isc_buffer_init(&b, anchortext, sizeof(anchortext) - 1);
 		isc_buffer_add(&b, sizeof(anchortext) - 1);
-		result = cfg_parse_buffer(parser, &b, &cfg_type_bindkeys,
-					  &bindkeys);
+		result = cfg_parse_buffer(parser, &b, NULL, 0,
+					  &cfg_type_bindkeys, 0, &bindkeys);
 		if (result != ISC_R_SUCCESS)
 			fatal("Unable to parse built-in keys");
 	}
@@ -765,7 +765,14 @@ setup_dnsseckeys(dns_client_t *client) {
 	if (dlv_validation)
 		dns_client_setdlv(client, dns_rdataclass_in, dlv_anchor);

+
 cleanup:
+	if (bindkeys != NULL) {
+		cfg_obj_destroy(parser, &bindkeys);
+	}
+	if (parser != NULL) {
+		cfg_parser_destroy(&parser);
+	}
 	if (result != ISC_R_SUCCESS)
 		delv_log(ISC_LOG_ERROR, "setup_dnsseckeys: %s",
 			  isc_result_totext(result));
@@ -1167,6 +1174,8 @@ plus_option(char *option) {
 * options: "46a:b:c:d:himp:q:t:vx:";
 */
 static const char *single_dash_opts = "46himv";
+static const char *dash_opts = "46abcdhimpqtvx";
+
 static bool
 dash_option(char *option, char *next, bool *open_type_class) {
 	char opt, *value;
@@ -1224,6 +1233,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
 			/* NOTREACHED */
 		default:
 			INSIST(0);
+			ISC_UNREACHABLE();
 		}
 		if (strlen(option) > 1U)
 			option = &option[1];
@@ -1367,8 +1377,10 @@ preparse_args(int argc, char **argv) {
 	char *option;

 	for (argc--, argv++; argc > 0; argc--, argv++) {
-		if (argv[0][0] != '-')
+		if (argv[0][0] != '-') {
 			continue;
+		}
+
 		option = &argv[0][1];
 		while (strpbrk(option, single_dash_opts) == &option[0]) {
 			switch (option[0]) {
@@ -1391,6 +1403,27 @@ preparse_args(int argc, char **argv) {
 			}
 			option = &option[1];
 		}
+
+		if (strlen(option) == 0U) {
+			continue;
+		}
+
+		/* Look for dash value option. */
+		if (strpbrk(option, dash_opts) != &option[0] ||
+		    strlen(option) > 1U)
+		{
+			/* Error or value in option. */
+			continue;
+		}
+
+		/* Dash value is next argument so we need to skip it. */
+		argc--;
+		argv++;
+
+		/* Handle missing argument */
+		if (argc == 0) {
+			break;
+		}
 	}
 }

@@ -39,6 +39,7 @@
      <year>2016</year>
      <year>2017</year>
      <year>2018</year>
+      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2014-2018 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000-2011, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000-2011, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -74,7 +74,9 @@ will perform an NS query for "\&." (the root)\&.
 It is possible to set per\-user defaults for
 \fBdig\fR
 via
-${HOME}/\&.digrc\&. This file is read and any options in it are applied before the command line arguments\&.
+${HOME}/\&.digrc\&. This file is read and any options in it are applied before the command line arguments\&. The
+\fB\-r\fR
+option disables this feature, for scripts that need predictable behaviour\&.
 .PP
 The IN and CH class names overlap with the IN and CH top level domain names\&. Either use the
 \fB\-t\fR
@@ -174,11 +176,6 @@ reads a list of lookup requests to process from the given
 using the command\-line interface\&.
 .RE
 .PP
-\-i
-.RS 4
-Do reverse IPv6 lookups using the obsolete RFC 1886 IP6\&.INT domain, which is no longer in use\&. Obsolete bit string label queries (RFC 2874) are not attempted\&.
-.RE
-.PP
 \-k \fIkeyfile\fR
 .RS 4
 Sign queries using TSIG using a key read from the given file\&. Key files can be generated using
@@ -208,6 +205,12 @@ The domain name to query\&. This is useful to distinguish the
 from other arguments\&.
 .RE
 .PP
+\-r
+.RS 4
+Do not read options from
+${HOME}/\&.digrc\&. This is useful for scripts that need predictable behaviour\&.
+.RE
+.PP
 \-t \fItype\fR
 .RS 4
 The resource record type to query\&. It can be any valid query type\&. If it is a resource record type supported in BIND 9, it can be given by the type mnemonic (such as "NS" or "AAAA")\&. The default query type is "A", unless the
@@ -246,9 +249,7 @@ arguments\&.
 \fBdig\fR
 automatically performs a lookup for a name like
 94\&.2\&.0\&.192\&.in\-addr\&.arpa
-and sets the query type and class to PTR and IN respectively\&. IPv6 addresses are looked up using nibble format under the IP6\&.ARPA domain (but see also the
-\fB\-i\fR
-option)\&.
+and sets the query type and class to PTR and IN respectively\&. IPv6 addresses are looked up using nibble format under the IP6\&.ARPA domain\&.
 .RE
 .PP
 \-y \fI[hmac:]\fR\fIkeyname:secret\fR
@@ -468,12 +469,16 @@ option is enabled\&. If short form answers are requested, the default is not to
 .PP
 \fB+[no]idnin\fR
 .RS 4
-Process [do not process] IDN domain names on input\&. This requires IDN SUPPORT to have been enabled at compile time\&. The default is to process IDN input\&.
+Process [do not process] IDN domain names on input\&. This requires IDN SUPPORT to have been enabled at compile time\&.
+.sp
+The default is to process IDN input when standard output is a tty\&. The IDN processing on input is disabled when dig output is redirected to files, pipes, and other non\-tty file descriptors\&.
 .RE
 .PP
 \fB+[no]idnout\fR
 .RS 4
-Convert [do not convert] puny code on output\&. This requires IDN SUPPORT to have been enabled at compile time\&. The default is to convert output\&.
+Convert [do not convert] puny code on output\&. This requires IDN SUPPORT to have been enabled at compile time\&.
+.sp
+The default is to process puny code on output when standard output is a tty\&. The puny code processing on output is disabled when dig output is redirected to files, pipes, and other non\-tty file descriptors\&.
 .RE
 .PP
 \fB+[no]ignore\fR
@@ -795,7 +800,10 @@ has been built with IDN (internationalized domain name) support, it can accept a
 appropriately converts character encoding of domain name before sending a request to DNS server or displaying a reply from the server\&. If you\*(Aqd like to turn off the IDN support for some reason, use parameters
 \fI+noidnin\fR
 and
-\fI+noidnout\fR\&.
+\fI+noidnout\fR
+or define the
+\fBIDN_DISABLE\fR
+environment variable\&.
 .SH "FILES"
 .PP
 /etc/resolv\&.conf
@@ -816,5 +824,5 @@ There are probably too many query options\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000-2011, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000-2011, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -66,7 +66,7 @@ static char hexcookie[81];

 static bool short_form = false, printcmd = true,
 	plusquest = false, pluscomm = false,
-	ipv4only = false, ipv6only = false;
+	ipv4only = false, ipv6only = false, digrc = true;
 static uint32_t splitwidth = 0xffffffff;

 /*% opcode text */
@@ -157,6 +157,7 @@ help(void) {
 "                 -m                  (enable memory usage debugging)\n"
 "                 -p port             (specify port number)\n"
 "                 -q name             (specify query name)\n"
+"                 -r                  (do not read ~/.digrc)\n"
 "                 -t type             (specify query type)\n"
 "                 -u                  (display times in usec instead of msec)\n"
 "                 -x dot-notation     (shortcut for reverse lookups)\n"
@@ -1543,8 +1544,8 @@ plus_option(char *option, bool is_batchfile,
 /*%
 * #true returned if value was used
 */
-static const char *single_dash_opts = "46dhimnuv";
-static const char *dash_opts = "46bcdfhikmnptvyx";
+static const char *single_dash_opts = "46dhimnruv";
+static const char *dash_opts = "46bcdfhikmnpqrtvyx";
 static bool
 dash_option(char *option, char *next, dig_lookup_t **lookup,
 	    bool *open_type_class, bool *need_clone,
@@ -1615,6 +1616,10 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		case 'n':
 			/* deprecated */
 			break;
+		case 'r':
+			debug("digrc (late)");
+			digrc = false;
+			break;
 		case 'u':
 			(*lookup)->use_usec = true;
 			break;
@@ -1841,11 +1846,23 @@ preparse_args(int argc, char **argv) {
 		option = &rv[0][1];
 		while (strpbrk(option, single_dash_opts) == &option[0]) {
 			switch (option[0]) {
+			case 'd':
+				/* For debugging early startup */
+				debugging = true;
+				break;
 			case 'm':
 				memdebugging = true;
 				isc_mem_debugging = ISC_MEM_DEBUGTRACE |
 					ISC_MEM_DEBUGRECORD;
 				break;
+			case 'r':
+				/*
+				 * Must be done early, because ~/.digrc
+				 * is read before command line parsing
+				 */
+				debug("digrc (early)");
+				digrc = false;
+				break;
 			case '4':
 				if (ipv6only)
 					fatal("only one of -4 and -6 allowed");
@@ -1859,6 +1876,20 @@ preparse_args(int argc, char **argv) {
 			}
 			option = &option[1];
 		}
+		if (strlen(option) == 0U) {
+			continue;
+		}
+		/* Look for dash value option. */
+		if (strpbrk(option, dash_opts) != &option[0] ||
+		    strlen(option) > 1U) {
+			/* Error or value in option. */
+			continue;
+		}
+		/* Dash value is next argument so we need to skip it. */
+		rc--, rv++;
+		/* Handle missing argument */
+		if (rc == 0)
+			break;
 	}
 }

@@ -1925,8 +1956,9 @@ parse_args(bool is_batchfile, bool config_only,
 		 */
 		INSIST(batchfp == NULL);
 		homedir = getenv("HOME");
-		if (homedir != NULL) {
+		if (homedir != NULL && digrc) {
 			unsigned int n;
+			debug("digrc (open)");
 			n = snprintf(rcfile, sizeof(rcfile), "%s/.digrc",
 				     homedir);
 			if (n < sizeof(rcfile)) {
@@ -52,6 +52,7 @@
      <year>2016</year>
      <year>2017</year>
      <year>2018</year>
+      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -131,9 +132,10 @@

    <para>
      It is possible to set per-user defaults for <command>dig</command> via
-      <filename>${HOME}/.digrc</filename>.  This file is read and
-      any options in it
-      are applied before the command line arguments.
+      <filename>${HOME}/.digrc</filename>. This file is read and any
+      options in it are applied before the command line arguments.
+      The <option>-r</option> option disables this feature, for
+      scripts that need predictable behaviour.
    </para>

    <para>
@@ -323,6 +325,16 @@
 	</listitem>
      </varlistentry>

+      <varlistentry>
+	<term>-r</term>
+	<listitem>
+	  <para>
+	    Do not read options from <filename>${HOME}/.digrc</filename>.
+	    This is useful for scripts that need predictable behaviour.
+	  </para>
+	</listitem>
+      </varlistentry>
+
      <varlistentry>
 	<term>-t <replaceable class="parameter">type</replaceable></term>
 	<listitem>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000-2011, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000-2011, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -106,9 +106,10 @@

    <p>
      It is possible to set per-user defaults for <span class="command"><strong>dig</strong></span> via
-      <code class="filename">${HOME}/.digrc</code>.  This file is read and
-      any options in it
-      are applied before the command line arguments.
+      <code class="filename">${HOME}/.digrc</code>. This file is read and any
+      options in it are applied before the command line arguments.
+      The <code class="option">-r</code> option disables this feature, for
+      scripts that need predictable behaviour.
    </p>

    <p>
@@ -227,14 +228,6 @@
 	    <span class="command"><strong>dig</strong></span> using the command-line interface.
 	  </p>
 	</dd>
-<dt><span class="term">-i</span></dt>
-<dd>
-	  <p>
-	    Do reverse IPv6 lookups using the obsolete RFC 1886 IP6.INT
-	    domain, which is no longer in use. Obsolete bit string
-	    label queries (RFC 2874) are not attempted.
-	  </p>
-	</dd>
 <dt><span class="term">-k <em class="replaceable"><code>keyfile</code></em></span></dt>
 <dd>
 	  <p>
@@ -274,6 +267,13 @@
 	    the <em class="parameter"><code>name</code></em> from other arguments.
 	  </p>
 	</dd>
+<dt><span class="term">-r</span></dt>
+<dd>
+	  <p>
+	    Do not read options from <code class="filename">${HOME}/.digrc</code>.
+	    This is useful for scripts that need predictable behaviour.
+	  </p>
+	</dd>
 <dt><span class="term">-t <em class="replaceable"><code>type</code></em></span></dt>
 <dd>
 	  <p>
@@ -324,8 +324,7 @@
 	    <code class="literal">94.2.0.192.in-addr.arpa</code> and sets the
 	    query type and class to PTR and IN respectively. IPv6
 	    addresses are looked up using nibble format under the
-	    IP6.ARPA domain (but see also the <code class="option">-i</code>
-	    option).
+	    IP6.ARPA domain.
 	  </p>
 	</dd>
 <dt><span class="term">-y <em class="replaceable"><code>[<span class="optional">hmac:</span>]keyname:secret</code></em></span></dt>
@@ -631,7 +630,13 @@
 	    <p>
 	      Process [do not process] IDN domain names on input.
 	      This requires IDN SUPPORT to have been enabled at
-	      compile time.  The default is to process IDN input.
+	      compile time.
+	    </p>
+	    <p>
+	      The default is to process IDN input when standard output
+	      is a tty.  The IDN processing on input is disabled when
+	      dig output is redirected to files, pipes, and other
+	      non-tty file descriptors.
 	    </p>
 	  </dd>
 <dt><span class="term"><code class="option">+[no]idnout</code></span></dt>
@@ -639,7 +644,13 @@
 	    <p>
 	      Convert [do not convert] puny code on output.
 	      This requires IDN SUPPORT to have been enabled at
-	      compile time.  The default is to convert output.
+	      compile time.
+	    </p>
+	    <p>
+	      The default is to process puny code on output when
+	      standard output is a tty.  The puny code processing on
+	      output is disabled when dig output is redirected to
+	      files, pipes, and other non-tty file descriptors.
 	    </p>
 	  </dd>
 <dt><span class="term"><code class="option">+[no]ignore</code></span></dt>
@@ -1061,7 +1072,9 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
      reply from the server.
      If you'd like to turn off the IDN support for some reason, use
      parameters <em class="parameter"><code>+noidnin</code></em> and
-      <em class="parameter"><code>+noidnout</code></em>.
+      <em class="parameter"><code>+noidnout</code></em> or define
+      the <code class="envar">IDN_DISABLE</code> environment variable.
+
    </p>
  </div>

@@ -1227,6 +1227,19 @@ create_search_list(irs_resconf_t *resconf) {
 	}
 }

+/*%
+ * Append 'addr' to the list of servers to be queried.  This function is only
+ * called when no server addresses are explicitly specified and either libirs
+ * returns an empty list of servers to use or none of the addresses returned by
+ * libirs are usable due to the specified address family restrictions.
+ */
+static void
+add_fallback_nameserver(const char *addr) {
+	dig_server_t *server = make_server(addr, addr);
+	ISC_LINK_INIT(server, link);
+	ISC_LIST_APPEND(server_list, server, link);
+}
+
 /*%
 * Setup the system as a whole, reading key information and resolv.conf
 * settings.
@@ -1272,6 +1285,16 @@ setup_system(bool ipv4only, bool ipv6only) {
 		get_server_list(resconf);
 	}

+	/* If we don't find a nameserver fall back to localhost */
+	if (ISC_LIST_EMPTY(server_list)) {
+		if (have_ipv6) {
+			add_fallback_nameserver("::1");
+		}
+		if (have_ipv4) {
+			add_fallback_nameserver("127.0.0.1");
+		}
+	}
+
 	irs_resconf_destroy(&resconf);

 #ifdef HAVE_SETLOCALE
@@ -1367,8 +1390,7 @@ setup_libs(void) {
 	isc_mempool_setfreemax(commctx, 6);
 	isc_mempool_setfillcount(commctx, 2);

-	result = isc_mutex_init(&lookup_lock);
-	check_result(result, "isc_mutex_init");
+	isc_mutex_init(&lookup_lock);
 }

 typedef struct dig_ednsoptname {
@@ -1519,17 +1541,21 @@ clear_query(dig_query_t *query) {

 	debug("clear_query(%p)", query);

-	if (query->timer != NULL)
+	if (query->timer != NULL) {
 		isc_timer_detach(&query->timer);
+	}
 	lookup = query->lookup;

-	if (lookup->current_query == query)
+	if (lookup->current_query == query) {
 		lookup->current_query = NULL;
+	}

-	if (ISC_LINK_LINKED(query, link))
+	if (ISC_LINK_LINKED(query, link)) {
 		ISC_LIST_UNLINK(lookup->q, query, link);
-	if (ISC_LINK_LINKED(query, clink))
+	}
+	if (ISC_LINK_LINKED(query, clink)) {
 		ISC_LIST_UNLINK(lookup->connecting, query, clink);
+	}
 	INSIST(query->recvspace != NULL);

 	if (query->sock != NULL) {
@@ -1541,10 +1567,13 @@ clear_query(dig_query_t *query) {
 	isc_mempool_put(commctx, query->tmpsendspace);
 	isc_buffer_invalidate(&query->recvbuf);
 	isc_buffer_invalidate(&query->lengthbuf);
-	if (query->waiting_senddone)
+
+	if (query->waiting_senddone) {
 		query->pending_free = true;
-	else
+	} else {
+		query->magic = 0;
 		isc_mem_free(mctx, query);
+	}
 }

 /*%
@@ -2284,7 +2313,7 @@ setup_lookup(dig_lookup_t *lookup) {

 		if (lookup->ecs_addr != NULL) {
 			uint8_t addr[16];
-			uint16_t family;
+			uint16_t family = 0;
 			uint32_t plen;
 			struct sockaddr *sa;
 			struct sockaddr_in *sin;
@@ -2341,6 +2370,7 @@ setup_lookup(dig_lookup_t *lookup) {
 				break;
 			default:
 				INSIST(0);
+				ISC_UNREACHABLE();
 			}

 			isc_buffer_init(&b, ecsbuf, sizeof(ecsbuf));
@@ -2452,13 +2482,14 @@ setup_lookup(dig_lookup_t *lookup) {

 	for (serv = ISC_LIST_HEAD(lookup->my_server_list);
 	     serv != NULL;
-	     serv = ISC_LIST_NEXT(serv, link)) {
+	     serv = ISC_LIST_NEXT(serv, link))
+	{
 		query = isc_mem_allocate(mctx, sizeof(dig_query_t));
-		if (query == NULL)
+		if (query == NULL) {
 			fatal("memory allocation failure in %s:%d",
 			      __FILE__, __LINE__);
-		debug("create query %p linked to lookup %p",
-		       query, lookup);
+		}
+		debug("create query %p linked to lookup %p", query, lookup);
 		query->lookup = lookup;
 		query->timer = NULL;
 		query->waiting_connect = false;
@@ -2482,16 +2513,21 @@ setup_lookup(dig_lookup_t *lookup) {
 		query->sock = NULL;
 		query->recvspace = isc_mempool_get(commctx);
 		query->tmpsendspace = isc_mempool_get(commctx);
-		if (query->recvspace == NULL)
+		if (query->recvspace == NULL) {
 			fatal("memory allocation failure");
+		}

 		isc_buffer_init(&query->recvbuf, query->recvspace, COMMSIZE);
 		isc_buffer_init(&query->lengthbuf, query->lengthspace, 2);
-		isc_buffer_init(&query->tmpsendbuf, query->tmpsendspace, COMMSIZE);
+		isc_buffer_init(&query->tmpsendbuf, query->tmpsendspace,
+				COMMSIZE);
 		query->sendbuf = lookup->renderbuf;

 		ISC_LINK_INIT(query, clink);
 		ISC_LINK_INIT(query, link);
+
+		query->magic = DIG_QUERY_MAGIC;
+
 		ISC_LIST_ENQUEUE(lookup->q, query, link);
 	}

@@ -2500,9 +2536,10 @@ setup_lookup(dig_lookup_t *lookup) {
 		extrabytes = 0;
 		dighost_printmessage(ISC_LIST_HEAD(lookup->q),
 				     lookup->sendmsg, true);
-		if (lookup->stats)
+		if (lookup->stats) {
 			printf(";; QUERY SIZE: %u\n\n",
 			       isc_buffer_usedlength(&lookup->renderbuf));
+		}
 	}
 	return (true);
 }
@@ -2528,20 +2565,26 @@ send_done(isc_task_t *_task, isc_event_t *event) {
 	INSIST(sendcount >= 0);

 	query = event->ev_arg;
+	REQUIRE(DIG_VALID_QUERY(query));
 	query->waiting_senddone = false;
 	l = query->lookup;

-	if (l->ns_search_only && !l->trace_root && !l->tcp_mode) {
+	if (!query->pending_free && l->ns_search_only &&
+	    !l->trace_root && !l->tcp_mode)
+	{
 		debug("sending next, since searching");
 		next = ISC_LIST_NEXT(query, link);
-		if (next != NULL)
+		if (next != NULL) {
 			send_udp(next);
+		}
 	}

 	isc_event_free(&event);

-	if (query->pending_free)
+	if (query->pending_free) {
+		query->magic = 0;
 		isc_mem_free(mctx, query);
+	}

 	check_if_done();
 	UNLOCK_LOOKUP;
@@ -2559,6 +2602,7 @@ cancel_lookup(dig_lookup_t *lookup) {
 	debug("cancel_lookup()");
 	query = ISC_LIST_HEAD(lookup->q);
 	while (query != NULL) {
+		REQUIRE(DIG_VALID_QUERY(query));
 		next = ISC_LIST_NEXT(query, link);
 		if (query->sock != NULL) {
 			isc_socket_cancel(query->sock, global_task,
@@ -2578,6 +2622,7 @@ bringup_timer(dig_query_t *query, unsigned int default_timeout) {
 	dig_lookup_t *l;
 	unsigned int local_timeout;
 	isc_result_t result;
+	REQUIRE(DIG_VALID_QUERY(query));

 	debug("bringup_timer()");
 	/*
@@ -2642,6 +2687,7 @@ send_tcp_connect(dig_query_t *query) {
 	isc_result_t result;
 	dig_query_t *next;
 	dig_lookup_t *l;
+	REQUIRE(DIG_VALID_QUERY(query));

 	debug("send_tcp_connect(%p)", query);

@@ -2684,27 +2730,6 @@ send_tcp_connect(dig_query_t *query) {
 		return;
 	}

-	if (specified_source &&
-	    (isc_sockaddr_pf(&query->sockaddr) !=
-	     isc_sockaddr_pf(&bind_address))) {
-		printf(";; Skipping server %s, incompatible "
-		       "address family\n", query->servname);
-		query->waiting_connect = false;
-		if (ISC_LINK_LINKED(query, link))
-			next = ISC_LIST_NEXT(query, link);
-		else
-			next = NULL;
-		l = query->lookup;
-		clear_query(query);
-		if (next == NULL) {
-			printf(";; No acceptable nameservers\n");
-			check_next_lookup(l);
-			return;
-		}
-		send_tcp_connect(next);
-		return;
-	}
-
 	INSIST(query->sock == NULL);

 	if (keep != NULL && isc_sockaddr_equal(&keepaddr, &query->sockaddr)) {
@@ -2770,6 +2795,7 @@ send_udp(dig_query_t *query) {
 	dig_query_t *next;
 	isc_region_t r;
 	isc_socketevent_t *sevent;
+	REQUIRE(DIG_VALID_QUERY(query));

 	debug("send_udp(%p)", query);

@@ -2854,6 +2880,36 @@ send_udp(dig_query_t *query) {
 	sendcount++;
 }

+/*%
+ * If there are more servers available for querying within 'lookup', initiate a
+ * TCP or UDP query to the next available server and return true; otherwise,
+ * return false.
+ */
+static bool
+try_next_server(dig_lookup_t *lookup) {
+	dig_query_t *current_query, *next_query;
+
+	current_query = lookup->current_query;
+	if (current_query == NULL || !ISC_LINK_LINKED(current_query, link)) {
+		return (false);
+	}
+
+	next_query = ISC_LIST_NEXT(current_query, link);
+	if (next_query == NULL) {
+		return (false);
+	}
+
+	debug("trying next server...");
+
+	if (lookup->tcp_mode) {
+		send_tcp_connect(next_query);
+	} else {
+		send_udp(next_query);
+	}
+
+	return (true);
+}
+
 /*%
 * IO timeout handler, used for both connect and recv timeouts.  If
 * retries are still allowed, either resend the UDP packet or queue a
@@ -2862,7 +2918,7 @@ send_udp(dig_query_t *query) {
 static void
 connect_timeout(isc_task_t *task, isc_event_t *event) {
 	dig_lookup_t *l = NULL;
-	dig_query_t *query = NULL, *cq;
+	dig_query_t *query = NULL;

 	UNUSED(task);
 	REQUIRE(event->ev_type == ISC_TIMEREVENT_IDLE);
@@ -2871,23 +2927,25 @@ connect_timeout(isc_task_t *task, isc_event_t *event) {

 	LOCK_LOOKUP;
 	query = event->ev_arg;
+	REQUIRE(DIG_VALID_QUERY(query));
 	l = query->lookup;
 	isc_event_free(&event);

 	INSIST(!free_now);

-	if ((query != NULL) && (query->lookup->current_query != NULL) &&
-	    ISC_LINK_LINKED(query->lookup->current_query, link) &&
-	    (ISC_LIST_NEXT(query->lookup->current_query, link) != NULL)) {
-		debug("trying next server...");
-		cq = query->lookup->current_query;
-		if (!l->tcp_mode)
-			send_udp(ISC_LIST_NEXT(cq, link));
-		else {
-			if (query->sock != NULL)
+	if (cancel_now) {
+		UNLOCK_LOOKUP;
+		return;
+	}
+
+	if (try_next_server(l)) {
+		if (l->tcp_mode) {
+			if (query->sock != NULL) {
 				isc_socket_cancel(query->sock, NULL,
 						  ISC_SOCKCANCEL_ALL);
-			send_tcp_connect(ISC_LIST_NEXT(cq, link));
+			} else {
+				clear_query(query);
+			}
 		}
 		UNLOCK_LOOKUP;
 		return;
@@ -2933,6 +2991,27 @@ connect_timeout(isc_task_t *task, isc_event_t *event) {
 	UNLOCK_LOOKUP;
 }

+/*%
+ * Called when a peer closes a TCP socket prematurely.
+ */
+static void
+requeue_or_update_exitcode(dig_lookup_t *lookup) {
+	if (lookup->eoferr == 0U) {
+		/*
+		 * Peer closed the connection prematurely for the first time
+		 * for this lookup.  Try again, keeping track of this failure.
+		 */
+		dig_lookup_t *requeued_lookup = requeue_lookup(lookup, true);
+		requeued_lookup->eoferr++;
+	} else {
+		/*
+		 * Peer closed the connection prematurely and it happened
+		 * previously for this lookup.  Indicate an error.
+		 */
+		exitcode = 9;
+	}
+}
+
 /*%
 * Event handler for the TCP recv which gets the length header of TCP
 * packets.  Start the next recv of length bytes.
@@ -2944,7 +3023,7 @@ tcp_length_done(isc_task_t *task, isc_event_t *event) {
 	isc_region_t r;
 	isc_result_t result;
 	dig_query_t *query = NULL;
-	dig_lookup_t *l, *n;
+	dig_lookup_t *l;
 	uint16_t length;

 	REQUIRE(event->ev_type == ISC_SOCKEVENT_RECVDONE);
@@ -2957,6 +3036,7 @@ tcp_length_done(isc_task_t *task, isc_event_t *event) {
 	LOCK_LOOKUP;
 	sevent = (isc_socketevent_t *)event;
 	query = event->ev_arg;
+	REQUIRE(DIG_VALID_QUERY(query));

 	recvcount--;
 	INSIST(recvcount >= 0);
@@ -2982,9 +3062,8 @@ tcp_length_done(isc_task_t *task, isc_event_t *event) {
 		sockcount--;
 		debug("sockcount=%d", sockcount);
 		INSIST(sockcount >= 0);
-		if (sevent->result == ISC_R_EOF && l->eoferr == 0U) {
-			n = requeue_lookup(l, true);
-			n->eoferr++;
+		if (sevent->result == ISC_R_EOF) {
+			requeue_or_update_exitcode(l);
 		}
 		isc_event_free(&event);
 		clear_query(query);
@@ -3031,6 +3110,7 @@ launch_next_query(dig_query_t *query, bool include_question) {
 	isc_result_t result;
 	dig_lookup_t *l;
 	isc_region_t r;
+	REQUIRE(DIG_VALID_QUERY(query));

 	INSIST(!free_now);

@@ -3103,6 +3183,7 @@ connect_done(isc_task_t *task, isc_event_t *event) {
 	LOCK_LOOKUP;
 	sevent = (isc_socketevent_t *)event;
 	query = sevent->ev_arg;
+	REQUIRE(DIG_VALID_QUERY(query));

 	INSIST(query->waiting_connect);

@@ -3341,7 +3422,7 @@ process_cookie(dig_lookup_t *l, dns_message_t *msg,
 	}

 	INSIST(msg->cc_ok == 0 && msg->cc_bad == 0);
-	if (optlen >= len && optlen >= 8U) {
+	if (len >= 8 && optlen >= 8U) {
 		if (isc_safe_memequal(isc_buffer_current(optbuf), sent, 8)) {
 			msg->cc_ok = 1;
 		} else {
@@ -3428,6 +3509,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 	dig_lookup_t *n, *l;
 	bool docancel = false;
 	bool match = true;
+	bool done_process_opt = false;
 	unsigned int parseflags;
 	dns_messageid_t id;
 	unsigned int msgflags;
@@ -3483,9 +3565,8 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 			debug("sockcount=%d", sockcount);
 			INSIST(sockcount >= 0);
 		}
-		if (sevent->result == ISC_R_EOF && l->eoferr == 0U) {
-			n = requeue_lookup(l, true);
-			n->eoferr++;
+		if (sevent->result == ISC_R_EOF) {
+			requeue_or_update_exitcode(l);
 		}
 		isc_event_free(&event);
 		clear_query(query);
@@ -3722,6 +3803,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 			UNLOCK_LOOKUP;
 			return;
 		}
+		done_process_opt = true;
 	}
 	if ((msg->rcode == dns_rcode_servfail && !l->servfail_stops) ||
 	    (check_ra && (msg->flags & DNS_MESSAGEFLAG_RA) == 0 && l->recurse))
@@ -3811,13 +3893,17 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 		}
 	}

-	if (l->cookie != NULL) {
-		if (msg->opt == NULL)
-			printf(";; expected opt record in response\n");
-		else
+	if (!done_process_opt) {
+		if (l->cookie != NULL) {
+			if (msg->opt == NULL) {
+				printf(";; expected opt record in response\n");
+			} else {
+				process_opt(l, msg);
+			}
+		} else if (l->sendcookie && msg->opt != NULL) {
 			process_opt(l, msg);
-	} else if (l->sendcookie && msg->opt != NULL)
-		process_opt(l, msg);
+		}
+	}
 	if (!l->doing_xfr || l->xfr_q == query) {
 		if (msg->rcode == dns_rcode_nxdomain &&
 		    (l->origin != NULL || l->need_search)) {
@@ -3994,6 +4080,7 @@ do_lookup(dig_lookup_t *lookup) {
 	lookup->pending = true;
 	query = ISC_LIST_HEAD(lookup->q);
 	if (query != NULL) {
+		REQUIRE(DIG_VALID_QUERY(query));
 		if (lookup->tcp_mode)
 			send_tcp_connect(query);
 		else
@@ -4141,7 +4228,7 @@ destroy_libs(void) {
 	}

 	UNLOCK_LOOKUP;
-	DESTROYLOCK(&lookup_lock);
+	isc_mutex_destroy(&lookup_lock);
 	debug("Removing log context");
 	isc_log_destroy(&lctx);

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000-2002, 2004, 2005, 2007-2009, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000-2002, 2004, 2005, 2007-2009, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -112,11 +112,6 @@ Print debugging traces\&. Equivalent to the
 verbose option\&.
 .RE
 .PP
-\-i
-.RS 4
-Obsolete\&. Use the IP6\&.INT domain for reverse lookups of IPv6 addresses as defined in RFC1886 and deprecated in RFC4159\&. The default is to use IP6\&.ARPA as specified in RFC3596\&.
-.RE
-.PP
 \-l
 .RS 4
 List zone: The
@@ -257,7 +252,7 @@ If
 \fBhost\fR
 has been built with IDN (internationalized domain name) support, it can accept and display non\-ASCII domain names\&.
 \fBhost\fR
-appropriately converts character encoding of domain name before sending a request to DNS server or displaying a reply from the server\&. If you\*(Aqd like to turn off the IDN support for some reason, defines the
+appropriately converts character encoding of domain name before sending a request to DNS server or displaying a reply from the server\&. If you\*(Aqd like to turn off the IDN support for some reason, define the
 \fBIDN_DISABLE\fR
 environment variable\&. The IDN support is disabled if the variable is set when
 \fBhost\fR
@@ -274,5 +269,5 @@ runs\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000-2002, 2004, 2005, 2007-2009, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000-2002, 2004, 2005, 2007-2009, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -151,6 +151,7 @@ show_usage(void) {
 "       -s a SERVFAIL response should stop query\n"
 "       -t specifies the query type\n"
 "       -T enables TCP/IP mode\n"
+"       -U enables UDP mode\n"
 "       -v enables verbose output\n"
 "       -V print version number and exit\n"
 "       -w specifies to wait forever for a reply\n"
@@ -624,28 +625,29 @@ pre_parse_args(int argc, char **argv) {
 		case 'a': break;
 		case 'A': break;
 		case 'c': break;
+		case 'C': break;
 		case 'd': break;
+		case 'D':
+			if (debugging)
+				debugtiming = true;
+			debugging = true;
+			break;
 		case 'i': break;
 		case 'l': break;
 		case 'n': break;
+		case 'N': break;
 		case 'r': break;
+		case 'R': break;
 		case 's': break;
 		case 't': break;
+		case 'T': break;
+		case 'U': break;
 		case 'v': break;
 		case 'V':
 			  version();
 			  exit(0);
 			  break;
 		case 'w': break;
-		case 'C': break;
-		case 'D':
-			if (debugging)
-				debugtiming = true;
-			debugging = true;
-			break;
-		case 'N': break;
-		case 'R': break;
-		case 'T': break;
 		case 'W': break;
 		default:
 			show_usage();
@@ -47,6 +47,7 @@
      <year>2016</year>
      <year>2017</year>
      <year>2018</year>
+      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000-2002, 2004, 2005, 2007-2009, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000-2002, 2004, 2005, 2007-2009, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -138,15 +138,6 @@
 	    Equivalent to the <code class="option">-v</code> verbose option.
 	  </p>
 	</dd>
-<dt><span class="term">-i</span></dt>
-<dd>
-	  <p>
-	    Obsolete.
-	    Use the IP6.INT domain for reverse lookups of IPv6
-	    addresses as defined in RFC1886 and deprecated in RFC4159.
-	    The default is to use IP6.ARPA as specified in RFC3596.
-	  </p>
-	</dd>
 <dt><span class="term">-l</span></dt>
 <dd>
 	  <p>
@@ -311,7 +302,7 @@
      <span class="command"><strong>host</strong></span> appropriately converts character encoding of
      domain name before sending a request to DNS server or displaying a
      reply from the server.
-      If you'd like to turn off the IDN support for some reason, defines
+      If you'd like to turn off the IDN support for some reason, define
      the <code class="envar">IDN_DISABLE</code> environment variable.
      The IDN support is disabled if the variable is set when
      <span class="command"><strong>host</strong></span> runs.
@@ -26,6 +26,7 @@
 #include <isc/formatcheck.h>
 #include <isc/lang.h>
 #include <isc/list.h>
+#include <isc/magic.h>
 #include <isc/mem.h>
 #include <isc/print.h>
 #include <isc/sockaddr.h>
@@ -81,6 +82,11 @@ typedef struct dig_server dig_server_t;
 typedef ISC_LIST(dig_server_t) dig_serverlist_t;
 typedef struct dig_searchlist dig_searchlist_t;

+#define DIG_QUERY_MAGIC		ISC_MAGIC('D','i','g','q')
+
+#define DIG_VALID_QUERY(x)	ISC_MAGIC_VALID((x), DIG_QUERY_MAGIC)
+
+
 /*% The dig_lookup structure */
 struct dig_lookup {
 	bool
@@ -184,6 +190,7 @@ struct dig_lookup {

 /*% The dig_query structure */
 struct dig_query {
+	unsigned int magic;
 	dig_lookup_t *lookup;
 	bool waiting_connect,
 		pending_free,
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004-2007, 2010, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2007, 2010, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -277,6 +277,17 @@ Try the next nameserver if a nameserver responds with SERVFAIL or a referral (no
 .PP
 \fBnslookup\fR
 returns with an exit status of 1 if any query failed, and 0 otherwise\&.
+.SH "IDN SUPPORT"
+.PP
+If
+\fBnslookup\fR
+has been built with IDN (internationalized domain name) support, it can accept and display non\-ASCII domain names\&.
+\fBnslookup\fR
+appropriately converts character encoding of domain name before sending a request to DNS server or displaying a reply from the server\&. If you\*(Aqd like to turn off the IDN support for some reason, define the
+\fBIDN_DISABLE\fR
+environment variable\&. The IDN support is disabled if the variable is set when
+\fBnslookup\fR
+runs or when the standard output is not a tty\&.
 .SH "FILES"
 .PP
 /etc/resolv\&.conf
@@ -290,5 +301,5 @@ returns with an exit status of 1 if any query failed, and 0 otherwise\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2004-2007, 2010, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004-2007, 2010, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -879,12 +879,29 @@ get_next_command(void) {
 	isc_mem_free(mctx, buf);
 }

+ISC_PLATFORM_NORETURN_PRE static void
+usage(void) ISC_PLATFORM_NORETURN_POST;
+
+static void
+usage(void) {
+    fprintf(stderr, "Usage:\n");
+    fprintf(stderr,
+"   nslookup [-opt ...]             # interactive mode using default server\n");
+    fprintf(stderr,
+"   nslookup [-opt ...] - server    # interactive mode using 'server'\n");
+    fprintf(stderr,
+"   nslookup [-opt ...] host        # just look up 'host' using default server\n");
+    fprintf(stderr,
+"   nslookup [-opt ...] host server # just look up 'host' using 'server'\n");
+    exit(1);
+}
+
 static void
 parse_args(int argc, char **argv) {
 	bool have_lookup = false;

 	usesearch = true;
-	for (argc--, argv++; argc > 0; argc--, argv++) {
+	for (argc--, argv++; argc > 0 && argv[0] != NULL; argc--, argv++) {
 		debug("main parsing %s", argv[0]);
 		if (argv[0][0] == '-') {
 			if (strncasecmp(argv[0], "-ver", 4) == 0) {
@@ -900,6 +917,9 @@ parse_args(int argc, char **argv) {
 				in_use = true;
 				addlookup(argv[0]);
 			} else {
+				if (argv[1] != NULL) {
+					usage();
+				}
 				set_nameserver(argv[0]);
 				check_ra = false;
 			}
@@ -71,6 +71,7 @@
      <year>2016</year>
      <year>2017</year>
      <year>2018</year>
+      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2004-2007, 2010, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2007, 2010, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -362,14 +362,31 @@ nslookup -query=hinfo  -timeout=10
  </div>

  <div class="refsection">
-<a name="id-1.11"></a><h2>FILES</h2>
+<a name="id-1.11"></a><h2>IDN SUPPORT</h2>
+
+    <p>
+      If <span class="command"><strong>nslookup</strong></span> has been built with IDN (internationalized
+      domain name) support, it can accept and display non-ASCII domain names.
+      <span class="command"><strong>nslookup</strong></span> appropriately converts character encoding of
+      domain name before sending a request to DNS server or displaying a
+      reply from the server.
+      If you'd like to turn off the IDN support for some reason, define
+      the <code class="envar">IDN_DISABLE</code> environment variable.
+      The IDN support is disabled if the variable is set when
+      <span class="command"><strong>nslookup</strong></span> runs or when the standard output is not
+      a tty.
+    </p>
+  </div>
+
+  <div class="refsection">
+<a name="id-1.12"></a><h2>FILES</h2>

    <p><code class="filename">/etc/resolv.conf</code>
    </p>
  </div>

  <div class="refsection">
-<a name="id-1.12"></a><h2>SEE ALSO</h2>
+<a name="id-1.13"></a><h2>SEE ALSO</h2>

    <p><span class="citerefentry">
        <span class="refentrytitle">dig</span>(1)
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2017, 2018 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2017-2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -102,7 +102,7 @@ Specify a digest algorithm to use when converting CDNSKEY records to DS records\
 .sp
 The
 \fIalgorithm\fR
-must be one of SHA\-1 (SHA1), SHA\-256 (SHA256), or SHA\-384 (SHA384)\&. These values are case insensitive\&. If no algorithm is specified, the default is SHA\-256\&.
+must be one of SHA\-1, SHA\-256, or SHA\-384\&. These values are case insensitive, and the hyphen may be omitted\&. If no algorithm is specified, the default is SHA\-256\&.
 .RE
 .PP
 \-c \fIclass\fR
@@ -293,5 +293,5 @@ RFC 7344\&.
 .RE
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2017, 2018 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2017-2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -163,8 +163,8 @@ verbose_time(int level, const char *msg, isc_stdtime_t time) {
 	if (verbose < 3) {
 		vbprintf(level, "%s %s\n", msg, timestr);
 	} else {
-		vbprintf(level, "%s %s (%lld)\n",
-			 msg, timestr, (long long)time);
+		vbprintf(level, "%s %s (%" PRIu32 ")\n",
+			 msg, timestr, time);
 	}
 }

@@ -482,7 +482,6 @@ match_key_dsset(keyinfo_t *ki, dns_rdataset_t *dsset, strictness_t strictness)
 		dns_rdata_ds_t ds;
 		dns_rdata_t dsrdata = DNS_RDATA_INIT;
 		dns_rdata_t newdsrdata = DNS_RDATA_INIT;
-		dns_rdatatype_t keytype;
 		bool c;

 		dns_rdataset_current(dsset, &dsrdata);
@@ -493,12 +492,8 @@ match_key_dsset(keyinfo_t *ki, dns_rdataset_t *dsset, strictness_t strictness)
 			continue;
 		}

-		/* allow for both DNSKEY and CDNSKEY */
-		keytype = ki->rdata.type;
-		ki->rdata.type = dns_rdatatype_dnskey;
 		result = dns_ds_buildrdata(name, &ki->rdata, ds.digest_type,
 					   dsbuf, &newdsrdata);
-		ki->rdata.type = keytype;
 		if (result != ISC_R_SUCCESS) {
 			vbprintf(3, "dns_ds_buildrdata("
 				 "keytag=%d, algo=%d, digest=%d): %s\n",
@@ -573,7 +568,7 @@ match_keyset_dsset(dns_rdataset_t *keyset, dns_rdataset_t *dsset,
 		ki->algo = dnskey.algorithm;

 		dns_rdata_toregion(keyrdata, &r);
-		ki->tag = dst_region_computeid(&r, ki->algo);
+		ki->tag = dst_region_computeid(&r);

 		ki->dst = NULL;
 		if (!match_key_dsset(ki, dsset, strictness)) {
@@ -826,7 +821,6 @@ ds_from_cdnskey(dns_rdatalist_t *dslist, isc_buffer_t *buf,
 				return (ISC_R_NOSPACE);
 			}

-			cdnskey->type = dns_rdatatype_dnskey;
 			rdata = rdata_get();
 			result = dns_ds_buildrdata(name, cdnskey, dtype[i],
 						   r.base, rdata);
@@ -40,6 +40,7 @@
    <copyright>
      <year>2017</year>
      <year>2018</year>
+      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -143,9 +144,9 @@
 	    record. This option has no effect when using CDS records.
          </para>
          <para>
-	    The <replaceable>algorithm</replaceable> must be one of SHA-1
-	    (SHA1), SHA-256 (SHA256), or SHA-384 (SHA384). These
-	    values are case insensitive. If no algorithm is specified,
+	    The <replaceable>algorithm</replaceable> must be one of
+	    SHA-1, SHA-256, or SHA-384.  These values are case insensitive,
+	    and the hyphen may be omitted.  If no algorithm is specified,
 	    the default is SHA-256.
          </para>
        </listitem>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2017, 2018 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2017-2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -129,9 +129,9 @@
 	    record. This option has no effect when using CDS records.
          </p>
          <p>
-	    The <em class="replaceable"><code>algorithm</code></em> must be one of SHA-1
-	    (SHA1), SHA-256 (SHA256), or SHA-384 (SHA384). These
-	    values are case insensitive. If no algorithm is specified,
+	    The <em class="replaceable"><code>algorithm</code></em> must be one of
+	    SHA-1, SHA-256, or SHA-384.  These values are case insensitive,
+	    and the hyphen may be omitted.  If no algorithm is specified,
 	    the default is SHA-256.
          </p>
        </dd>
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2008-2012, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2008-2012, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -39,61 +39,103 @@
 dnssec-dsfromkey \- DNSSEC DS RR generation tool
 .SH "SYNOPSIS"
 .HP \w'\fBdnssec\-dsfromkey\fR\ 'u
-\fBdnssec\-dsfromkey\fR [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-1\fR] [\fB\-2\fR] [\fB\-a\ \fR\fB\fIalg\fR\fR] [\fB\-C\fR] [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-T\ \fR\fB\fITTL\fR\fR] {keyfile}
+\fBdnssec\-dsfromkey\fR [\fB\-1\fR | \fB\-2\fR | \fB\-a\ \fR\fB\fIalg\fR\fR] [\fB\-C\fR | \fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-T\ \fR\fB\fITTL\fR\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] {keyfile}
 .HP \w'\fBdnssec\-dsfromkey\fR\ 'u
-\fBdnssec\-dsfromkey\fR {\-s} [\fB\-1\fR] [\fB\-2\fR] [\fB\-a\ \fR\fB\fIalg\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-s\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-T\ \fR\fB\fITTL\fR\fR] [\fB\-f\ \fR\fB\fIfile\fR\fR] [\fB\-A\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] {dnsname}
+\fBdnssec\-dsfromkey\fR [\fB\-1\fR | \fB\-2\fR | \fB\-a\ \fR\fB\fIalg\fR\fR] [\fB\-C\fR | \fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-T\ \fR\fB\fITTL\fR\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-A\fR] {\fB\-f\ \fR\fB\fIfile\fR\fR} [dnsname]
 .HP \w'\fBdnssec\-dsfromkey\fR\ 'u
-\fBdnssec\-dsfromkey\fR [\fB\-h\fR] [\fB\-V\fR]
+\fBdnssec\-dsfromkey\fR [\fB\-1\fR | \fB\-2\fR | \fB\-a\ \fR\fB\fIalg\fR\fR] [\fB\-C\fR | \fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-T\ \fR\fB\fITTL\fR\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] {\-s} {dnsname}
+.HP \w'\fBdnssec\-dsfromkey\fR\ 'u
+\fBdnssec\-dsfromkey\fR [\fB\-h\fR | \fB\-V\fR]
 .SH "DESCRIPTION"
 .PP
+The
 \fBdnssec\-dsfromkey\fR
-outputs the Delegation Signer (DS) resource record (RR), as defined in RFC 3658 and RFC 4509, for the given key(s)\&.
+command outputs DS (Delegation Signer) resource records (RRs) and other similarly\-constructed RRs: with the
+\fB\-l\fR
+option it outputs DLV (DNSSEC Lookaside Validation) RRs; or with the
+\fB\-C\fR
+it outputs CDS (Child DS) RRs\&.
+.PP
+The input keys can be specified in a number of ways:
+.PP
+By default,
+\fBdnssec\-dsfromkey\fR
+reads a key file named like
+Knnnn\&.+aaa+iiiii\&.key, as generated by
+\fBdnssec\-keygen\fR\&.
+.PP
+With the
+\fB\-f \fR\fB\fIfile\fR\fR
+option,
+\fBdnssec\-dsfromkey\fR
+reads keys from a zone file or partial zone file (which can contain just the DNSKEY records)\&.
+.PP
+With the
+\fB\-s\fR
+option,
+\fBdnssec\-dsfromkey\fR
+reads a
+keyset\-
+file, as generated by
+\fBdnssec\-keygen\fR\fB\-C\fR\&.
 .SH "OPTIONS"
 .PP
 \-1
 .RS 4
-Use SHA\-1 as the digest algorithm (the default is to use both SHA\-1 and SHA\-256)\&.
+An abbreviation for
+\fB\-a SHA1\fR
 .RE
 .PP
 \-2
 .RS 4
-Use SHA\-256 as the digest algorithm\&.
+An abbreviation for
+\fB\-a SHA\-256\fR
 .RE
 .PP
 \-a \fIalgorithm\fR
 .RS 4
-Select the digest algorithm\&. The value of
-\fBalgorithm\fR
-must be one of SHA\-1 (SHA1), SHA\-256 (SHA256) or SHA\-384 (SHA384)\&. These values are case insensitive\&.
+Specify a digest algorithm to use when converting DNSKEY records to DS records\&. This option can be repeated, so that multiple DS records are created for each DNSKEY record\&.
+.sp
+The
+\fIalgorithm\fR
+must be one of SHA\-1, SHA\-256, or SHA\-384\&. These values are case insensitive, and the hyphen may be omitted\&. If no algorithm is specified, the default is SHA\-256\&.
+.RE
+.PP
+\-A
+.RS 4
+Include ZSKs when generating DS records\&. Without this option, only keys which have the KSK flag set will be converted to DS records and printed\&. Useful only in
+\fB\-f\fR
+zone file mode\&.
+.RE
+.PP
+\-c \fIclass\fR
+.RS 4
+Specifies the DNS class (default is IN)\&. Useful only in
+\fB\-s\fR
+keyset or
+\fB\-f\fR
+zone file mode\&.
 .RE
 .PP
 \-C
 .RS 4
-Generate CDS records rather than DS records\&. This is mutually exclusive with generating lookaside records\&.
-.RE
-.PP
-\-T \fITTL\fR
-.RS 4
-Specifies the TTL of the DS records\&.
-.RE
-.PP
-\-K \fIdirectory\fR
-.RS 4
-Look for key files (or, in keyset mode,
-keyset\-
-files) in
-\fBdirectory\fR\&.
+Generate CDS records rather than DS records\&. This is mutually exclusive with the
+\fB\-l\fR
+option for generating DLV records\&.
 .RE
 .PP
 \-f \fIfile\fR
 .RS 4
-Zone file mode: in place of the keyfile name, the argument is the DNS domain name of a zone master file, which can be read from
+Zone file mode:
+\fBdnssec\-dsfromkey\fR\*(Aqs final
+\fIdnsname\fR
+argument is the DNS domain name of a zone whose master file can be read from
 \fBfile\fR\&. If the zone name is the same as
 \fBfile\fR, then it may be omitted\&.
 .sp
 If
-\fBfile\fR
-is set to
+\fIfile\fR
+is
 "\-", then the zone data is read from the standard input\&. This makes it possible to use the output of the
 \fBdig\fR
 command as input, as in:
@@ -101,26 +143,41 @@ command as input, as in:
 \fBdig dnskey example\&.com | dnssec\-dsfromkey \-f \- example\&.com\fR
 .RE
 .PP
-\-A
+\-h
 .RS 4
-Include ZSKs when generating DS records\&. Without this option, only keys which have the KSK flag set will be converted to DS records and printed\&. Useful only in zone file mode\&.
+Prints usage information\&.
+.RE
+.PP
+\-K \fIdirectory\fR
+.RS 4
+Look for key files or
+keyset\-
+files in
+\fBdirectory\fR\&.
 .RE
 .PP
 \-l \fIdomain\fR
 .RS 4
 Generate a DLV set instead of a DS set\&. The specified
-\fBdomain\fR
-is appended to the name for each record in the set\&. The DNSSEC Lookaside Validation (DLV) RR is described in RFC 4431\&. This is mutually exclusive with generating CDS records\&.
+\fIdomain\fR
+is appended to the name for each record in the set\&. This is mutually exclusive with the
+\fB\-C\fR
+option for generating CDS records\&.
 .RE
 .PP
 \-s
 .RS 4
-Keyset mode: in place of the keyfile name, the argument is the DNS domain name of a keyset file\&.
+Keyset mode:
+\fBdnssec\-dsfromkey\fR\*(Aqs final
+\fIdnsname\fR
+argument is the DNS domain name used to locate a
+keyset\-
+file\&.
 .RE
 .PP
-\-c \fIclass\fR
+\-T \fITTL\fR
 .RS 4
-Specifies the DNS class (default is IN)\&. Useful only in keyset or zone file mode\&.
+Specifies the TTL of the DS records\&. By default the TTL is omitted\&.
 .RE
 .PP
 \-v \fIlevel\fR
@@ -128,11 +185,6 @@ Specifies the DNS class (default is IN)\&. Useful only in keyset or zone file mo
 Sets the debugging level\&.
 .RE
 .PP
-\-h
-.RS 4
-Prints usage information\&.
-.RE
-.PP
 \-V
 .RS 4
 Prints version information\&.
@@ -141,16 +193,16 @@ Prints version information\&.
 .PP
 To build the SHA\-256 DS RR from the
 \fBKexample\&.com\&.+003+26160\fR
-keyfile name, the following command would be issued:
+keyfile name, you can issue the following command:
 .PP
 \fBdnssec\-dsfromkey \-2 Kexample\&.com\&.+003+26160\fR
 .PP
 The command would print something like:
 .PP
-\fBexample\&.com\&. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0 C5EA0B94\fR
+\fBexample\&.com\&. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0C5EA0B94\fR
 .SH "FILES"
 .PP
-The keyfile can be designed by the key identification
+The keyfile can be designated by the key identification
 Knnnn\&.+aaa+iiiii
 or the full file name
 Knnnn\&.+aaa+iiiii\&.key
@@ -170,13 +222,20 @@ A keyfile error can give a "file not found" even if the file exists\&.
 \fBdnssec-keygen\fR(8),
 \fBdnssec-signzone\fR(8),
 BIND 9 Administrator Reference Manual,
-RFC 3658,
-RFC 4431\&.
-RFC 4509\&.
+RFC 3658
+(DS RRs),
+RFC 4431
+(DLV RRs),
+RFC 4509
+(SHA\-256 for DS RRs),
+RFC 6605
+(SHA\-384 for DS RRs),
+RFC 7344
+(CDS and CDNSKEY RRs)\&.
 .SH "AUTHOR"
 .PP
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2008-2012, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2008-2012, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -318,30 +318,27 @@ usage(void) ISC_PLATFORM_NORETURN_POST;
 static void
 usage(void) {
 	fprintf(stderr, "Usage:\n");
-	fprintf(stderr,	"    %s options [-K dir] keyfile\n\n", program);
-	fprintf(stderr, "    %s options [-K dir] [-c class] -s dnsname\n\n",
-		program);
-	fprintf(stderr, "    %s options -f zonefile (as zone name)\n\n", program);
-	fprintf(stderr, "    %s options -f zonefile zonename\n\n", program);
+	fprintf(stderr,	"    %s [options] keyfile\n\n", program);
+	fprintf(stderr, "    %s [options] -f zonefile [zonename]\n\n", program);
+	fprintf(stderr, "    %s [options] -s dnsname\n\n", program);
+	fprintf(stderr, "    %s [-h|-V]\n\n", program);
 	fprintf(stderr, "Version: %s\n", VERSION);
-	fprintf(stderr, "Options:\n");
-	fprintf(stderr, "    -v <verbose level>\n");
-	fprintf(stderr, "    -V: print version information\n");
-	fprintf(stderr, "    -K <directory>: directory in which to find "
-			"key file or keyset file\n");
-	fprintf(stderr, "    -a algorithm: digest algorithm "
-			"(SHA-1, SHA-256, GOST or SHA-384)\n");
-	fprintf(stderr, "    -1: use SHA-1\n");
-	fprintf(stderr, "    -2: use SHA-256\n");
-	fprintf(stderr, "    -C: print CDS record\n");
-	fprintf(stderr, "    -l: add lookaside zone and print DLV records\n");
-	fprintf(stderr, "    -s: read keyset from keyset-<dnsname> file\n");
-	fprintf(stderr, "    -c class: rdata class for DS set (default: IN)\n");
-	fprintf(stderr, "    -T TTL\n");
-	fprintf(stderr, "    -f file: read keyset from zone file\n");
-	fprintf(stderr, "    -A: when used with -f, "
-			"include all keys in DS set, not just KSKs\n");
-	fprintf(stderr, "Output: DS or DLV RRs\n");
+	fprintf(stderr, "Options:\n"
+"    -1: digest algorithm SHA-1\n"
+"    -2: digest algorithm SHA-256\n"
+"    -a algorithm: digest algorithm (SHA-1, SHA-256 or SHA-384)\n"
+"    -A: include all keys in DS set, not just KSKs (-f only)\n"
+"    -c class: rdata class for DS set (default IN) (-f or -s only)\n"
+"    -C: print CDS records\n"
+"    -f zonefile: read keys from a zone file\n"
+"    -h: print help information\n"
+"    -K directory: where to find key or keyset files\n"
+"    -l zone: print DLV records in the given lookaside zone\n"
+"    -s: read keys from keyset-<dnsname> file\n"
+"    -T: TTL of output records (omitted by default)\n"
+"    -v level: verbosity\n"
+"    -V: print version information\n");
+	fprintf(stderr, "Output: DS, DLV, or CDS RRs\n");

 	exit (-1);
 }
@@ -41,6 +41,7 @@
      <year>2015</year>
      <year>2016</year>
      <year>2018</year>
+      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -48,56 +49,108 @@
  <refsynopsisdiv>
    <cmdsynopsis sepchar=" ">
      <command>dnssec-dsfromkey</command>
-      <arg choice="opt" rep="norepeat"><option>-v <replaceable class="parameter">level</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-1</option></arg>
-      <arg choice="opt" rep="norepeat"><option>-2</option></arg>
-      <arg choice="opt" rep="norepeat"><option>-a <replaceable class="parameter">alg</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-C</option></arg>
-      <arg choice="opt" rep="norepeat"><option>-l <replaceable class="parameter">domain</replaceable></option></arg>
+      <group choice="opt">
+	<arg choice="plain"><option>-1</option></arg>
+	<arg choice="plain"><option>-2</option></arg>
+	<arg choice="plain"><option>-a <replaceable class="parameter">alg</replaceable></option></arg>
+      </group>
+      <group>
+	<arg choice="plain" rep="norepeat"><option>-C</option></arg>
+	<arg choice="plain" rep="norepeat"><option>-l <replaceable class="parameter">domain</replaceable></option></arg>
+      </group>
      <arg choice="opt" rep="norepeat"><option>-T <replaceable class="parameter">TTL</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-v <replaceable class="parameter">level</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-K <replaceable class="parameter">directory</replaceable></option></arg>
      <arg choice="req" rep="norepeat">keyfile</arg>
    </cmdsynopsis>
    <cmdsynopsis sepchar=" ">
      <command>dnssec-dsfromkey</command>
-      <arg choice="req" rep="norepeat">-s</arg>
-      <arg choice="opt" rep="norepeat"><option>-1</option></arg>
-      <arg choice="opt" rep="norepeat"><option>-2</option></arg>
-      <arg choice="opt" rep="norepeat"><option>-a <replaceable class="parameter">alg</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-K <replaceable class="parameter">directory</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-l <replaceable class="parameter">domain</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-s</option></arg>
-      <arg choice="opt" rep="norepeat"><option>-c <replaceable class="parameter">class</replaceable></option></arg>
+      <group choice="opt">
+	<arg choice="plain"><option>-1</option></arg>
+	<arg choice="plain"><option>-2</option></arg>
+	<arg choice="plain"><option>-a <replaceable class="parameter">alg</replaceable></option></arg>
+      </group>
+      <group>
+	<arg choice="plain" rep="norepeat"><option>-C</option></arg>
+	<arg choice="plain" rep="norepeat"><option>-l <replaceable class="parameter">domain</replaceable></option></arg>
+      </group>
      <arg choice="opt" rep="norepeat"><option>-T <replaceable class="parameter">TTL</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-f <replaceable class="parameter">file</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-A</option></arg>
      <arg choice="opt" rep="norepeat"><option>-v <replaceable class="parameter">level</replaceable></option></arg>
-      <arg choice="req" rep="norepeat">dnsname</arg>
-   </cmdsynopsis>
+      <arg choice="opt" rep="norepeat"><option>-c <replaceable class="parameter">class</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-A</option></arg>
+      <arg choice="req" rep="norepeat"><option>-f <replaceable class="parameter">file</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat">dnsname</arg>
+    </cmdsynopsis>
    <cmdsynopsis sepchar=" ">
      <command>dnssec-dsfromkey</command>
-      <arg choice="opt" rep="norepeat"><option>-h</option></arg>
-      <arg choice="opt" rep="norepeat"><option>-V</option></arg>
-   </cmdsynopsis>
+      <group choice="opt">
+	<arg choice="plain"><option>-1</option></arg>
+	<arg choice="plain"><option>-2</option></arg>
+	<arg choice="plain"><option>-a <replaceable class="parameter">alg</replaceable></option></arg>
+      </group>
+      <group>
+	<arg choice="plain" rep="norepeat"><option>-C</option></arg>
+	<arg choice="plain" rep="norepeat"><option>-l <replaceable class="parameter">domain</replaceable></option></arg>
+      </group>
+      <arg choice="opt" rep="norepeat"><option>-T <replaceable class="parameter">TTL</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-v <replaceable class="parameter">level</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-c <replaceable class="parameter">class</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-K <replaceable class="parameter">directory</replaceable></option></arg>
+      <arg choice="req" rep="norepeat">-s</arg>
+      <arg choice="req" rep="norepeat">dnsname</arg>
+    </cmdsynopsis>
+    <cmdsynopsis sepchar=" ">
+      <command>dnssec-dsfromkey</command>
+      <group choice="opt">
+	<arg choice="plain" rep="norepeat"><option>-h</option></arg>
+	<arg choice="plain" rep="norepeat"><option>-V</option></arg>
+      </group>
+    </cmdsynopsis>
  </refsynopsisdiv>

  <refsection><info><title>DESCRIPTION</title></info>

-    <para><command>dnssec-dsfromkey</command>
-      outputs the Delegation Signer (DS) resource record (RR), as defined in
-      RFC 3658 and RFC 4509, for the given key(s).
+    <para>
+      The <command>dnssec-dsfromkey</command> command outputs DS (Delegation
+      Signer) resource records (RRs) and other similarly-constructed RRs:
+      with the <option>-l</option> option it outputs DLV (DNSSEC Lookaside
+      Validation) RRs; or with the <option>-C</option> it outputs CDS (Child
+      DS) RRs.
    </para>
+
+    <para>
+      The input keys can be specified in a number of ways:
+    </para>
+
+    <para>
+      By default, <command>dnssec-dsfromkey</command> reads a key file
+      named like <filename>Knnnn.+aaa+iiiii.key</filename>, as generated
+      by <command>dnssec-keygen</command>.
+    </para>
+
+    <para>
+      With the <option>-f <replaceable>file</replaceable></option>
+      option, <command>dnssec-dsfromkey</command> reads keys from a zone file
+      or partial zone file (which can contain just the DNSKEY records).
+    </para>
+
+    <para>
+      With the <option>-s</option>
+      option, <command>dnssec-dsfromkey</command> reads
+      a <filename>keyset-</filename> file, as generated
+      by <command>dnssec-keygen</command> <option>-C</option>.
+    </para>
+
  </refsection>

  <refsection><info><title>OPTIONS</title></info>

-
    <variablelist>
      <varlistentry>
 	<term>-1</term>
 	<listitem>
 	  <para>
-	    Use SHA-1 as the digest algorithm (the default is to use
-	    both SHA-1 and SHA-256).
+	    An abbreviation for <option>-a SHA1</option>
 	  </para>
 	</listitem>
      </varlistentry>
@@ -106,7 +159,7 @@
 	<term>-2</term>
 	<listitem>
 	  <para>
-	    Use SHA-256 as the digest algorithm.
+	    An abbreviation for <option>-a SHA-256</option>
 	  </para>
 	</listitem>
      </varlistentry>
@@ -115,40 +168,49 @@
 	<term>-a <replaceable class="parameter">algorithm</replaceable></term>
 	<listitem>
 	  <para>
-	    Select the digest algorithm. The value of
-	    <option>algorithm</option> must be one of SHA-1 (SHA1),
-	    SHA-256 (SHA256) or SHA-384 (SHA384).
-	    These values are case insensitive.
+	    Specify a digest algorithm to use when converting DNSKEY
+	    records to DS records. This option can be repeated, so
+	    that multiple DS records are created for each DNSKEY
+	    record.
+          </para>
+          <para>
+	    The <replaceable>algorithm</replaceable> must be one of
+	    SHA-1, SHA-256, or SHA-384.  These values are case insensitive,
+	    and the hyphen may be omitted.  If no algorithm is specified,
+	    the default is SHA-256.
 	  </para>
 	</listitem>
      </varlistentry>

+      <varlistentry>
+        <term>-A</term>
+        <listitem>
+          <para>
+            Include ZSKs when generating DS records. Without this option, only
+            keys which have the KSK flag set will be converted to DS records
+            and printed. Useful only in <option>-f</option> zone file mode.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+	<term>-c <replaceable class="parameter">class</replaceable></term>
+	<listitem>
+	  <para>
+	    Specifies the DNS class (default is IN). Useful only
+	    in <option>-s</option> keyset or <option>-f</option>
+	    zone file mode.
+	  </para>
+	  </listitem>
+      </varlistentry>
+
      <varlistentry>
 	<term>-C</term>
 	<listitem>
 	  <para>
-	    Generate CDS records rather than DS records.  This is mutually
-	    exclusive with generating lookaside records.
-	  </para>
-	</listitem>
-      </varlistentry>
-
-      <varlistentry>
-	<term>-T <replaceable class="parameter">TTL</replaceable></term>
-	<listitem>
-	  <para>
-	    Specifies the TTL of the DS records.
-	  </para>
-	  </listitem>
-      </varlistentry>
-
-      <varlistentry>
-	<term>-K <replaceable class="parameter">directory</replaceable></term>
-	<listitem>
-	  <para>
-	    Look for key files (or, in keyset mode,
-	    <filename>keyset-</filename> files) in
-	    <option>directory</option>.
+	    Generate CDS records rather than DS records. This is mutually
+	    exclusive with the <option>-l</option> option for generating DLV
+	    records.
 	  </para>
 	</listitem>
      </varlistentry>
@@ -157,13 +219,14 @@
 	<term>-f <replaceable class="parameter">file</replaceable></term>
 	<listitem>
 	  <para>
-	    Zone file mode: in place of the keyfile name, the argument is
-	    the DNS domain name of a zone master file, which can be read
+	    Zone file mode: <command>dnssec-dsfromkey</command>'s
+	    final <replaceable>dnsname</replaceable> argument is
+	    the DNS domain name of a zone whose master file can be read
 	    from <option>file</option>.  If the zone name is the same as
 	    <option>file</option>, then it may be omitted.
 	  </para>
 	  <para>
-	    If <option>file</option> is set to <literal>"-"</literal>, then
+	    If <replaceable>file</replaceable> is <literal>"-"</literal>, then
 	    the zone data is read from the standard input.  This makes it
 	    possible to use the output of the <command>dig</command>
 	    command as input, as in:
@@ -175,26 +238,33 @@
      </varlistentry>

      <varlistentry>
-        <term>-A</term>
-        <listitem>
-          <para>
-            Include ZSKs when generating DS records.  Without this option,
-            only keys which have the KSK flag set will be converted to DS
-            records and printed.  Useful only in zone file mode.
-          </para>
-        </listitem>
+	<term>-h</term>
+	<listitem>
+	  <para>
+	    Prints usage information.
+	  </para>
+	</listitem>
+      </varlistentry>
+
+      <varlistentry>
+	<term>-K <replaceable class="parameter">directory</replaceable></term>
+	<listitem>
+	  <para>
+	    Look for key files or <filename>keyset-</filename> files in
+	    <option>directory</option>.
+	  </para>
+	</listitem>
      </varlistentry>

      <varlistentry>
 	<term>-l <replaceable class="parameter">domain</replaceable></term>
 	<listitem>
 	  <para>
-	    Generate a DLV set instead of a DS set.  The specified
-	    <option>domain</option> is appended to the name for each
+	    Generate a DLV set instead of a DS set. The specified
+	    <replaceable>domain</replaceable> is appended to the name for each
 	    record in the set.
-	    The DNSSEC Lookaside Validation (DLV) RR is described
-	    in RFC 4431.  This is mutually exclusive with generating
-	    CDS records.
+	    This is mutually exclusive with the <option>-C</option> option
+	    for generating CDS records.
 	  </para>
 	</listitem>
      </varlistentry>
@@ -203,18 +273,18 @@
 	<term>-s</term>
 	<listitem>
 	  <para>
-	    Keyset mode: in place of the keyfile name, the argument is
-	    the DNS domain name of a keyset file.
+	    Keyset mode: <command>dnssec-dsfromkey</command>'s
+	    final <replaceable>dnsname</replaceable> argument is the DNS
+	    domain name used to locate a <filename>keyset-</filename> file.
 	  </para>
 	</listitem>
      </varlistentry>

      <varlistentry>
-	<term>-c <replaceable class="parameter">class</replaceable></term>
+	<term>-T <replaceable class="parameter">TTL</replaceable></term>
 	<listitem>
 	  <para>
-	    Specifies the DNS class (default is IN).  Useful only
-	    in keyset or zone file mode.
+	    Specifies the TTL of the DS records. By default the TTL is omitted.
 	  </para>
 	  </listitem>
      </varlistentry>
@@ -228,15 +298,6 @@
 	</listitem>
      </varlistentry>

-      <varlistentry>
-	<term>-h</term>
-	<listitem>
-	  <para>
-	    Prints usage information.
-	  </para>
-	</listitem>
-      </varlistentry>
-
      <varlistentry>
 	<term>-V</term>
 	<listitem>
@@ -253,21 +314,22 @@
    <para>
      To build the SHA-256 DS RR from the
      <userinput>Kexample.com.+003+26160</userinput>
-      keyfile name, the following command would be issued:
+      keyfile name, you can issue the following command:
    </para>
    <para><userinput>dnssec-dsfromkey -2 Kexample.com.+003+26160</userinput>
    </para>
    <para>
      The command would print something like:
    </para>
-    <para><userinput>example.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0 C5EA0B94</userinput>
+    <para><userinput>example.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0C5EA0B94</userinput>
    </para>
+
  </refsection>

  <refsection><info><title>FILES</title></info>

    <para>
-      The keyfile can be designed by the key identification
+      The keyfile can be designated by the key identification
      <filename>Knnnn.+aaa+iiiii</filename> or the full file name
      <filename>Knnnn.+aaa+iiiii.key</filename> as generated by
      <refentrytitle>dnssec-keygen</refentrytitle><manvolnum>8</manvolnum>.
@@ -295,9 +357,11 @@
 	<refentrytitle>dnssec-signzone</refentrytitle><manvolnum>8</manvolnum>
      </citerefentry>,
      <citetitle>BIND 9 Administrator Reference Manual</citetitle>,
-      <citetitle>RFC 3658</citetitle>,
-      <citetitle>RFC 4431</citetitle>.
-      <citetitle>RFC 4509</citetitle>.
+      <citetitle>RFC 3658</citetitle> (DS RRs),
+      <citetitle>RFC 4431</citetitle> (DLV RRs),
+      <citetitle>RFC 4509</citetitle> (SHA-256 for DS RRs),
+      <citetitle>RFC 6605</citetitle> (SHA-384 for DS RRs),
+      <citetitle>RFC 7344</citetitle> (CDS and CDNSKEY RRs).
    </para>
  </refsection>

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2008-2012, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2008-2012, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -33,105 +33,167 @@
 <h2>Synopsis</h2>
    <div class="cmdsynopsis"><p>
      <code class="command">dnssec-dsfromkey</code> 
-       [<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
-       [<code class="option">-1</code>]
-       [<code class="option">-2</code>]
-       [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>]
-       [<code class="option">-C</code>]
-       [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>]
+       [
+	 <code class="option">-1</code> 
+	 |   <code class="option">-2</code> 
+	 |   <code class="option">-a <em class="replaceable"><code>alg</code></em></code> 
+      ]
+       [
+	 <code class="option">-C</code> 
+	 |   <code class="option">-l <em class="replaceable"><code>domain</code></em></code> 
+      ]
       [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>]
+       [<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
+       [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>]
       {keyfile}
    </p></div>
    <div class="cmdsynopsis"><p>
      <code class="command">dnssec-dsfromkey</code> 
-       {-s}
-       [<code class="option">-1</code>]
-       [<code class="option">-2</code>]
-       [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>]
-       [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>]
-       [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>]
-       [<code class="option">-s</code>]
-       [<code class="option">-c <em class="replaceable"><code>class</code></em></code>]
+       [
+	 <code class="option">-1</code> 
+	 |   <code class="option">-2</code> 
+	 |   <code class="option">-a <em class="replaceable"><code>alg</code></em></code> 
+      ]
+       [
+	 <code class="option">-C</code> 
+	 |   <code class="option">-l <em class="replaceable"><code>domain</code></em></code> 
+      ]
       [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>]
-       [<code class="option">-f <em class="replaceable"><code>file</code></em></code>]
-       [<code class="option">-A</code>]
       [<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
-       {dnsname}
-   </p></div>
+       [<code class="option">-c <em class="replaceable"><code>class</code></em></code>]
+       [<code class="option">-A</code>]
+       {<code class="option">-f <em class="replaceable"><code>file</code></em></code>}
+       [dnsname]
+    </p></div>
    <div class="cmdsynopsis"><p>
      <code class="command">dnssec-dsfromkey</code> 
-       [<code class="option">-h</code>]
-       [<code class="option">-V</code>]
-   </p></div>
+       [
+	 <code class="option">-1</code> 
+	 |   <code class="option">-2</code> 
+	 |   <code class="option">-a <em class="replaceable"><code>alg</code></em></code> 
+      ]
+       [
+	 <code class="option">-C</code> 
+	 |   <code class="option">-l <em class="replaceable"><code>domain</code></em></code> 
+      ]
+       [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>]
+       [<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
+       [<code class="option">-c <em class="replaceable"><code>class</code></em></code>]
+       [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>]
+       {-s}
+       {dnsname}
+    </p></div>
+    <div class="cmdsynopsis"><p>
+      <code class="command">dnssec-dsfromkey</code> 
+       [
+	 <code class="option">-h</code> 
+	 |   <code class="option">-V</code> 
+      ]
+    </p></div>
  </div>

  <div class="refsection">
 <a name="id-1.7"></a><h2>DESCRIPTION</h2>

-    <p><span class="command"><strong>dnssec-dsfromkey</strong></span>
-      outputs the Delegation Signer (DS) resource record (RR), as defined in
-      RFC 3658 and RFC 4509, for the given key(s).
+    <p>
+      The <span class="command"><strong>dnssec-dsfromkey</strong></span> command outputs DS (Delegation
+      Signer) resource records (RRs) and other similarly-constructed RRs:
+      with the <code class="option">-l</code> option it outputs DLV (DNSSEC Lookaside
+      Validation) RRs; or with the <code class="option">-C</code> it outputs CDS (Child
+      DS) RRs.
    </p>
+
+    <p>
+      The input keys can be specified in a number of ways:
+    </p>
+
+    <p>
+      By default, <span class="command"><strong>dnssec-dsfromkey</strong></span> reads a key file
+      named like <code class="filename">Knnnn.+aaa+iiiii.key</code>, as generated
+      by <span class="command"><strong>dnssec-keygen</strong></span>.
+    </p>
+
+    <p>
+      With the <code class="option">-f <em class="replaceable"><code>file</code></em></code>
+      option, <span class="command"><strong>dnssec-dsfromkey</strong></span> reads keys from a zone file
+      or partial zone file (which can contain just the DNSKEY records).
+    </p>
+
+    <p>
+      With the <code class="option">-s</code>
+      option, <span class="command"><strong>dnssec-dsfromkey</strong></span> reads
+      a <code class="filename">keyset-</code> file, as generated
+      by <span class="command"><strong>dnssec-keygen</strong></span> <code class="option">-C</code>.
+    </p>
+
  </div>

  <div class="refsection">
 <a name="id-1.8"></a><h2>OPTIONS</h2>

-
    <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-1</span></dt>
 <dd>
 	  <p>
-	    Use SHA-1 as the digest algorithm (the default is to use
-	    both SHA-1 and SHA-256).
+	    An abbreviation for <code class="option">-a SHA1</code>
 	  </p>
 	</dd>
 <dt><span class="term">-2</span></dt>
 <dd>
 	  <p>
-	    Use SHA-256 as the digest algorithm.
+	    An abbreviation for <code class="option">-a SHA-256</code>
 	  </p>
 	</dd>
 <dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
 <dd>
 	  <p>
-	    Select the digest algorithm. The value of
-	    <code class="option">algorithm</code> must be one of SHA-1 (SHA1),
-	    SHA-256 (SHA256) or SHA-384 (SHA384).
-	    These values are case insensitive.
+	    Specify a digest algorithm to use when converting DNSKEY
+	    records to DS records. This option can be repeated, so
+	    that multiple DS records are created for each DNSKEY
+	    record.
+          </p>
+          <p>
+	    The <em class="replaceable"><code>algorithm</code></em> must be one of
+	    SHA-1, SHA-256, or SHA-384.  These values are case insensitive,
+	    and the hyphen may be omitted.  If no algorithm is specified,
+	    the default is SHA-256.
 	  </p>
 	</dd>
+<dt><span class="term">-A</span></dt>
+<dd>
+          <p>
+            Include ZSKs when generating DS records. Without this option, only
+            keys which have the KSK flag set will be converted to DS records
+            and printed. Useful only in <code class="option">-f</code> zone file mode.
+          </p>
+        </dd>
+<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
+<dd>
+	  <p>
+	    Specifies the DNS class (default is IN). Useful only
+	    in <code class="option">-s</code> keyset or <code class="option">-f</code>
+	    zone file mode.
+	  </p>
+	  </dd>
 <dt><span class="term">-C</span></dt>
 <dd>
 	  <p>
-	    Generate CDS records rather than DS records.  This is mutually
-	    exclusive with generating lookaside records.
-	  </p>
-	</dd>
-<dt><span class="term">-T <em class="replaceable"><code>TTL</code></em></span></dt>
-<dd>
-	  <p>
-	    Specifies the TTL of the DS records.
-	  </p>
-	  </dd>
-<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
-<dd>
-	  <p>
-	    Look for key files (or, in keyset mode,
-	    <code class="filename">keyset-</code> files) in
-	    <code class="option">directory</code>.
+	    Generate CDS records rather than DS records. This is mutually
+	    exclusive with the <code class="option">-l</code> option for generating DLV
+	    records.
 	  </p>
 	</dd>
 <dt><span class="term">-f <em class="replaceable"><code>file</code></em></span></dt>
 <dd>
 	  <p>
-	    Zone file mode: in place of the keyfile name, the argument is
-	    the DNS domain name of a zone master file, which can be read
+	    Zone file mode: <span class="command"><strong>dnssec-dsfromkey</strong></span>'s
+	    final <em class="replaceable"><code>dnsname</code></em> argument is
+	    the DNS domain name of a zone whose master file can be read
 	    from <code class="option">file</code>.  If the zone name is the same as
 	    <code class="option">file</code>, then it may be omitted.
 	  </p>
 	  <p>
-	    If <code class="option">file</code> is set to <code class="literal">"-"</code>, then
+	    If <em class="replaceable"><code>file</code></em> is <code class="literal">"-"</code>, then
 	    the zone data is read from the standard input.  This makes it
 	    possible to use the output of the <span class="command"><strong>dig</strong></span>
 	    command as input, as in:
@@ -140,37 +202,41 @@
 	    <strong class="userinput"><code>dig dnskey example.com | dnssec-dsfromkey -f - example.com</code></strong>
 	  </p>
 	</dd>
-<dt><span class="term">-A</span></dt>
+<dt><span class="term">-h</span></dt>
 <dd>
-          <p>
-            Include ZSKs when generating DS records.  Without this option,
-            only keys which have the KSK flag set will be converted to DS
-            records and printed.  Useful only in zone file mode.
-          </p>
-        </dd>
+	  <p>
+	    Prints usage information.
+	  </p>
+	</dd>
+<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
+<dd>
+	  <p>
+	    Look for key files or <code class="filename">keyset-</code> files in
+	    <code class="option">directory</code>.
+	  </p>
+	</dd>
 <dt><span class="term">-l <em class="replaceable"><code>domain</code></em></span></dt>
 <dd>
 	  <p>
-	    Generate a DLV set instead of a DS set.  The specified
-	    <code class="option">domain</code> is appended to the name for each
+	    Generate a DLV set instead of a DS set. The specified
+	    <em class="replaceable"><code>domain</code></em> is appended to the name for each
 	    record in the set.
-	    The DNSSEC Lookaside Validation (DLV) RR is described
-	    in RFC 4431.  This is mutually exclusive with generating
-	    CDS records.
+	    This is mutually exclusive with the <code class="option">-C</code> option
+	    for generating CDS records.
 	  </p>
 	</dd>
 <dt><span class="term">-s</span></dt>
 <dd>
 	  <p>
-	    Keyset mode: in place of the keyfile name, the argument is
-	    the DNS domain name of a keyset file.
+	    Keyset mode: <span class="command"><strong>dnssec-dsfromkey</strong></span>'s
+	    final <em class="replaceable"><code>dnsname</code></em> argument is the DNS
+	    domain name used to locate a <code class="filename">keyset-</code> file.
 	  </p>
 	</dd>
-<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
+<dt><span class="term">-T <em class="replaceable"><code>TTL</code></em></span></dt>
 <dd>
 	  <p>
-	    Specifies the DNS class (default is IN).  Useful only
-	    in keyset or zone file mode.
+	    Specifies the TTL of the DS records. By default the TTL is omitted.
 	  </p>
 	  </dd>
 <dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
@@ -179,12 +245,6 @@
 	    Sets the debugging level.
 	  </p>
 	</dd>
-<dt><span class="term">-h</span></dt>
-<dd>
-	  <p>
-	    Prints usage information.
-	  </p>
-	</dd>
 <dt><span class="term">-V</span></dt>
 <dd>
 	  <p>
@@ -200,22 +260,23 @@
    <p>
      To build the SHA-256 DS RR from the
      <strong class="userinput"><code>Kexample.com.+003+26160</code></strong>
-      keyfile name, the following command would be issued:
+      keyfile name, you can issue the following command:
    </p>
    <p><strong class="userinput"><code>dnssec-dsfromkey -2 Kexample.com.+003+26160</code></strong>
    </p>
    <p>
      The command would print something like:
    </p>
-    <p><strong class="userinput"><code>example.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0 C5EA0B94</code></strong>
+    <p><strong class="userinput"><code>example.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0C5EA0B94</code></strong>
    </p>
+
  </div>

  <div class="refsection">
 <a name="id-1.10"></a><h2>FILES</h2>

    <p>
-      The keyfile can be designed by the key identification
+      The keyfile can be designated by the key identification
      <code class="filename">Knnnn.+aaa+iiiii</code> or the full file name
      <code class="filename">Knnnn.+aaa+iiiii.key</code> as generated by
      <span class="refentrytitle">dnssec-keygen</span>(8).
@@ -245,9 +306,11 @@
 	<span class="refentrytitle">dnssec-signzone</span>(8)
      </span>,
      <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
-      <em class="citetitle">RFC 3658</em>,
-      <em class="citetitle">RFC 4431</em>.
-      <em class="citetitle">RFC 4509</em>.
+      <em class="citetitle">RFC 3658</em> (DS RRs),
+      <em class="citetitle">RFC 4431</em> (DLV RRs),
+      <em class="citetitle">RFC 4509</em> (SHA-256 for DS RRs),
+      <em class="citetitle">RFC 6605</em> (SHA-384 for DS RRs),
+      <em class="citetitle">RFC 7344</em> (CDS and CDNSKEY RRs).
    </p>
  </div>

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2013-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2013-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -134,5 +134,5 @@ RFC 5011\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2013-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2013-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -38,6 +38,7 @@
      <year>2015</year>
      <year>2016</year>
      <year>2018</year>
+      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2013-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2013-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2008-2012, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2008-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -55,7 +55,7 @@ of the key is specified on the command line\&. This must match the name of the z
 .RS 4
 Selects the cryptographic algorithm\&. The value of
 \fBalgorithm\fR
-must be one of RSAMD5, RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&.
+must be one of RSASHA1, NSEC3RSASHA1, RSASHA256, RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&.
 .sp
 If no algorithm is specified, then RSASHA1 will be used by default, unless the
 \fB\-3\fR
@@ -63,9 +63,9 @@ option is specified, in which case NSEC3RSASHA1 will be used instead\&. (If
 \fB\-3\fR
 is used and an algorithm is specified, that algorithm will be checked for compatibility with NSEC3\&.)
 .sp
-These values are case insensitive\&. In some cases, abbreviations are supported, such as ECDSA256 for ECDSAP256SHA256 and ECDSA384 for ECDSAP384SHA384\&. If RSASHA1 or DSA is specified along with the
+These values are case insensitive\&. In some cases, abbreviations are supported, such as ECDSA256 for ECDSAP256SHA256 and ECDSA384 for ECDSAP384SHA384\&. If RSASHA1 is specified along with the
 \fB\-3\fR
-option, then NSEC3RSASHA1 or NSEC3DSA will be used instead\&.
+option, then NSEC3RSASHA1 will be used instead\&.
 .sp
 As of BIND 9\&.12\&.0, this option is mandatory except when using the
 \fB\-S\fR
@@ -307,5 +307,5 @@ The PKCS#11 URI Scheme (draft\-pechanec\-pkcs11uri\-13)\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2008-2012, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2008-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -64,7 +64,7 @@ usage(void) {
 	fprintf(stderr, "    name: owner of the key\n");
 	fprintf(stderr, "Other options:\n");
 	fprintf(stderr, "    -a algorithm: \n"
-			"        RSA | RSAMD5 | DH | RSASHA1 |\n"
+			"        DH | RSASHA1 |\n"
 			"        NSEC3RSASHA1 |\n"
 			"        RSASHA256 | RSASHA512 |\n"
 			"        ECDSAP256SHA256 | ECDSAP384SHA384\n");
@@ -382,22 +382,14 @@ main(int argc, char **argv) {
 			fatal("no algorithm specified");
 		}

-		if (strcasecmp(algname, "RSA") == 0) {
-			fprintf(stderr, "The use of RSA (RSAMD5) is not "
-					"recommended.\nIf you still wish to "
-					"use RSA (RSAMD5) please specify "
-					"\"-a RSAMD5\"\n");
-			if (freeit != NULL)
-				free(freeit);
-			return (1);
-		} else {
-			r.base = algname;
-			r.length = strlen(algname);
-			ret = dns_secalg_fromtext(&alg, &r);
-			if (ret != ISC_R_SUCCESS)
-				fatal("unknown algorithm %s", algname);
-			if (alg == DST_ALG_DH)
-				options |= DST_TYPE_KEY;
+		r.base = algname;
+		r.length = strlen(algname);
+		ret = dns_secalg_fromtext(&alg, &r);
+		if (ret != ISC_R_SUCCESS) {
+			fatal("unknown algorithm %s", algname);
+		}
+		if (alg == DST_ALG_DH) {
+			options |= DST_TYPE_KEY;
 		}

 		if (use_nsec3) {
@@ -639,10 +631,10 @@ main(int argc, char **argv) {

 		if (setdel)
 			dst_key_settime(key, DST_TIME_DELETE, deltime);
-	if (setsyncadd)
-		dst_key_settime(key, DST_TIME_SYNCPUBLISH, syncadd);
-	if (setsyncdel)
-		dst_key_settime(key, DST_TIME_SYNCDELETE, syncdel);
+		if (setsyncadd)
+			dst_key_settime(key, DST_TIME_SYNCPUBLISH, syncadd);
+		if (setsyncdel)
+			dst_key_settime(key, DST_TIME_SYNCDELETE, syncdel);

 	} else {
 		if (setpub || setact || setrev || setinact ||
@@ -43,6 +43,7 @@
      <year>2016</year>
      <year>2017</year>
      <year>2018</year>
+      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -105,7 +106,7 @@
 	<listitem>
 	  <para>
 	    Selects the cryptographic algorithm.  The value of
-	    <option>algorithm</option> must be one of RSAMD5, RSASHA1,
+	    <option>algorithm</option> must be one of RSASHA1,
 	    NSEC3RSASHA1, RSASHA256, RSASHA512,
 	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.
 	  </para>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2008-2012, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2008-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -89,8 +89,8 @@
 <dd>
 	  <p>
 	    Selects the cryptographic algorithm.  The value of
-	    <code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
-	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512,
+	    <code class="option">algorithm</code> must be one of RSASHA1,
+	    NSEC3RSASHA1, RSASHA256, RSASHA512,
 	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.
 	  </p>
 	  <p>
@@ -103,9 +103,9 @@
 	  <p>
 	    These values are case insensitive. In some cases, abbreviations
 	    are supported, such as ECDSA256 for ECDSAP256SHA256 and
-	    ECDSA384 for ECDSAP384SHA384. If RSASHA1 or DSA is specified
+	    ECDSA384 for ECDSAP384SHA384. If RSASHA1 is specified
 	    along with the <code class="option">-3</code> option, then NSEC3RSASHA1
-	    or NSEC3DSA will be used instead.
+	    will be used instead.
 	  </p>
 	  <p>
 	    As of BIND 9.12.0, this option is mandatory except when using
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000-2005, 2007-2012, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000-2005, 2007-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -62,13 +62,13 @@ may be preferable to direct use of
 .RS 4
 Selects the cryptographic algorithm\&. For DNSSEC keys, the value of
 \fBalgorithm\fR
-must be one of RSAMD5, RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&. For TKEY, the value must be DH (Diffie Hellman); specifying his value will automatically set the
+must be one of RSASHA1, NSEC3RSASHA1, RSASHA256, RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&. For TKEY, the value must be DH (Diffie Hellman); specifying his value will automatically set the
 \fB\-T KEY\fR
 option as well\&.
 .sp
-These values are case insensitive\&. In some cases, abbreviations are supported, such as ECDSA256 for ECDSAP256SHA256 and ECDSA384 for ECDSAP384SHA384\&. If RSASHA1 or DSA is specified along with the
+These values are case insensitive\&. In some cases, abbreviations are supported, such as ECDSA256 for ECDSAP256SHA256 and ECDSA384 for ECDSAP384SHA384\&. If RSASHA1 is specified along with the
 \fB\-3\fR
-option, then NSEC3RSASHA1 or NSEC3DSA will be used instead\&.
+option, then NSEC3RSASHA1 will be used instead\&.
 .sp
 This parameter
 \fImust\fR
@@ -327,21 +327,21 @@ and
 files are generated for symmetric cryptography algorithms such as HMAC\-MD5, even though the public and private key are equivalent\&.
 .SH "EXAMPLE"
 .PP
-To generate a 768\-bit DSA key for the domain
+To generate an ECDSAP256SHA256 key for the domain
 \fBexample\&.com\fR, the following command would be issued:
 .PP
-\fBdnssec\-keygen \-a DSA \-b 768 \-n ZONE example\&.com\fR
+\fBdnssec\-keygen \-a ECDSAP256SHA256 \-n ZONE example\&.com\fR
 .PP
 The command would print a string of the form:
 .PP
-\fBKexample\&.com\&.+003+26160\fR
+\fBKexample\&.com\&.+013+26160\fR
 .PP
 In this example,
 \fBdnssec\-keygen\fR
 creates the files
-Kexample\&.com\&.+003+26160\&.key
+Kexample\&.com\&.+013+26160\&.key
 and
-Kexample\&.com\&.+003+26160\&.private\&.
+Kexample\&.com\&.+013+26160\&.private\&.
 .SH "SEE ALSO"
 .PP
 \fBdnssec-signzone\fR(8),
@@ -354,5 +354,5 @@ RFC 4034\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000-2005, 2007-2012, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000-2005, 2007-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -79,14 +79,12 @@ usage(void) {
 	fprintf(stderr, "Options:\n");
 	fprintf(stderr, "    -K <directory>: write keys into directory\n");
 	fprintf(stderr, "    -a <algorithm>:\n");
-	fprintf(stderr, "        RSA | RSAMD5 | RSASHA1 | NSEC3RSASHA1"
-				" |\n");
+	fprintf(stderr, "        RSASHA1 | NSEC3RSASHA1 |\n");
 	fprintf(stderr, "        RSASHA256 | RSASHA512 |\n");
 	fprintf(stderr, "        ECDSAP256SHA256 | ECDSAP384SHA384 |\n");
 	fprintf(stderr, "        ED25519 | ED448 | DH\n");
 	fprintf(stderr, "    -3: use NSEC3-capable algorithm\n");
 	fprintf(stderr, "    -b <key size in bits>:\n");
-	fprintf(stderr, "        RSAMD5:\t[1024..%d]\n", MAX_RSA);
 	fprintf(stderr, "        RSASHA1:\t[1024..%d]\n", MAX_RSA);
 	fprintf(stderr, "        NSEC3RSASHA1:\t[1024..%d]\n", MAX_RSA);
 	fprintf(stderr, "        RSASHA256:\t[1024..%d]\n", MAX_RSA);
@@ -243,7 +241,7 @@ main(int argc, char **argv) {
 	/*
 	 * Process memory debugging argument first.
 	 */
-#define CMDLINE_FLAGS "3A:a:b:Cc:D:d:E:eFf:Gg:hI:i:K:kL:m:n:P:p:qR:r:S:s:T:t:" \
+#define CMDLINE_FLAGS "3A:a:b:Cc:D:d:E:eFf:Gg:hI:i:K:L:m:n:P:p:qR:r:S:s:T:t:" \
 		      "v:V"
 	while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (ch) {
@@ -324,11 +322,6 @@ main(int argc, char **argv) {
 				fatal("cannot open directory %s: %s",
 				      directory, isc_result_totext(ret));
 			break;
-		case 'k':
-			fatal("The -k option has been deprecated.\n"
-			      "To generate a key-signing key, use -f KSK.\n"
-			      "To generate a key with TYPE=KEY, use -T KEY.\n");
-			break;
 		case 'L':
 			ttl = strtottl(isc_commandline_argument);
 			setttl = true;
@@ -508,23 +501,14 @@ main(int argc, char **argv) {
 			fatal("no algorithm specified");
 		}

-		if (strcasecmp(algname, "RSA") == 0) {
-			fprintf(stderr, "The use of RSA (RSAMD5) is not "
-					"recommended.\nIf you still wish to "
-					"use RSA (RSAMD5) please specify "
-					"\"-a RSAMD5\"\n");
-			INSIST(freeit == NULL);
-			return (1);
-		} else {
-			r.base = algname;
-			r.length = strlen(algname);
-			ret = dns_secalg_fromtext(&alg, &r);
-			if (ret != ISC_R_SUCCESS) {
-				fatal("unknown algorithm %s", algname);
-			}
-			if (alg == DST_ALG_DH) {
-				options |= DST_TYPE_KEY;
-			}
+		r.base = algname;
+		r.length = strlen(algname);
+		ret = dns_secalg_fromtext(&alg, &r);
+		if (ret != ISC_R_SUCCESS) {
+			fatal("unknown algorithm %s", algname);
+		}
+		if (alg == DST_ALG_DH) {
+			options |= DST_TYPE_KEY;
 		}

 		if (!dst_algorithm_supported(alg)) {
@@ -698,7 +682,6 @@ main(int argc, char **argv) {
 	}

 	switch (alg) {
-	case DNS_KEYALG_RSAMD5:
 	case DNS_KEYALG_RSASHA1:
 	case DNS_KEYALG_NSEC3RSASHA1:
 	case DNS_KEYALG_RSASHA256:
@@ -780,7 +763,6 @@ main(int argc, char **argv) {
 	}

 	switch(alg) {
-	case DNS_KEYALG_RSAMD5:
 	case DNS_KEYALG_RSASHA1:
 	case DNS_KEYALG_NSEC3RSASHA1:
 	case DNS_KEYALG_RSASHA256:
@@ -50,6 +50,7 @@
      <year>2016</year>
      <year>2017</year>
      <year>2018</year>
+      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -57,11 +58,10 @@
  <refsynopsisdiv>
    <cmdsynopsis sepchar=" ">
      <command>dnssec-keygen</command>
-      <arg rep="norepeat"><option>-a <replaceable class="parameter">algorithm</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-b <replaceable class="parameter">keysize</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-n <replaceable class="parameter">nametype</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-3</option></arg>
      <arg choice="opt" rep="norepeat"><option>-A <replaceable class="parameter">date/offset</replaceable></option></arg>
+      <arg rep="norepeat"><option>-a <replaceable class="parameter">algorithm</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-b <replaceable class="parameter">keysize</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-C</option></arg>
      <arg choice="opt" rep="norepeat"><option>-c <replaceable class="parameter">class</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-D <replaceable class="parameter">date/offset</replaceable></option></arg>
@@ -76,6 +76,7 @@
      <arg choice="opt" rep="norepeat"><option>-K <replaceable class="parameter">directory</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-k</option></arg>
      <arg choice="opt" rep="norepeat"><option>-L <replaceable class="parameter">ttl</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-n <replaceable class="parameter">nametype</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-P <replaceable class="parameter">date/offset</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-P sync <replaceable class="parameter">date/offset</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-p <replaceable class="parameter">protocol</replaceable></option></arg>
@@ -86,7 +87,6 @@
      <arg choice="opt" rep="norepeat"><option>-t <replaceable class="parameter">type</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-V</option></arg>
      <arg choice="opt" rep="norepeat"><option>-v <replaceable class="parameter">level</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-z</option></arg>
      <arg choice="req" rep="norepeat">name</arg>
    </cmdsynopsis>
  </refsynopsisdiv>
@@ -117,12 +117,26 @@


    <variablelist>
+
+      <varlistentry>
+	<term>-3</term>
+	<listitem>
+	  <para>
+	    Use an NSEC3-capable algorithm to generate a DNSSEC key.
+	    If this option is used with an algorithm that has both
+	    NSEC and NSEC3 versions, then the NSEC3 version will be
+	    used; for example, <command>dnssec-keygen -3a RSASHA1</command>
+	    specifies the NSEC3RSASHA1 algorithm.
+	  </para>
+	</listitem>
+      </varlistentry>
+
      <varlistentry>
 	<term>-a <replaceable class="parameter">algorithm</replaceable></term>
 	<listitem>
 	  <para>
 	    Selects the cryptographic algorithm.  For DNSSEC keys, the value
-	    of <option>algorithm</option> must be one of RSAMD5, RSASHA1,
+	    of <option>algorithm</option> must be one of RSASHA1,
 	    NSEC3RSASHA1, RSASHA256, RSASHA512,
 	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.  For
 	    TKEY, the value must be DH (Diffie Hellman); specifying
@@ -156,11 +170,9 @@
 	  <para>
 	    Specifies the number of bits in the key.  The choice of key
 	    size depends on the algorithm used.  RSA keys must be
-	    between 1024 and 2048 bits.  Diffie Hellman keys must be between
-	    128 and 4096 bits.  DSA keys must be between 512 and 1024
-	    bits and an exact multiple of 64.  HMAC keys must be
-	    between 1 and 512 bits. Elliptic curve algorithms don't need
-	    this parameter.
+	    between 1024 and 4096 bits.  Diffie Hellman keys must be between
+	    128 and 4096 bits.  Elliptic curve algorithms don't need this
+	    parameter.
 	  </para>
 	  <para>
 	    If the key size is not specified, some algorithms have
@@ -172,43 +184,16 @@
 	</listitem>
      </varlistentry>

-      <varlistentry>
-	<term>-n <replaceable class="parameter">nametype</replaceable></term>
-	<listitem>
-	  <para>
-	    Specifies the owner type of the key.  The value of
-	    <option>nametype</option> must either be ZONE (for a DNSSEC
-	    zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated
-	    with a host (KEY)), USER (for a key associated with a
-	    user(KEY)) or OTHER (DNSKEY).  These values are case
-	    insensitive.  Defaults to ZONE for DNSKEY generation.
-	  </para>
-	</listitem>
-      </varlistentry>
-
-      <varlistentry>
-	<term>-3</term>
-	<listitem>
-	  <para>
-	    Use an NSEC3-capable algorithm to generate a DNSSEC key.
-	    If this option is used with an algorithm that has both
-	    NSEC and NSEC3 versions, then the NSEC3 version will be
-	    used; for example, <command>dnssec-keygen -3a RSASHA1</command>
-	    specifies the NSEC3RSASHA1 algorithm.
-	  </para>
-	</listitem>
-      </varlistentry>
-
      <varlistentry>
 	<term>-C</term>
 	<listitem>
 	  <para>
-	    Compatibility mode:  generates an old-style key, without
-	    any metadata.  By default, <command>dnssec-keygen</command>
-	    will include the key's creation date in the metadata stored
-	    with the private key, and other dates may be set there as well
-	    (publication date, activation date, etc).  Keys that include
-	    this data may be incompatible with older versions of BIND; the
+	    Compatibility mode: generates an old-style key, without any
+	    timing metadata. By default, <command>dnssec-keygen</command>
+	    will include the key's creation date in the metadata stored with
+	    the private key, and other dates may be set there as well
+	    (publication date, activation date, etc). Keys that include this
+	    data may be incompatible with older versions of BIND; the
 	    <option>-C</option> option suppresses them.
 	  </para>
 	</listitem>
@@ -292,15 +277,6 @@
 	</listitem>
      </varlistentry>

-      <varlistentry>
-	<term>-k</term>
-	<listitem>
-	  <para>
-	    Deprecated in favor of -T KEY.
-	  </para>
-	</listitem>
-      </varlistentry>
-
      <varlistentry>
 	<term>-L <replaceable class="parameter">ttl</replaceable></term>
 	<listitem>
@@ -317,14 +293,28 @@
 	</listitem>
      </varlistentry>

+      <varlistentry>
+	<term>-n <replaceable class="parameter">nametype</replaceable></term>
+	<listitem>
+	  <para>
+	    Specifies the owner type of the key.  The value of
+	    <option>nametype</option> must either be ZONE (for a DNSSEC
+	    zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated
+	    with a host (KEY)), USER (for a key associated with a
+	    user(KEY)) or OTHER (DNSKEY).  These values are case
+	    insensitive.  Defaults to ZONE for DNSKEY generation.
+	  </para>
+	</listitem>
+      </varlistentry>
+
      <varlistentry>
 	<term>-p <replaceable class="parameter">protocol</replaceable></term>
 	<listitem>
 	  <para>
-	    Sets the protocol value for the generated key.  The protocol
-	    is a number between 0 and 255.  The default is 3 (DNSSEC).
-	    Other possible values for this argument are listed in
-	    RFC 2535 and its successors.
+	    Sets the protocol value for the generated key, for use
+	    with <option>-T KEY</option>. The protocol is a number between 0
+	    and 255. The default is 3 (DNSSEC). Other possible values for
+	    this argument are listed in RFC 2535 and its successors.
 	  </para>
 	</listitem>
      </varlistentry>
@@ -382,10 +372,6 @@
 	    <option>rrtype</option> must be either DNSKEY or KEY.  The
 	    default is DNSKEY when using a DNSSEC algorithm, but it can be
 	    overridden to KEY for use with SIG(0).
-	  <para>
-	  </para>
-	    Specifying any TSIG algorithm (HMAC-* or DH) with
-	    <option>-a</option> forces this option to KEY.
 	  </para>
 	</listitem>
      </varlistentry>
@@ -394,19 +380,11 @@
 	<term>-t <replaceable class="parameter">type</replaceable></term>
 	<listitem>
 	  <para>
-	    Indicates the use of the key.  <option>type</option> must be
-	    one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF.  The default
-	    is AUTHCONF.  AUTH refers to the ability to authenticate
-	    data, and CONF the ability to encrypt data.
-	  </para>
-	</listitem>
-      </varlistentry>
-
-      <varlistentry>
-	<term>-v <replaceable class="parameter">level</replaceable></term>
-	<listitem>
-	  <para>
-	    Sets the debugging level.
+	    Indicates the use of the key, for use with <option>-T
+	    KEY</option>. <option>type</option> must be one of AUTHCONF,
+	    NOAUTHCONF, NOAUTH, or NOCONF. The default is AUTHCONF. AUTH
+	    refers to the ability to authenticate data, and CONF the ability
+	    to encrypt data.
 	  </para>
 	</listitem>
      </varlistentry>
@@ -420,6 +398,15 @@
 	</listitem>
      </varlistentry>

+      <varlistentry>
+	<term>-v <replaceable class="parameter">level</replaceable></term>
+	<listitem>
+	  <para>
+	    Sets the debugging level.
+	  </para>
+	</listitem>
+      </varlistentry>
+
    </variablelist>
  </refsection>

@@ -605,22 +592,28 @@
  <refsection><info><title>EXAMPLE</title></info>

    <para>
-      To generate a 768-bit DSA key for the domain
-      <userinput>example.com</userinput>, the following command would be
-      issued:
+      To generate an ECDSAP256SHA256 zone-signing key for the zone
+      <userinput>example.com</userinput>, issue the command:
    </para>
-    <para><userinput>dnssec-keygen -a DSA -b 768 -n ZONE example.com</userinput>
+    <para>
+      <userinput>dnssec-keygen -a ECDSAP256SHA256 example.com</userinput>
    </para>
    <para>
      The command would print a string of the form:
    </para>
-    <para><userinput>Kexample.com.+003+26160</userinput>
+    <para><userinput>Kexample.com.+013+26160</userinput>
    </para>
    <para>
      In this example, <command>dnssec-keygen</command> creates
-      the files <filename>Kexample.com.+003+26160.key</filename>
+      the files <filename>Kexample.com.+013+26160.key</filename>
      and
-      <filename>Kexample.com.+003+26160.private</filename>.
+      <filename>Kexample.com.+013+26160.private</filename>.
+    </para>
+    <para>
+      To generate a matching key-signing key, issue the command:
+    </para>
+    <para>
+      <userinput>dnssec-keygen -a ECDSAP256SHA256 -f KSK example.com</userinput>
    </para>
  </refsection>

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000-2005, 2007-2012, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000-2005, 2007-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -99,8 +99,8 @@
 <dd>
 	  <p>
 	    Selects the cryptographic algorithm.  For DNSSEC keys, the value
-	    of <code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
-	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512,
+	    of <code class="option">algorithm</code> must be one of RSASHA1,
+	    NSEC3RSASHA1, RSASHA256, RSASHA512,
 	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.  For
 	    TKEY, the value must be DH (Diffie Hellman); specifying
 	    his value will automatically set the <code class="option">-T KEY</code>
@@ -109,9 +109,9 @@
 	  <p>
 	    These values are case insensitive. In some cases, abbreviations
 	    are supported, such as ECDSA256 for ECDSAP256SHA256 and
-	    ECDSA384 for ECDSAP384SHA384. If RSASHA1 or DSA is specified
+	    ECDSA384 for ECDSAP384SHA384. If RSASHA1 is specified
 	    along with the <code class="option">-3</code> option, then NSEC3RSASHA1
-	    or NSEC3DSA will be used instead.
+	    will be used instead.
 	  </p>
 	  <p>
 	    This parameter <span class="emphasis"><em>must</em></span> be specified except
@@ -498,22 +498,22 @@
 <a name="id-1.11"></a><h2>EXAMPLE</h2>

    <p>
-      To generate a 768-bit DSA key for the domain
+      To generate an ECDSAP256SHA256 key for the domain
      <strong class="userinput"><code>example.com</code></strong>, the following command would be
      issued:
    </p>
-    <p><strong class="userinput"><code>dnssec-keygen -a DSA -b 768 -n ZONE example.com</code></strong>
+    <p><strong class="userinput"><code>dnssec-keygen -a ECDSAP256SHA256 -n ZONE example.com</code></strong>
    </p>
    <p>
      The command would print a string of the form:
    </p>
-    <p><strong class="userinput"><code>Kexample.com.+003+26160</code></strong>
+    <p><strong class="userinput"><code>Kexample.com.+013+26160</code></strong>
    </p>
    <p>
      In this example, <span class="command"><strong>dnssec-keygen</strong></span> creates
-      the files <code class="filename">Kexample.com.+003+26160.key</code>
+      the files <code class="filename">Kexample.com.+013+26160.key</code>
      and
-      <code class="filename">Kexample.com.+003+26160.private</code>.
+      <code class="filename">Kexample.com.+013+26160.private</code>.
    </p>
  </div>

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2009, 2011, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2009, 2011, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -99,5 +99,5 @@ RFC 5011\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2009, 2011, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2009, 2011, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -57,13 +57,13 @@ usage(void) {
 #else
 	fprintf(stderr, "    -E engine:    specify OpenSSL engine\n");
 #endif
-	fprintf(stderr, "    -f:	   force overwrite\n");
+	fprintf(stderr, "    -f:           force overwrite\n");
+	fprintf(stderr, "    -h:           help\n");
 	fprintf(stderr, "    -K directory: use directory for key files\n");
-	fprintf(stderr, "    -h:	   help\n");
-	fprintf(stderr, "    -r:	   remove old keyfiles after "
+	fprintf(stderr, "    -r:           remove old keyfiles after "
 					   "creating revoked version\n");
-	fprintf(stderr, "    -v level:	   set level of verbosity\n");
-	fprintf(stderr, "    -V: print version information\n");
+	fprintf(stderr, "    -v level:     set level of verbosity\n");
+	fprintf(stderr, "    -V:           print version information\n");
 	fprintf(stderr, "Output:\n");
 	fprintf(stderr, "     K<name>+<alg>+<new id>.key, "
 			     "K<name>+<alg>+<new id>.private\n");
@@ -239,7 +239,7 @@ main(int argc, char **argv) {
 		 * Remove old key file, if told to (and if
 		 * it isn't the same as the new file)
 		 */
-		if (removefile && dst_key_alg(key) != DST_ALG_RSAMD5) {
+		if (removefile) {
 			isc_buffer_init(&buf, oldname, sizeof(oldname));
 			dst_key_setflags(key, flags & ~DNS_KEYFLAG_REVOKE);
 			dst_key_buildfilename(key, DST_TYPE_PRIVATE, dir, &buf);
@@ -38,6 +38,7 @@
      <year>2015</year>
      <year>2016</year>
      <year>2018</year>
+      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2009, 2011, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2009, 2011, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2009-2011, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2009-2011, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -200,5 +200,5 @@ RFC 5011\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2009-2011, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2009-2011, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -40,6 +40,7 @@
      <year>2016</year>
      <year>2017</year>
      <year>2018</year>
+      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2009-2011, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2009-2011, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000-2009, 2011-2018 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000-2009, 2011-2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -415,9 +415,9 @@ Specify which keys should be used to sign the zone\&. If no keys are specified,
 .PP
 The following command signs the
 \fBexample\&.com\fR
-zone with the DSA key generated by
+zone with the ECDSAP256SHA256 key generated by key generated by
 \fBdnssec\-keygen\fR
-(Kexample\&.com\&.+003+17247)\&. Because the
+(Kexample\&.com\&.+013+17247)\&. Because the
 \fB\-S\fR
 option is not being used, the zone\*(Aqs keys must be in the master file (db\&.example\&.com)\&. This invocation looks for
 dsset
@@ -428,7 +428,7 @@ files, in the current directory, so that DS records can be imported from them (\
 .\}
 .nf
 % dnssec\-signzone \-g \-o example\&.com db\&.example\&.com \e
-Kexample\&.com\&.+003+17247
+Kexample\&.com\&.+013+17247
 db\&.example\&.com\&.signed
 %
 .fi
@@ -468,5 +468,5 @@ RFC 4641\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000-2009, 2011-2018 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000-2009, 2011-2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -533,8 +533,6 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 		arraysize += dns_rdataset_count(&sigset);
 	wassignedby = isc_mem_get(mctx, arraysize * sizeof(bool));
 	nowsignedby = isc_mem_get(mctx, arraysize * sizeof(bool));
-	if (wassignedby == NULL || nowsignedby == NULL)
-		fatal("out of memory");

 	for (i = 0; i < arraysize; i++)
 		wassignedby[i] = nowsignedby[i] = false;
@@ -3876,9 +3874,11 @@ main(int argc, char *argv[]) {
 			      isc_result_totext(result));
 	}

-	RUNTIME_CHECK(isc_mutex_init(&namelock) == ISC_R_SUCCESS);
-	if (printstats)
-		RUNTIME_CHECK(isc_mutex_init(&statslock) == ISC_R_SUCCESS);
+	isc_mutex_init(&namelock);
+
+	if (printstats) {
+		isc_mutex_init(&statslock);
+	}

 	presign();
 	TIME_NOW(&sign_start);
@@ -3936,9 +3936,9 @@ main(int argc, char *argv[]) {
 		check_result(result, "dns_master_dumptostream3");
 	}

-	DESTROYLOCK(&namelock);
+	isc_mutex_destroy(&namelock);
 	if (printstats)
-		DESTROYLOCK(&statslock);
+		isc_mutex_destroy(&statslock);

 	if (!output_stdout) {
 		result = isc_stdio_close(outfp);
@@ -50,6 +50,7 @@
      <year>2016</year>
      <year>2017</year>
      <year>2018</year>
+      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -787,15 +788,16 @@

    <para>
      The following command signs the <userinput>example.com</userinput>
-      zone with the DSA key generated by <command>dnssec-keygen</command>
-      (Kexample.com.+003+17247).  Because the <command>-S</command> option
-      is not being used, the zone's keys must be in the master file
+      zone with the ECDSAP256SHA256 key generated by key generated by
+      <command>dnssec-keygen</command> (Kexample.com.+013+17247).
+      Because the <command>-S</command> option is not being used,
+      the zone's keys must be in the master file
      (<filename>db.example.com</filename>).  This invocation looks
      for <filename>dsset</filename> files, in the current directory,
      so that DS records can be imported from them (<command>-g</command>).
    </para>
 <programlisting>% dnssec-signzone -g -o example.com db.example.com \
-Kexample.com.+003+17247
+Kexample.com.+013+17247
 db.example.com.signed
 %</programlisting>
    <para>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000-2009, 2011-2018 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000-2009, 2011-2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -624,15 +624,16 @@

    <p>
      The following command signs the <strong class="userinput"><code>example.com</code></strong>
-      zone with the DSA key generated by <span class="command"><strong>dnssec-keygen</strong></span>
-      (Kexample.com.+003+17247).  Because the <span class="command"><strong>-S</strong></span> option
-      is not being used, the zone's keys must be in the master file
+      zone with the ECDSAP256SHA256 key generated by key generated by
+      <span class="command"><strong>dnssec-keygen</strong></span> (Kexample.com.+013+17247).
+      Because the <span class="command"><strong>-S</strong></span> option is not being used,
+      the zone's keys must be in the master file
      (<code class="filename">db.example.com</code>).  This invocation looks
      for <code class="filename">dsset</code> files, in the current directory,
      so that DS records can be imported from them (<span class="command"><strong>-g</strong></span>).
    </p>
 <pre class="programlisting">% dnssec-signzone -g -o example.com db.example.com \
-Kexample.com.+003+17247
+Kexample.com.+013+17247
 db.example.com.signed
 %</pre>
    <p>
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2012, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2012, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -113,5 +113,5 @@ RFC 4033\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2012, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2012, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -37,6 +37,7 @@
      <year>2015</year>
      <year>2016</year>
      <year>2018</year>
+      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2012, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2012, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup>
+    <Filter Include="Source Files">
+      <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
+      <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
+    </Filter>
+    <Filter Include="Resource Files">
+      <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
+      <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
+    </Filter>
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="..\dnssec-cds.c">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+  </ItemGroup>
+</Project>
@@ -0,0 +1,112 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|@PLATFORM@">
+      <Configuration>Debug</Configuration>
+      <Platform>@PLATFORM@</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|@PLATFORM@">
+      <Configuration>Release</Configuration>
+      <Platform>@PLATFORM@</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+  <PropertyGroup Label="Globals">
+    <ProjectGuid>{0EB1727E-2BBD-47A6-AD12-418F9DEB0531}</ProjectGuid>
+    <Keyword>Win32Proj</Keyword>
+    <RootNamespace>cds</RootNamespace>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <CharacterSet>MultiByte</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>MultiByte</CharacterSet>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <ImportGroup Label="ExtensionSettings">
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <PropertyGroup Label="UserMacros" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'">
+    <LinkIncremental>true</LinkIncremental>
+    <OutDir>..\..\..\Build\$(Configuration)\</OutDir>
+    <IntDir>.\$(Configuration)\</IntDir>
+    <TargetName>dnssec-$(ProjectName)</TargetName>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
+    <LinkIncremental>false</LinkIncremental>
+    <OutDir>..\..\..\Build\$(Configuration)\</OutDir>
+    <IntDir>.\$(Configuration)\</IntDir>
+    <TargetName>dnssec-$(ProjectName)</TargetName>
+  </PropertyGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'">
+    <ClCompile>
+      <PrecompiledHeader>
+      </PrecompiledHeader>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>Disabled</Optimization>
+      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <PrecompiledHeaderOutputFile>.\$(Configuration)\$(ProjectName).pch</PrecompiledHeaderOutputFile>
+      <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
+      <ObjectFileName>.\$(Configuration)\</ObjectFileName>
+      <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
+      <BrowseInformation>true</BrowseInformation>
+      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <CompileAs>CompileAsC</CompileAs>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <PrecompiledHeader>
+      </PrecompiledHeader>
+      <Optimization>MaxSpeed</Optimization>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>@INTRINSIC@</IntrinsicFunctions>
+      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <WholeProgramOptimization>false</WholeProgramOptimization>
+      <StringPooling>true</StringPooling>
+      <PrecompiledHeaderOutputFile>.\$(Configuration)\$(ProjectName).pch</PrecompiledHeaderOutputFile>
+      <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
+      <ObjectFileName>.\$(Configuration)\</ObjectFileName>
+      <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
+      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <CompileAs>CompileAsC</CompileAs>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <GenerateDebugInformation>false</GenerateDebugInformation>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
+      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
+      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemGroup>
+    <ClCompile Include="..\dnssec-cds.c" />
+  </ItemGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+  <ImportGroup Label="ExtensionTargets">
+  </ImportGroup>
+</Project>
@@ -0,0 +1,3 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+</Project>
@@ -154,10 +154,7 @@ options {\n\
 #	fetch-glue <obsolete>;\n\
 	fetch-quota-params 100 0.1 0.3 0.7;\n\
 	fetches-per-server 0;\n\
-	fetches-per-zone 0;\n\
-	filter-aaaa-on-v4 no;\n\
-	filter-aaaa-on-v6 no;\n\
-	filter-aaaa { any; };\n"
+	fetches-per-zone 0;\n"
 #ifdef HAVE_GEOIP
 "	geoip-use-ecs yes;\n"
 #endif
@@ -174,6 +171,8 @@ options {\n\
 	max-recursion-queries 75;\n\
 	max-stale-ttl 604800; /* 1 week */\n\
 	message-compression yes;\n\
+	min-ncache-ttl 0; /* 0 hours */\n\
+	min-cache-ttl 0; /* 0 seconds */\n\
 #	min-roots <obsolete>;\n\
 	minimal-any false;\n\
 	minimal-responses no-auth-recursive;\n\
@@ -324,9 +323,9 @@ named_config_parsedefaults(cfg_parser_t *parser, cfg_obj_t **conf) {

 	isc_buffer_init(&b, defaultconf, sizeof(defaultconf) - 1);
 	isc_buffer_add(&b, sizeof(defaultconf) - 1);
-	return (cfg_parse_buffer4(parser, &b, __FILE__, 0,
-				  &cfg_type_namedconf,
-				  CFG_PCTX_NODEPRECATED, conf));
+	return (cfg_parse_buffer(parser, &b, __FILE__, 0,
+				 &cfg_type_namedconf,
+				 CFG_PCTX_NODEPRECATED, conf));
 }

 isc_result_t
@@ -457,6 +456,7 @@ named_config_getzonetype(const cfg_obj_t *zonetypeobj) {
 		ztype = dns_zone_redirect;
 	} else {
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 	return (ztype);
 }
@@ -1029,6 +1029,7 @@ named_config_getkeyalgorithm2(const char *str, const dns_name_t **name,
 		case hmacsha512: *name = dns_tsig_hmacsha512_name; break;
 		default:
 			INSIST(0);
+			ISC_UNREACHABLE();
 		}
 	}
 	if (typep != NULL)
@@ -152,16 +152,11 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		      "received control channel command '%s'",
 		      cmdline);

-	if (command_compare(command, NAMED_COMMAND_RELOAD)) {
-		result = named_server_reloadcommand(named_g_server, lex, text);
-	} else if (command_compare(command, NAMED_COMMAND_RECONFIG)) {
-		result = named_server_reconfigcommand(named_g_server);
-	} else if (command_compare(command, NAMED_COMMAND_REFRESH)) {
-		result = named_server_refreshcommand(named_g_server, lex, text);
-	} else if (command_compare(command, NAMED_COMMAND_RETRANSFER)) {
-		result = named_server_retransfercommand(named_g_server,
-							lex, text);
-	} else if (command_compare(command, NAMED_COMMAND_HALT)) {
+	/*
+	 * After the lengthy "halt" and "stop", the commands are
+	 * handled in alphabetical order of the NAMED_COMMAND_ macros.
+	 */
+	if (command_compare(command, NAMED_COMMAND_HALT)) {
 #ifdef HAVE_LIBSCF
 		/*
 		 * If we are managed by smf(5), AND in chroot, then
@@ -206,83 +201,90 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		named_os_shutdownmsg(cmdline, *text);
 		isc_app_shutdown();
 		result = ISC_R_SUCCESS;
-	} else if (command_compare(command, NAMED_COMMAND_DUMPSTATS)) {
-		result = named_server_dumpstats(named_g_server);
-	} else if (command_compare(command, NAMED_COMMAND_QUERYLOG)) {
-		result = named_server_togglequerylog(named_g_server, lex);
+	} else if (command_compare(command, NAMED_COMMAND_ADDZONE) ||
+		   command_compare(command, NAMED_COMMAND_MODZONE)) {
+		result = named_server_changezone(named_g_server, cmdline, text);
+	} else if (command_compare(command, NAMED_COMMAND_DELZONE)) {
+		result = named_server_delzone(named_g_server, lex, text);
+	} else if (command_compare(command, NAMED_COMMAND_DNSTAP) ||
+		   command_compare(command, NAMED_COMMAND_DNSTAPREOPEN)) {
+		result = named_server_dnstap(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_DUMPDB)) {
 		named_server_dumpdb(named_g_server, lex, text);
 		result = ISC_R_SUCCESS;
-	} else if (command_compare(command, NAMED_COMMAND_SECROOTS)) {
-		result = named_server_dumpsecroots(named_g_server, lex, text);
-	} else if (command_compare(command, NAMED_COMMAND_TRACE)) {
-		result = named_server_setdebuglevel(named_g_server, lex);
-	} else if (command_compare(command, NAMED_COMMAND_NOTRACE)) {
-		named_g_debuglevel = 0;
-		isc_log_setdebuglevel(named_g_lctx, named_g_debuglevel);
-		result = ISC_R_SUCCESS;
+	} else if (command_compare(command, NAMED_COMMAND_DUMPSTATS)) {
+		result = named_server_dumpstats(named_g_server);
 	} else if (command_compare(command, NAMED_COMMAND_FLUSH)) {
 		result = named_server_flushcache(named_g_server, lex);
 	} else if (command_compare(command, NAMED_COMMAND_FLUSHNAME)) {
 		result = named_server_flushnode(named_g_server, lex, false);
 	} else if (command_compare(command, NAMED_COMMAND_FLUSHTREE)) {
 		result = named_server_flushnode(named_g_server, lex, true);
-	} else if (command_compare(command, NAMED_COMMAND_STATUS)) {
-		result = named_server_status(named_g_server, text);
-	} else if (command_compare(command, NAMED_COMMAND_TSIGLIST)) {
-		result = named_server_tsiglist(named_g_server, text);
-	} else if (command_compare(command, NAMED_COMMAND_TSIGDELETE)) {
-		result = named_server_tsigdelete(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_FREEZE)) {
-		result = named_server_freeze(named_g_server, true, lex,
-					     text);
-	} else if (command_compare(command, NAMED_COMMAND_UNFREEZE) ||
-		   command_compare(command, NAMED_COMMAND_THAW)) {
-		result = named_server_freeze(named_g_server, false, lex,
-					     text);
-	} else if (command_compare(command, NAMED_COMMAND_SCAN)) {
-		result = ISC_R_SUCCESS;
-		named_server_scan_interfaces(named_g_server);
-	} else if (command_compare(command, NAMED_COMMAND_SYNC)) {
-		result = named_server_sync(named_g_server, lex, text);
-	} else if (command_compare(command, NAMED_COMMAND_RECURSING)) {
-		result = named_server_dumprecursing(named_g_server);
-	} else if (command_compare(command, NAMED_COMMAND_TIMERPOKE)) {
-		result = ISC_R_SUCCESS;
-		isc_timermgr_poke(named_g_timermgr);
-	} else if (command_compare(command, NAMED_COMMAND_NULL)) {
-		result = ISC_R_SUCCESS;
+		result = named_server_freeze(named_g_server, true, lex, text);
+	} else if (command_compare(command, NAMED_COMMAND_LOADKEYS) ||
+		   command_compare(command, NAMED_COMMAND_SIGN)) {
+		result = named_server_rekey(named_g_server, lex, text);
+	} else if (command_compare(command, NAMED_COMMAND_MKEYS)) {
+		result = named_server_mkeys(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_NOTIFY)) {
 		result = named_server_notifycommand(named_g_server, lex, text);
-	} else if (command_compare(command, NAMED_COMMAND_VALIDATION)) {
-		result = named_server_validation(named_g_server, lex, text);
-	} else if (command_compare(command, NAMED_COMMAND_SIGN) ||
-		   command_compare(command, NAMED_COMMAND_LOADKEYS)) {
-		result = named_server_rekey(named_g_server, lex, text);
-	} else if (command_compare(command, NAMED_COMMAND_ADDZONE) ||
-		   command_compare(command, NAMED_COMMAND_MODZONE)) {
-		result = named_server_changezone(named_g_server, cmdline, text);
-	} else if (command_compare(command, NAMED_COMMAND_DELZONE)) {
-		result = named_server_delzone(named_g_server, lex, text);
+	} else if (command_compare(command, NAMED_COMMAND_NOTRACE)) {
+		named_g_debuglevel = 0;
+		isc_log_setdebuglevel(named_g_lctx, named_g_debuglevel);
+		result = ISC_R_SUCCESS;
+	} else if (command_compare(command, NAMED_COMMAND_NTA)) {
+		result = named_server_nta(named_g_server, lex, readonly, text);
+	} else if (command_compare(command, NAMED_COMMAND_NULL)) {
+		result = ISC_R_SUCCESS;
+	} else if (command_compare(command, NAMED_COMMAND_QUERYLOG)) {
+		result = named_server_togglequerylog(named_g_server, lex);
+	} else if (command_compare(command, NAMED_COMMAND_RECONFIG)) {
+		result = named_server_reconfigcommand(named_g_server);
+	} else if (command_compare(command, NAMED_COMMAND_RECURSING)) {
+		result = named_server_dumprecursing(named_g_server);
+	} else if (command_compare(command, NAMED_COMMAND_REFRESH)) {
+		result = named_server_refreshcommand(named_g_server, lex, text);
+	} else if (command_compare(command, NAMED_COMMAND_RELOAD)) {
+		result = named_server_reloadcommand(named_g_server, lex, text);
+	} else if (command_compare(command, NAMED_COMMAND_RETRANSFER)) {
+		result = named_server_retransfercommand(named_g_server,
+							lex, text);
+	} else if (command_compare(command, NAMED_COMMAND_SCAN)) {
+		named_server_scan_interfaces(named_g_server);
+		result = ISC_R_SUCCESS;
+	} else if (command_compare(command, NAMED_COMMAND_SECROOTS)) {
+		result = named_server_dumpsecroots(named_g_server, lex, text);
+	} else if (command_compare(command, NAMED_COMMAND_SERVESTALE)) {
+		result = named_server_servestale(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_SHOWZONE)) {
 		result = named_server_showzone(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_SIGNING)) {
 		result = named_server_signing(named_g_server, lex, text);
-	} else if (command_compare(command, NAMED_COMMAND_ZONESTATUS)) {
-		result = named_server_zonestatus(named_g_server, lex, text);
-	} else if (command_compare(command, NAMED_COMMAND_NTA)) {
-		result = named_server_nta(named_g_server, lex, readonly, text);
-	} else if (command_compare(command, NAMED_COMMAND_TESTGEN)) {
-		result = named_server_testgen(lex, text);
-	} else if (command_compare(command, NAMED_COMMAND_MKEYS)) {
-		result = named_server_mkeys(named_g_server, lex, text);
-	} else if (command_compare(command, NAMED_COMMAND_DNSTAP) ||
-		   command_compare(command, NAMED_COMMAND_DNSTAPREOPEN)) {
-		result = named_server_dnstap(named_g_server, lex, text);
+	} else if (command_compare(command, NAMED_COMMAND_STATUS)) {
+		result = named_server_status(named_g_server, text);
+	} else if (command_compare(command, NAMED_COMMAND_SYNC)) {
+		result = named_server_sync(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_TCPTIMEOUTS)) {
 		result = named_server_tcptimeouts(lex, text);
-	} else if (command_compare(command, NAMED_COMMAND_SERVESTALE)) {
-		result = named_server_servestale(named_g_server, lex, text);
+	} else if (command_compare(command, NAMED_COMMAND_TESTGEN)) {
+		result = named_server_testgen(lex, text);
+	} else if (command_compare(command, NAMED_COMMAND_THAW) ||
+		   command_compare(command, NAMED_COMMAND_UNFREEZE)) {
+		result = named_server_freeze(named_g_server, false, lex, text);
+	} else if (command_compare(command, NAMED_COMMAND_TIMERPOKE)) {
+		isc_timermgr_poke(named_g_timermgr);
+		result = ISC_R_SUCCESS;
+	} else if (command_compare(command, NAMED_COMMAND_TRACE)) {
+		result = named_server_setdebuglevel(named_g_server, lex);
+	} else if (command_compare(command, NAMED_COMMAND_TSIGDELETE)) {
+		result = named_server_tsigdelete(named_g_server, lex, text);
+	} else if (command_compare(command, NAMED_COMMAND_TSIGLIST)) {
+		result = named_server_tsiglist(named_g_server, text);
+	} else if (command_compare(command, NAMED_COMMAND_VALIDATION)) {
+		result = named_server_validation(named_g_server, lex, text);
+	} else if (command_compare(command, NAMED_COMMAND_ZONESTATUS)) {
+		result = named_server_zonestatus(named_g_server, lex, text);
 	} else {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_CONTROL, ISC_LOG_WARNING,
@@ -90,7 +90,8 @@ EXTERN cfg_obj_t *		named_g_config		INIT(NULL);
 EXTERN const cfg_obj_t *	named_g_defaults	INIT(NULL);
 EXTERN const char *		named_g_conffile	INIT(NAMED_SYSCONFDIR
 							     "/named.conf");
-EXTERN cfg_obj_t *		named_g_bindkeys	INIT(NULL);
+EXTERN const char *		named_g_defaultbindkeys	INIT(NAMED_SYSCONFDIR
+							     "/bind.keys");
 EXTERN const char *		named_g_keyfile		INIT(NAMED_SYSCONFDIR
 							     "/rndc.key");

@@ -78,6 +78,7 @@ struct named_server {

 	isc_mutex_t		reload_event_lock;
 	isc_event_t *		reload_event;
+	bool			reload_in_progress;

 	bool		flushonshutdown;

@@ -157,6 +157,7 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *logconfig) {
 			break;
 		default:
 			INSIST(0);
+			ISC_UNREACHABLE();
 		}

 		type = ISC_LOG_TOFILE;
@@ -445,6 +445,98 @@ set_flags(const char *arg, struct flag_def *defs, unsigned int *ret) {
 		*ret = 0;
 }

+static void
+printversion(bool verbose) {
+	char rndcconf[PATH_MAX], *dot = NULL;
+
+	printf("%s %s%s%s <id:%s>\n",
+	       named_g_product, named_g_version,
+	       (*named_g_description != '\0') ? " " : "",
+	       named_g_description, named_g_srcid);
+
+	if (!verbose) {
+		return;
+	}
+
+	printf("running on %s\n", named_os_uname());
+	printf("built by %s with %s\n",
+	       named_g_builder, named_g_configargs);
+#ifdef __clang__
+	printf("compiled by CLANG %s\n", __VERSION__);
+#else
+#if defined(__ICC) || defined(__INTEL_COMPILER)
+	printf("compiled by ICC %s\n", __VERSION__);
+#else
+#ifdef __GNUC__
+	printf("compiled by GCC %s\n", __VERSION__);
+#endif
+#endif
+#endif
+#ifdef _MSC_VER
+	printf("compiled by MSVC %d\n", _MSC_VER);
+#endif
+#ifdef __SUNPRO_C
+	printf("compiled by Solaris Studio %x\n", __SUNPRO_C);
+#endif
+	printf("compiled with OpenSSL version: %s\n",
+	       OPENSSL_VERSION_TEXT);
+#if !defined(LIBRESSL_VERSION_NUMBER) && \
+OPENSSL_VERSION_NUMBER >= 0x10100000L /* 1.1.0 or higher */
+	printf("linked to OpenSSL version: %s\n",
+	       OpenSSL_version(OPENSSL_VERSION));
+
+#else
+	printf("linked to OpenSSL version: %s\n",
+	       SSLeay_version(SSLEAY_VERSION));
+#endif /* OPENSSL_VERSION_NUMBER >= 0x10100000L */
+#ifdef HAVE_LIBXML2
+	printf("compiled with libxml2 version: %s\n",
+	       LIBXML_DOTTED_VERSION);
+	printf("linked to libxml2 version: %s\n",
+	       xmlParserVersion);
+#endif
+#if defined(HAVE_JSON) && defined(JSON_C_VERSION)
+	printf("compiled with libjson-c version: %s\n",
+	       JSON_C_VERSION);
+	printf("linked to libjson-c version: %s\n",
+	       json_c_version());
+#endif
+#if defined(HAVE_ZLIB) && defined(ZLIB_VERSION)
+	printf("compiled with zlib version: %s\n",
+	       ZLIB_VERSION);
+	printf("linked to zlib version: %s\n",
+	       zlibVersion());
+#endif
+	printf("threads support is enabled\n\n");
+
+
+	/*
+	 * The default rndc.conf and rndc.key paths are in the same
+	 * directory, but named only has rndc.key defined internally.
+	 * We construct the rndc.conf path from it. (We could use
+	 * NAMED_SYSCONFDIR here but the result would look wrong on
+	 * Windows.)
+	 */
+	strlcpy(rndcconf, named_g_keyfile, sizeof(rndcconf));
+	dot = strrchr(rndcconf, '.');
+	if (dot != NULL) {
+		size_t len = dot - rndcconf + 1;
+		snprintf(dot + 1, PATH_MAX - len, "conf");
+	}
+
+	/*
+	 * Print default configuration paths.
+	 */
+	printf("default paths:\n");
+	printf("  named configuration:  %s\n", named_g_conffile);
+	printf("  rndc configuration:   %s\n", rndcconf);
+	printf("  DNSSEC root key:      %s\n", named_g_defaultbindkeys);
+	printf("  nsupdate session key: %s\n", named_g_defaultsessionkeyfile);
+	printf("  named PID file:       %s\n", named_g_defaultpidfile);
+	printf("  named lock file:      %s\n", named_g_defaultlockfile);
+
+}
+
 static void
 parse_fuzz_arg(void) {
 	if (!strncmp(isc_commandline_argument, "client:", 7)) {
@@ -670,66 +762,10 @@ parse_command_line(int argc, char *argv[]) {
 			named_g_username = isc_commandline_argument;
 			break;
 		case 'v':
-			printf("%s %s%s%s <id:%s>\n",
-			       named_g_product, named_g_version,
-			       (*named_g_description != '\0') ? " " : "",
-			       named_g_description, named_g_srcid);
+			printversion(false);
 			exit(0);
 		case 'V':
-			printf("%s %s%s%s <id:%s>\n",
-			       named_g_product, named_g_version,
-			       (*named_g_description != '\0') ? " " : "",
-			       named_g_description, named_g_srcid);
-			printf("running on %s\n", named_os_uname());
-			printf("built by %s with %s\n",
-			       named_g_builder, named_g_configargs);
-#ifdef __clang__
-			printf("compiled by CLANG %s\n", __VERSION__);
-#else
-#if defined(__ICC) || defined(__INTEL_COMPILER)
-			printf("compiled by ICC %s\n", __VERSION__);
-#else
-#ifdef __GNUC__
-			printf("compiled by GCC %s\n", __VERSION__);
-#endif
-#endif
-#endif
-#ifdef _MSC_VER
-			printf("compiled by MSVC %d\n", _MSC_VER);
-#endif
-#ifdef __SUNPRO_C
-			printf("compiled by Solaris Studio %x\n", __SUNPRO_C);
-#endif
-			printf("compiled with OpenSSL version: %s\n",
-			       OPENSSL_VERSION_TEXT);
-#if !defined(LIBRESSL_VERSION_NUMBER) && \
-    OPENSSL_VERSION_NUMBER >= 0x10100000L /* 1.1.0 or higher */
-			printf("linked to OpenSSL version: %s\n",
-			       OpenSSL_version(OPENSSL_VERSION));
-
-#else
-			printf("linked to OpenSSL version: %s\n",
-			       SSLeay_version(SSLEAY_VERSION));
-#endif /* OPENSSL_VERSION_NUMBER >= 0x10100000L */
-#ifdef HAVE_LIBXML2
-			printf("compiled with libxml2 version: %s\n",
-			       LIBXML_DOTTED_VERSION);
-			printf("linked to libxml2 version: %s\n",
-			       xmlParserVersion);
-#endif
-#if defined(HAVE_JSON) && defined(JSON_C_VERSION)
-			printf("compiled with libjson-c version: %s\n",
-			       JSON_C_VERSION);
-			printf("linked to libjson-c version: %s\n",
-			       json_c_version());
-#endif
-#if defined(HAVE_ZLIB) && defined(ZLIB_VERSION)
-			printf("compiled with zlib version: %s\n",
-			       ZLIB_VERSION);
-			printf("linked to zlib version: %s\n",
-			       zlibVersion());
-#endif
-			printf("threads support is enabled\n");
+			printversion(true);
 			exit(0);
 		case 'x':
 			/* Obsolete. No longer in use. Ignore. */
@@ -793,10 +829,7 @@ create_managers(void) {
 	named_g_udpdisp = 1;
 #else
 	if (named_g_udpdisp == 0) {
-		if (named_g_cpus_detected == 1)
-			named_g_udpdisp = 1;
-		else
-			named_g_udpdisp = named_g_cpus_detected - 1;
+		named_g_udpdisp = named_g_cpus_detected;
 	}
 	if (named_g_udpdisp > named_g_cpus)
 		named_g_udpdisp = named_g_cpus;
@@ -824,7 +857,7 @@ create_managers(void) {
 	}

 	result = isc_socketmgr_create2(named_g_mctx, &named_g_socketmgr,
-				       maxsocks);
+				       maxsocks, named_g_cpus);
 	if (result != ISC_R_SUCCESS) {
 		UNEXPECTED_ERROR(__FILE__, __LINE__,
 				 "isc_socketmgr_create() failed: %s",
@@ -1068,14 +1101,20 @@ setup(void) {
 	/*
 	 * Get the initial resource limits.
 	 */
-	(void)isc_resource_getlimit(isc_resource_stacksize,
-				    &named_g_initstacksize);
-	(void)isc_resource_getlimit(isc_resource_datasize,
-				    &named_g_initdatasize);
-	(void)isc_resource_getlimit(isc_resource_coresize,
-				    &named_g_initcoresize);
-	(void)isc_resource_getlimit(isc_resource_openfiles,
-				    &named_g_initopenfiles);
+#ifndef WIN32
+	RUNTIME_CHECK(isc_resource_getlimit(isc_resource_stacksize,
+					    &named_g_initstacksize)
+		      == ISC_R_SUCCESS);
+	RUNTIME_CHECK(isc_resource_getlimit(isc_resource_datasize,
+					    &named_g_initdatasize)
+		      == ISC_R_SUCCESS);
+	RUNTIME_CHECK(isc_resource_getlimit(isc_resource_coresize,
+					    &named_g_initcoresize)
+		      == ISC_R_SUCCESS);
+#endif
+	RUNTIME_CHECK(isc_resource_getlimit(isc_resource_openfiles,
+					    &named_g_initopenfiles)
+		      == ISC_R_SUCCESS);

 	/*
 	 * System resources cannot effectively be tuned on some systems.
@@ -1083,8 +1122,9 @@ setup(void) {
 	 */
 	old_openfiles = named_g_initopenfiles;
 	named_os_adjustnofile();
-	(void)isc_resource_getlimit(isc_resource_openfiles,
-				    &named_g_initopenfiles);
+	RUNTIME_CHECK(isc_resource_getlimit(isc_resource_openfiles,
+					    &named_g_initopenfiles)
+		      == ISC_R_SUCCESS);
 	if (old_openfiles != named_g_initopenfiles) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000, 2001, 2003-2009, 2011, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000, 2001, 2003-2009, 2011, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -378,5 +378,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000, 2001, 2003-2009, 2011, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000, 2001, 2003-2009, 2011, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004-2018 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -10,12 +10,12 @@
 .\"     Title: named.conf
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
-.\"      Date: 2018-06-21
+.\"      Date: 2018-12-07
 .\"    Manual: BIND9
 .\"    Source: ISC
 .\"  Language: English
 .\"
-.TH "NAMED\&.CONF" "5" "2018\-06\-21" "ISC" "BIND9"
+.TH "NAMED\&.CONF" "5" "2018\-12\-07" "ISC" "BIND9"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -199,6 +199,7 @@ options {
 	    ] [ dscp \fIinteger\fR ];
 	alt\-transfer\-source\-v6 ( \fIipv6_address\fR | * ) [ port ( \fIinteger\fR |
 	    * ) ] [ dscp \fIinteger\fR ];
+	answer\-cookie \fIboolean\fR;
 	attach\-cache \fIstring\fR;
 	auth\-nxdomain \fIboolean\fR; // default changed
 	auto\-dnssec ( allow | maintain | off );
@@ -208,9 +209,9 @@ options {
 	bindkeys\-file \fIquoted_string\fR;
 	blackhole { \fIaddress_match_element\fR; \&.\&.\&. };
 	cache\-file \fIquoted_string\fR;
-	catalog\-zones { zone \fIquoted_string\fR [ default\-masters [ port
-	    \fIinteger\fR ] [ dscp \fIinteger\fR ] { ( \fImasters\fR | \fIipv4_address\fR [
-	    port \fIinteger\fR ] | \fIipv6_address\fR [ port \fIinteger\fR ] ) [ key
+	catalog\-zones { zone \fIstring\fR [ default\-masters [ port \fIinteger\fR ]
+	    [ dscp \fIinteger\fR ] { ( \fImasters\fR | \fIipv4_address\fR [ port
+	    \fIinteger\fR ] | \fIipv6_address\fR [ port \fIinteger\fR ] ) [ key
 	    \fIstring\fR ]; \&.\&.\&. } ] [ zone\-directory \fIquoted_string\fR ] [
 	    in\-memory \fIboolean\fR ] [ min\-update\-interval \fIttlval\fR ]; \&.\&.\&. };
 	check\-dup\-records ( fail | warn | ignore );
@@ -264,12 +265,15 @@ options {
 	dnssec\-secure\-to\-insecure \fIboolean\fR;
 	dnssec\-update\-mode ( maintain | no\-resign );
 	dnssec\-validation ( yes | no | auto );
-	dnstap { ( all | auth | client | forwarder | resolver ) [ ( query |
-	    response ) ]; \&.\&.\&. };
-	dnstap\-identity ( \fIquoted_string\fR | none | hostname );
-	dnstap\-output ( file | unix ) \fIquoted_string\fR [ size ( unlimited |
-	    \fIsize\fR ) ] [ versions ( unlimited | \fIinteger\fR ) ] [ suffix (
-	    increment | timestamp ) ];
+	dnstap { ( all | auth | client | forwarder |
+	    resolver | update ) [ ( query | response ) ];
+	    \&.\&.\&. };
+	dnstap\-identity ( \fIquoted_string\fR | none |
+	    hostname );
+	dnstap\-output ( file | unix ) \fIquoted_string\fR [
+	    size ( unlimited | \fIsize\fR ) ] [ versions (
+	    unlimited | \fIinteger\fR ) ] [ suffix ( increment
+	    | timestamp ) ];
 	dnstap\-version ( \fIquoted_string\fR | none );
 	dscp \fIinteger\fR;
 	dual\-stack\-servers [ port \fIinteger\fR ] { ( \fIquoted_string\fR [ port
@@ -285,9 +289,6 @@ options {
 	fetches\-per\-server \fIinteger\fR [ ( drop | fail ) ];
 	fetches\-per\-zone \fIinteger\fR [ ( drop | fail ) ];
 	files ( default | unlimited | \fIsizeval\fR );
-	filter\-aaaa { \fIaddress_match_element\fR; \&.\&.\&. };
-	filter\-aaaa\-on\-v4 ( break\-dnssec | \fIboolean\fR );
-	filter\-aaaa\-on\-v6 ( break\-dnssec | \fIboolean\fR );
 	flush\-zones\-on\-shutdown \fIboolean\fR;
 	forward ( first | only );
 	forwarders [ port \fIinteger\fR ] [ dscp \fIinteger\fR ] { ( \fIipv4_address\fR
@@ -343,6 +344,8 @@ options {
 	memstatistics \fIboolean\fR;
 	memstatistics\-file \fIquoted_string\fR;
 	message\-compression \fIboolean\fR;
+	min\-cache\-ttl \fIttlval\fR;
+	min\-ncache\-ttl \fIttlval\fR;
 	min\-refresh\-time \fIinteger\fR;
 	min\-retry\-time \fIinteger\fR;
 	minimal\-any \fIboolean\fR;
@@ -406,18 +409,17 @@ options {
 	resolver\-retry\-interval \fIinteger\fR;
 	response\-padding { \fIaddress_match_element\fR; \&.\&.\&. } block\-size
 	    \fIinteger\fR;
-	response\-policy { zone \fIquoted_string\fR [ log \fIboolean\fR ] [
-	    max\-policy\-ttl \fIttlval\fR ] [ min\-update\-interval \fIttlval\fR ] [
-	    policy ( cname | disabled | drop | given | no\-op | nodata |
-	    nxdomain | passthru | tcp\-only \fIquoted_string\fR ) ] [
-	    recursive\-only \fIboolean\fR ] [ nsip\-enable \fIboolean\fR ] [
-	    nsdname\-enable \fIboolean\fR ]; \&.\&.\&. } [ break\-dnssec \fIboolean\fR ] [
-	    max\-policy\-ttl \fIttlval\fR ] [ min\-update\-interval \fIttlval\fR ] [
-	    min\-ns\-dots \fIinteger\fR ] [ nsip\-wait\-recurse \fIboolean\fR ] [
-	    qname\-wait\-recurse \fIboolean\fR ] [ recursive\-only \fIboolean\fR ] [
-	    nsip\-enable \fIboolean\fR ] [ nsdname\-enable \fIboolean\fR ] [
-	    dnsrps\-enable \fIboolean\fR ] [ dnsrps\-options { \fIunspecified\-text\fR
-	    } ];
+	response\-policy { zone \fIstring\fR [ log \fIboolean\fR ] [ max\-policy\-ttl
+	    \fIttlval\fR ] [ min\-update\-interval \fIttlval\fR ] [ policy ( cname |
+	    disabled | drop | given | no\-op | nodata | nxdomain | passthru
+	    | tcp\-only \fIquoted_string\fR ) ] [ recursive\-only \fIboolean\fR ] [
+	    nsip\-enable \fIboolean\fR ] [ nsdname\-enable \fIboolean\fR ]; \&.\&.\&. } [
+	    break\-dnssec \fIboolean\fR ] [ max\-policy\-ttl \fIttlval\fR ] [
+	    min\-update\-interval \fIttlval\fR ] [ min\-ns\-dots \fIinteger\fR ] [
+	    nsip\-wait\-recurse \fIboolean\fR ] [ qname\-wait\-recurse \fIboolean\fR ]
+	    [ recursive\-only \fIboolean\fR ] [ nsip\-enable \fIboolean\fR ] [
+	    nsdname\-enable \fIboolean\fR ] [ dnsrps\-enable \fIboolean\fR ] [
+	    dnsrps\-options { \fIunspecified\-text\fR } ];
 	root\-delegation\-only [ exclude { \fIstring\fR; \&.\&.\&. } ];
 	root\-key\-sentinel \fIboolean\fR;
 	rrset\-order { [ class \fIstring\fR ] [ type \fIstring\fR ] [ name
@@ -478,6 +480,18 @@ options {
 .if n \{\
 .RE
 .\}
+.SH "PLUGIN"
+.sp
+.if n \{\
+.RS 4
+.\}
+.nf
+plugin ( query ) \fIstring\fR [ { \fIunspecified\-text\fR
+    } ];
+.fi
+.if n \{\
+.RE
+.\}
 .SH "SERVER"
 .sp
 .if n \{\
@@ -577,9 +591,9 @@ view \fIstring\fR [ \fIclass\fR ] {
 	auth\-nxdomain \fIboolean\fR; // default changed
 	auto\-dnssec ( allow | maintain | off );
 	cache\-file \fIquoted_string\fR;
-	catalog\-zones { zone \fIquoted_string\fR [ default\-masters [ port
-	    \fIinteger\fR ] [ dscp \fIinteger\fR ] { ( \fImasters\fR | \fIipv4_address\fR [
-	    port \fIinteger\fR ] | \fIipv6_address\fR [ port \fIinteger\fR ] ) [ key
+	catalog\-zones { zone \fIstring\fR [ default\-masters [ port \fIinteger\fR ]
+	    [ dscp \fIinteger\fR ] { ( \fImasters\fR | \fIipv4_address\fR [ port
+	    \fIinteger\fR ] | \fIipv6_address\fR [ port \fIinteger\fR ] ) [ key
 	    \fIstring\fR ]; \&.\&.\&. } ] [ zone\-directory \fIquoted_string\fR ] [
 	    in\-memory \fIboolean\fR ] [ min\-update\-interval \fIttlval\fR ]; \&.\&.\&. };
 	check\-dup\-records ( fail | warn | ignore );
@@ -632,8 +646,9 @@ view \fIstring\fR [ \fIclass\fR ] {
 	dnssec\-secure\-to\-insecure \fIboolean\fR;
 	dnssec\-update\-mode ( maintain | no\-resign );
 	dnssec\-validation ( yes | no | auto );
-	dnstap { ( all | auth | client | forwarder | resolver ) [ ( query |
-	    response ) ]; \&.\&.\&. };
+	dnstap { ( all | auth | client | forwarder |
+	    resolver | update ) [ ( query | response ) ];
+	    \&.\&.\&. };
 	dual\-stack\-servers [ port \fIinteger\fR ] { ( \fIquoted_string\fR [ port
 	    \fIinteger\fR ] [ dscp \fIinteger\fR ] | \fIipv4_address\fR [ port
 	    \fIinteger\fR ] [ dscp \fIinteger\fR ] | \fIipv6_address\fR [ port
@@ -647,9 +662,6 @@ view \fIstring\fR [ \fIclass\fR ] {
 	fetch\-quota\-params \fIinteger\fR \fIfixedpoint\fR \fIfixedpoint\fR \fIfixedpoint\fR;
 	fetches\-per\-server \fIinteger\fR [ ( drop | fail ) ];
 	fetches\-per\-zone \fIinteger\fR [ ( drop | fail ) ];
-	filter\-aaaa { \fIaddress_match_element\fR; \&.\&.\&. };
-	filter\-aaaa\-on\-v4 ( break\-dnssec | \fIboolean\fR );
-	filter\-aaaa\-on\-v6 ( break\-dnssec | \fIboolean\fR );
 	forward ( first | only );
 	forwarders [ port \fIinteger\fR ] [ dscp \fIinteger\fR ] { ( \fIipv4_address\fR
 	    | \fIipv6_address\fR ) [ port \fIinteger\fR ] [ dscp \fIinteger\fR ]; \&.\&.\&. };
@@ -690,6 +702,8 @@ view \fIstring\fR [ \fIclass\fR ] {
 	max\-udp\-size \fIinteger\fR;
 	max\-zone\-ttl ( unlimited | \fIttlval\fR );
 	message\-compression \fIboolean\fR;
+	min\-cache\-ttl \fIttlval\fR;
+	min\-ncache\-ttl \fIttlval\fR;
 	min\-refresh\-time \fIinteger\fR;
 	min\-retry\-time \fIinteger\fR;
 	minimal\-any \fIboolean\fR;
@@ -708,6 +722,8 @@ view \fIstring\fR [ \fIclass\fR ] {
 	nta\-lifetime \fIttlval\fR;
 	nta\-recheck \fIttlval\fR;
 	nxdomain\-redirect \fIstring\fR;
+	plugin ( query ) \fIstring\fR [ {
+	    \fIunspecified\-text\fR } ];
 	preferred\-glue \fIstring\fR;
 	prefetch \fIinteger\fR [ \fIinteger\fR ];
 	provide\-ixfr \fIboolean\fR;
@@ -745,18 +761,17 @@ view \fIstring\fR [ \fIclass\fR ] {
 	resolver\-retry\-interval \fIinteger\fR;
 	response\-padding { \fIaddress_match_element\fR; \&.\&.\&. } block\-size
 	    \fIinteger\fR;
-	response\-policy { zone \fIquoted_string\fR [ log \fIboolean\fR ] [
-	    max\-policy\-ttl \fIttlval\fR ] [ min\-update\-interval \fIttlval\fR ] [
-	    policy ( cname | disabled | drop | given | no\-op | nodata |
-	    nxdomain | passthru | tcp\-only \fIquoted_string\fR ) ] [
-	    recursive\-only \fIboolean\fR ] [ nsip\-enable \fIboolean\fR ] [
-	    nsdname\-enable \fIboolean\fR ]; \&.\&.\&. } [ break\-dnssec \fIboolean\fR ] [
-	    max\-policy\-ttl \fIttlval\fR ] [ min\-update\-interval \fIttlval\fR ] [
-	    min\-ns\-dots \fIinteger\fR ] [ nsip\-wait\-recurse \fIboolean\fR ] [
-	    qname\-wait\-recurse \fIboolean\fR ] [ recursive\-only \fIboolean\fR ] [
-	    nsip\-enable \fIboolean\fR ] [ nsdname\-enable \fIboolean\fR ] [
-	    dnsrps\-enable \fIboolean\fR ] [ dnsrps\-options { \fIunspecified\-text\fR
-	    } ];
+	response\-policy { zone \fIstring\fR [ log \fIboolean\fR ] [ max\-policy\-ttl
+	    \fIttlval\fR ] [ min\-update\-interval \fIttlval\fR ] [ policy ( cname |
+	    disabled | drop | given | no\-op | nodata | nxdomain | passthru
+	    | tcp\-only \fIquoted_string\fR ) ] [ recursive\-only \fIboolean\fR ] [
+	    nsip\-enable \fIboolean\fR ] [ nsdname\-enable \fIboolean\fR ]; \&.\&.\&. } [
+	    break\-dnssec \fIboolean\fR ] [ max\-policy\-ttl \fIttlval\fR ] [
+	    min\-update\-interval \fIttlval\fR ] [ min\-ns\-dots \fIinteger\fR ] [
+	    nsip\-wait\-recurse \fIboolean\fR ] [ qname\-wait\-recurse \fIboolean\fR ]
+	    [ recursive\-only \fIboolean\fR ] [ nsip\-enable \fIboolean\fR ] [
+	    nsdname\-enable \fIboolean\fR ] [ dnsrps\-enable \fIboolean\fR ] [
+	    dnsrps\-options { \fIunspecified\-text\fR } ];
 	root\-delegation\-only [ exclude { \fIstring\fR; \&.\&.\&. } ];
 	root\-key\-sentinel \fIboolean\fR;
 	rrset\-order { [ class \fIstring\fR ] [ type \fIstring\fR ] [ name
@@ -892,9 +907,7 @@ view \fIstring\fR [ \fIclass\fR ] {
 		notify\-source\-v6 ( \fIipv6_address\fR | * ) [ port ( \fIinteger\fR
 		    | * ) ] [ dscp \fIinteger\fR ];
 		notify\-to\-soa \fIboolean\fR;
-		pubkey \fIinteger\fR
-		    \fIinteger\fR
-		    \fIinteger\fR
+		pubkey \fIinteger\fR \fIinteger\fR \fIinteger\fR
 		request\-expire \fIboolean\fR;
 		request\-ixfr \fIboolean\fR;
 		serial\-update\-method ( date | increment | unixtime );
@@ -914,10 +927,10 @@ view \fIstring\fR [ \fIclass\fR ] {
 		    static\-stub | stub );
 		update\-check\-ksk \fIboolean\fR;
 		update\-policy ( local | { ( deny | grant ) \fIstring\fR (
-		    6to4\-self | external | krb5\-self | krb5\-subdomain |
-		    ms\-self | ms\-subdomain | name | self | selfsub |
-		    selfwild | subdomain | tcp\-self | wildcard | zonesub )
-		    [ \fIstring\fR ] \fIrrtypelist\fR; \&.\&.\&. };
+		    6to4\-self | external | krb5\-self | krb5\-selfsub |
+		    krb5\-subdomain | ms\-self | ms\-selfsub | ms\-subdomain |
+		    name | self | selfsub | selfwild | subdomain | tcp\-self
+		    | wildcard | zonesub ) [ \fIstring\fR ] \fIrrtypelist\fR; \&.\&.\&. };
 		use\-alt\-transfer\-source \fIboolean\fR;
 		zero\-no\-soa\-ttl \fIboolean\fR;
 		zone\-statistics ( full | terse | none | \fIboolean\fR );
@@ -1000,7 +1013,6 @@ zone \fIstring\fR [ \fIclass\fR ] {
 	notify\-source\-v6 ( \fIipv6_address\fR | * ) [ port ( \fIinteger\fR | * ) ]
 	    [ dscp \fIinteger\fR ];
 	notify\-to\-soa \fIboolean\fR;
-	pubkey \fIinteger\fR \fIinteger\fR
 	request\-expire \fIboolean\fR;
 	request\-ixfr \fIboolean\fR;
 	serial\-update\-method ( date | increment | unixtime );
@@ -1020,9 +1032,10 @@ zone \fIstring\fR [ \fIclass\fR ] {
 	    stub );
 	update\-check\-ksk \fIboolean\fR;
 	update\-policy ( local | { ( deny | grant ) \fIstring\fR ( 6to4\-self |
-	    external | krb5\-self | krb5\-subdomain | ms\-self | ms\-subdomain
-	    | name | self | selfsub | selfwild | subdomain | tcp\-self |
-	    wildcard | zonesub ) [ \fIstring\fR ] \fIrrtypelist\fR; \&.\&.\&. };
+	    external | krb5\-self | krb5\-selfsub | krb5\-subdomain | ms\-self
+	    | ms\-selfsub | ms\-subdomain | name | self | selfsub | selfwild
+	    | subdomain | tcp\-self | wildcard | zonesub ) [ \fIstring\fR ]
+	    \fIrrtypelist\fR; \&.\&.\&. };
 	use\-alt\-transfer\-source \fIboolean\fR;
 	zero\-no\-soa\-ttl \fIboolean\fR;
 	zone\-statistics ( full | terse | none | \fIboolean\fR );
@@ -1047,5 +1060,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2004-2018 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004-2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -13,7 +13,7 @@

 <refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.named.conf">
  <info>
-    <date>2018-10-23</date>
+    <date>2018-12-07</date>
  </info>
  <refentryinfo>
    <corpname>ISC</corpname>
@@ -48,6 +48,7 @@
      <year>2016</year>
      <year>2017</year>
      <year>2018</year>
+      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -202,9 +203,9 @@ options {
 	bindkeys-file <replaceable>quoted_string</replaceable>;
 	blackhole { <replaceable>address_match_element</replaceable>; ... };
 	cache-file <replaceable>quoted_string</replaceable>;
-	catalog-zones { zone <replaceable>quoted_string</replaceable> [ default-masters [ port
-	    <replaceable>integer</replaceable> ] [ dscp <replaceable>integer</replaceable> ] { ( <replaceable>masters</replaceable> | <replaceable>ipv4_address</replaceable> [
-	    port <replaceable>integer</replaceable> ] | <replaceable>ipv6_address</replaceable> [ port <replaceable>integer</replaceable> ] ) [ key
+	catalog-zones { zone <replaceable>string</replaceable> [ default-masters [ port <replaceable>integer</replaceable> ]
+	    [ dscp <replaceable>integer</replaceable> ] { ( <replaceable>masters</replaceable> | <replaceable>ipv4_address</replaceable> [ port
+	    <replaceable>integer</replaceable> ] | <replaceable>ipv6_address</replaceable> [ port <replaceable>integer</replaceable> ] ) [ key
 	    <replaceable>string</replaceable> ]; ... } ] [ zone-directory <replaceable>quoted_string</replaceable> ] [
 	    in-memory <replaceable>boolean</replaceable> ] [ min-update-interval <replaceable>ttlval</replaceable> ]; ... };
 	check-dup-records ( fail | warn | ignore );
@@ -258,12 +259,15 @@ options {
 	dnssec-secure-to-insecure <replaceable>boolean</replaceable>;
 	dnssec-update-mode ( maintain | no-resign );
 	dnssec-validation ( yes | no | auto );
-	dnstap { ( all | auth | client | forwarder | resolver | update ) [
-	    ( query | response ) ]; ... };
-	dnstap-identity ( <replaceable>quoted_string</replaceable> | none | hostname );
-	dnstap-output ( file | unix ) <replaceable>quoted_string</replaceable> [ size ( unlimited |
-	    <replaceable>size</replaceable> ) ] [ versions ( unlimited | <replaceable>integer</replaceable> ) ] [ suffix (
-	    increment | timestamp ) ];
+	dnstap { ( all | auth | client | forwarder |
+	    resolver | update ) [ ( query | response ) ];
+	    ... };
+	dnstap-identity ( <replaceable>quoted_string</replaceable> | none |
+	    hostname );
+	dnstap-output ( file | unix ) <replaceable>quoted_string</replaceable> [
+	    size ( unlimited | <replaceable>size</replaceable> ) ] [ versions (
+	    unlimited | <replaceable>integer</replaceable> ) ] [ suffix ( increment
+	    | timestamp ) ];
 	dnstap-version ( <replaceable>quoted_string</replaceable> | none );
 	dscp <replaceable>integer</replaceable>;
 	dual-stack-servers [ port <replaceable>integer</replaceable> ] { ( <replaceable>quoted_string</replaceable> [ port
@@ -279,9 +283,6 @@ options {
 	fetches-per-server <replaceable>integer</replaceable> [ ( drop | fail ) ];
 	fetches-per-zone <replaceable>integer</replaceable> [ ( drop | fail ) ];
 	files ( default | unlimited | <replaceable>sizeval</replaceable> );
-	filter-aaaa { <replaceable>address_match_element</replaceable>; ... };
-	filter-aaaa-on-v4 ( break-dnssec | <replaceable>boolean</replaceable> );
-	filter-aaaa-on-v6 ( break-dnssec | <replaceable>boolean</replaceable> );
 	flush-zones-on-shutdown <replaceable>boolean</replaceable>;
 	forward ( first | only );
 	forwarders [ port <replaceable>integer</replaceable> ] [ dscp <replaceable>integer</replaceable> ] { ( <replaceable>ipv4_address</replaceable>
@@ -337,6 +338,8 @@ options {
 	memstatistics <replaceable>boolean</replaceable>;
 	memstatistics-file <replaceable>quoted_string</replaceable>;
 	message-compression <replaceable>boolean</replaceable>;
+	min-cache-ttl <replaceable>ttlval</replaceable>;
+	min-ncache-ttl <replaceable>ttlval</replaceable>;
 	min-refresh-time <replaceable>integer</replaceable>;
 	min-retry-time <replaceable>integer</replaceable>;
 	minimal-any <replaceable>boolean</replaceable>;
@@ -400,18 +403,17 @@ options {
 	resolver-retry-interval <replaceable>integer</replaceable>;
 	response-padding { <replaceable>address_match_element</replaceable>; ... } block-size
 	    <replaceable>integer</replaceable>;
-	response-policy { zone <replaceable>quoted_string</replaceable> [ log <replaceable>boolean</replaceable> ] [
-	    max-policy-ttl <replaceable>ttlval</replaceable> ] [ min-update-interval <replaceable>ttlval</replaceable> ] [
-	    policy ( cname | disabled | drop | given | no-op | nodata |
-	    nxdomain | passthru | tcp-only <replaceable>quoted_string</replaceable> ) ] [
-	    recursive-only <replaceable>boolean</replaceable> ] [ nsip-enable <replaceable>boolean</replaceable> ] [
-	    nsdname-enable <replaceable>boolean</replaceable> ]; ... } [ break-dnssec <replaceable>boolean</replaceable> ] [
-	    max-policy-ttl <replaceable>ttlval</replaceable> ] [ min-update-interval <replaceable>ttlval</replaceable> ] [
-	    min-ns-dots <replaceable>integer</replaceable> ] [ nsip-wait-recurse <replaceable>boolean</replaceable> ] [
-	    qname-wait-recurse <replaceable>boolean</replaceable> ] [ recursive-only <replaceable>boolean</replaceable> ] [
-	    nsip-enable <replaceable>boolean</replaceable> ] [ nsdname-enable <replaceable>boolean</replaceable> ] [
-	    dnsrps-enable <replaceable>boolean</replaceable> ] [ dnsrps-options { <replaceable>unspecified-text</replaceable>
-	    } ];
+	response-policy { zone <replaceable>string</replaceable> [ log <replaceable>boolean</replaceable> ] [ max-policy-ttl
+	    <replaceable>ttlval</replaceable> ] [ min-update-interval <replaceable>ttlval</replaceable> ] [ policy ( cname |
+	    disabled | drop | given | no-op | nodata | nxdomain | passthru
+	    | tcp-only <replaceable>quoted_string</replaceable> ) ] [ recursive-only <replaceable>boolean</replaceable> ] [
+	    nsip-enable <replaceable>boolean</replaceable> ] [ nsdname-enable <replaceable>boolean</replaceable> ]; ... } [
+	    break-dnssec <replaceable>boolean</replaceable> ] [ max-policy-ttl <replaceable>ttlval</replaceable> ] [
+	    min-update-interval <replaceable>ttlval</replaceable> ] [ min-ns-dots <replaceable>integer</replaceable> ] [
+	    nsip-wait-recurse <replaceable>boolean</replaceable> ] [ qname-wait-recurse <replaceable>boolean</replaceable> ]
+	    [ recursive-only <replaceable>boolean</replaceable> ] [ nsip-enable <replaceable>boolean</replaceable> ] [
+	    nsdname-enable <replaceable>boolean</replaceable> ] [ dnsrps-enable <replaceable>boolean</replaceable> ] [
+	    dnsrps-options { <replaceable>unspecified-text</replaceable> } ];
 	root-delegation-only [ exclude { <replaceable>string</replaceable>; ... } ];
 	root-key-sentinel <replaceable>boolean</replaceable>;
 	rrset-order { [ class <replaceable>string</replaceable> ] [ type <replaceable>string</replaceable> ] [ name
@@ -471,6 +473,14 @@ options {
 </literallayout>
  </refsection>

+  <refsection><info><title>PLUGIN</title></info>
+
+    <literallayout class="normal">
+plugin ( query ) <replaceable>string</replaceable> [ { <replaceable>unspecified-text</replaceable>
+    } ];
+</literallayout>
+  </refsection>
+
  <refsection><info><title>SERVER</title></info>

    <literallayout class="normal">
@@ -555,9 +565,9 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	auth-nxdomain <replaceable>boolean</replaceable>; // default changed
 	auto-dnssec ( allow | maintain | off );
 	cache-file <replaceable>quoted_string</replaceable>;
-	catalog-zones { zone <replaceable>quoted_string</replaceable> [ default-masters [ port
-	    <replaceable>integer</replaceable> ] [ dscp <replaceable>integer</replaceable> ] { ( <replaceable>masters</replaceable> | <replaceable>ipv4_address</replaceable> [
-	    port <replaceable>integer</replaceable> ] | <replaceable>ipv6_address</replaceable> [ port <replaceable>integer</replaceable> ] ) [ key
+	catalog-zones { zone <replaceable>string</replaceable> [ default-masters [ port <replaceable>integer</replaceable> ]
+	    [ dscp <replaceable>integer</replaceable> ] { ( <replaceable>masters</replaceable> | <replaceable>ipv4_address</replaceable> [ port
+	    <replaceable>integer</replaceable> ] | <replaceable>ipv6_address</replaceable> [ port <replaceable>integer</replaceable> ] ) [ key
 	    <replaceable>string</replaceable> ]; ... } ] [ zone-directory <replaceable>quoted_string</replaceable> ] [
 	    in-memory <replaceable>boolean</replaceable> ] [ min-update-interval <replaceable>ttlval</replaceable> ]; ... };
 	check-dup-records ( fail | warn | ignore );
@@ -610,8 +620,9 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	dnssec-secure-to-insecure <replaceable>boolean</replaceable>;
 	dnssec-update-mode ( maintain | no-resign );
 	dnssec-validation ( yes | no | auto );
-	dnstap { ( all | auth | client | forwarder | resolver | update ) [
-	    ( query | response ) ]; ... };
+	dnstap { ( all | auth | client | forwarder |
+	    resolver | update ) [ ( query | response ) ];
+	    ... };
 	dual-stack-servers [ port <replaceable>integer</replaceable> ] { ( <replaceable>quoted_string</replaceable> [ port
 	    <replaceable>integer</replaceable> ] [ dscp <replaceable>integer</replaceable> ] | <replaceable>ipv4_address</replaceable> [ port
 	    <replaceable>integer</replaceable> ] [ dscp <replaceable>integer</replaceable> ] | <replaceable>ipv6_address</replaceable> [ port
@@ -625,9 +636,6 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	fetch-quota-params <replaceable>integer</replaceable> <replaceable>fixedpoint</replaceable> <replaceable>fixedpoint</replaceable> <replaceable>fixedpoint</replaceable>;
 	fetches-per-server <replaceable>integer</replaceable> [ ( drop | fail ) ];
 	fetches-per-zone <replaceable>integer</replaceable> [ ( drop | fail ) ];
-	filter-aaaa { <replaceable>address_match_element</replaceable>; ... };
-	filter-aaaa-on-v4 ( break-dnssec | <replaceable>boolean</replaceable> );
-	filter-aaaa-on-v6 ( break-dnssec | <replaceable>boolean</replaceable> );
 	forward ( first | only );
 	forwarders [ port <replaceable>integer</replaceable> ] [ dscp <replaceable>integer</replaceable> ] { ( <replaceable>ipv4_address</replaceable>
 	    | <replaceable>ipv6_address</replaceable> ) [ port <replaceable>integer</replaceable> ] [ dscp <replaceable>integer</replaceable> ]; ... };
@@ -668,6 +676,8 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	max-udp-size <replaceable>integer</replaceable>;
 	max-zone-ttl ( unlimited | <replaceable>ttlval</replaceable> );
 	message-compression <replaceable>boolean</replaceable>;
+	min-cache-ttl <replaceable>ttlval</replaceable>;
+	min-ncache-ttl <replaceable>ttlval</replaceable>;
 	min-refresh-time <replaceable>integer</replaceable>;
 	min-retry-time <replaceable>integer</replaceable>;
 	minimal-any <replaceable>boolean</replaceable>;
@@ -686,6 +696,8 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	nta-lifetime <replaceable>ttlval</replaceable>;
 	nta-recheck <replaceable>ttlval</replaceable>;
 	nxdomain-redirect <replaceable>string</replaceable>;
+	plugin ( query ) <replaceable>string</replaceable> [ {
+	    <replaceable>unspecified-text</replaceable> } ];
 	preferred-glue <replaceable>string</replaceable>;
 	prefetch <replaceable>integer</replaceable> [ <replaceable>integer</replaceable> ];
 	provide-ixfr <replaceable>boolean</replaceable>;
@@ -723,18 +735,17 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	resolver-retry-interval <replaceable>integer</replaceable>;
 	response-padding { <replaceable>address_match_element</replaceable>; ... } block-size
 	    <replaceable>integer</replaceable>;
-	response-policy { zone <replaceable>quoted_string</replaceable> [ log <replaceable>boolean</replaceable> ] [
-	    max-policy-ttl <replaceable>ttlval</replaceable> ] [ min-update-interval <replaceable>ttlval</replaceable> ] [
-	    policy ( cname | disabled | drop | given | no-op | nodata |
-	    nxdomain | passthru | tcp-only <replaceable>quoted_string</replaceable> ) ] [
-	    recursive-only <replaceable>boolean</replaceable> ] [ nsip-enable <replaceable>boolean</replaceable> ] [
-	    nsdname-enable <replaceable>boolean</replaceable> ]; ... } [ break-dnssec <replaceable>boolean</replaceable> ] [
-	    max-policy-ttl <replaceable>ttlval</replaceable> ] [ min-update-interval <replaceable>ttlval</replaceable> ] [
-	    min-ns-dots <replaceable>integer</replaceable> ] [ nsip-wait-recurse <replaceable>boolean</replaceable> ] [
-	    qname-wait-recurse <replaceable>boolean</replaceable> ] [ recursive-only <replaceable>boolean</replaceable> ] [
-	    nsip-enable <replaceable>boolean</replaceable> ] [ nsdname-enable <replaceable>boolean</replaceable> ] [
-	    dnsrps-enable <replaceable>boolean</replaceable> ] [ dnsrps-options { <replaceable>unspecified-text</replaceable>
-	    } ];
+	response-policy { zone <replaceable>string</replaceable> [ log <replaceable>boolean</replaceable> ] [ max-policy-ttl
+	    <replaceable>ttlval</replaceable> ] [ min-update-interval <replaceable>ttlval</replaceable> ] [ policy ( cname |
+	    disabled | drop | given | no-op | nodata | nxdomain | passthru
+	    | tcp-only <replaceable>quoted_string</replaceable> ) ] [ recursive-only <replaceable>boolean</replaceable> ] [
+	    nsip-enable <replaceable>boolean</replaceable> ] [ nsdname-enable <replaceable>boolean</replaceable> ]; ... } [
+	    break-dnssec <replaceable>boolean</replaceable> ] [ max-policy-ttl <replaceable>ttlval</replaceable> ] [
+	    min-update-interval <replaceable>ttlval</replaceable> ] [ min-ns-dots <replaceable>integer</replaceable> ] [
+	    nsip-wait-recurse <replaceable>boolean</replaceable> ] [ qname-wait-recurse <replaceable>boolean</replaceable> ]
+	    [ recursive-only <replaceable>boolean</replaceable> ] [ nsip-enable <replaceable>boolean</replaceable> ] [
+	    nsdname-enable <replaceable>boolean</replaceable> ] [ dnsrps-enable <replaceable>boolean</replaceable> ] [
+	    dnsrps-options { <replaceable>unspecified-text</replaceable> } ];
 	root-delegation-only [ exclude { <replaceable>string</replaceable>; ... } ];
 	root-key-sentinel <replaceable>boolean</replaceable>;
 	rrset-order { [ class <replaceable>string</replaceable> ] [ type <replaceable>string</replaceable> ] [ name
@@ -870,9 +881,7 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 		notify-source-v6 ( <replaceable>ipv6_address</replaceable> | * ) [ port ( <replaceable>integer</replaceable>
 		    | * ) ] [ dscp <replaceable>integer</replaceable> ];
 		notify-to-soa <replaceable>boolean</replaceable>;
-		pubkey <replaceable>integer</replaceable>
-		    <replaceable>integer</replaceable>
-		    <replaceable>integer</replaceable>
+		pubkey <replaceable>integer</replaceable> <replaceable>integer</replaceable> <replaceable>integer</replaceable>
 		request-expire <replaceable>boolean</replaceable>;
 		request-ixfr <replaceable>boolean</replaceable>;
 		serial-update-method ( date | increment | unixtime );
@@ -974,7 +983,6 @@ zone <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	notify-source-v6 ( <replaceable>ipv6_address</replaceable> | * ) [ port ( <replaceable>integer</replaceable> | * ) ]
 	    [ dscp <replaceable>integer</replaceable> ];
 	notify-to-soa <replaceable>boolean</replaceable>;
-	pubkey <replaceable>integer</replaceable> <replaceable>integer</replaceable>
 	request-expire <replaceable>boolean</replaceable>;
 	request-ixfr <replaceable>boolean</replaceable>;
 	serial-update-method ( date | increment | unixtime );
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2004-2018 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -180,6 +180,7 @@ options
 	    ] [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
 	alt-transfer-source-v6 ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [ port ( <em class="replaceable"><code>integer</code></em> |<br>
 	    * ) ] [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
+	answer-cookie <em class="replaceable"><code>boolean</code></em>;<br>
 	attach-cache <em class="replaceable"><code>string</code></em>;<br>
 	auth-nxdomain <em class="replaceable"><code>boolean</code></em>; // default changed<br>
 	auto-dnssec ( allow | maintain | off );<br>
@@ -189,9 +190,9 @@ options
 	bindkeys-file <em class="replaceable"><code>quoted_string</code></em>;<br>
 	blackhole { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
 	cache-file <em class="replaceable"><code>quoted_string</code></em>;<br>
-	catalog-zones { zone <em class="replaceable"><code>quoted_string</code></em> [ default-masters [ port<br>
-	    <em class="replaceable"><code>integer</code></em> ] [ dscp <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [<br>
-	    port <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv6_address</code></em> [ port <em class="replaceable"><code>integer</code></em> ] ) [ key<br>
+	catalog-zones { zone <em class="replaceable"><code>string</code></em> [ default-masters [ port <em class="replaceable"><code>integer</code></em> ]<br>
+	    [ dscp <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [ port<br>
+	    <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv6_address</code></em> [ port <em class="replaceable"><code>integer</code></em> ] ) [ key<br>
 	    <em class="replaceable"><code>string</code></em> ]; ... } ] [ zone-directory <em class="replaceable"><code>quoted_string</code></em> ] [<br>
 	    in-memory <em class="replaceable"><code>boolean</code></em> ] [ min-update-interval <em class="replaceable"><code>ttlval</code></em> ]; ... };<br>
 	check-dup-records ( fail | warn | ignore );<br>
@@ -245,12 +246,15 @@ options
 	dnssec-secure-to-insecure <em class="replaceable"><code>boolean</code></em>;<br>
 	dnssec-update-mode ( maintain | no-resign );<br>
 	dnssec-validation ( yes | no | auto );<br>
-	dnstap { ( all | auth | client | forwarder | resolver ) [ ( query |<br>
-	    response ) ]; ... };<br>
-	dnstap-identity ( <em class="replaceable"><code>quoted_string</code></em> | none | hostname );<br>
-	dnstap-output ( file | unix ) <em class="replaceable"><code>quoted_string</code></em> [ size ( unlimited |<br>
-	    <em class="replaceable"><code>size</code></em> ) ] [ versions ( unlimited | <em class="replaceable"><code>integer</code></em> ) ] [ suffix (<br>
-	    increment | timestamp ) ];<br>
+	dnstap { ( all | auth | client | forwarder |<br>
+	    resolver | update ) [ ( query | response ) ];<br>
+	    ... };<br>
+	dnstap-identity ( <em class="replaceable"><code>quoted_string</code></em> | none |<br>
+	    hostname );<br>
+	dnstap-output ( file | unix ) <em class="replaceable"><code>quoted_string</code></em> [<br>
+	    size ( unlimited | <em class="replaceable"><code>size</code></em> ) ] [ versions (<br>
+	    unlimited | <em class="replaceable"><code>integer</code></em> ) ] [ suffix ( increment<br>
+	    | timestamp ) ];<br>
 	dnstap-version ( <em class="replaceable"><code>quoted_string</code></em> | none );<br>
 	dscp <em class="replaceable"><code>integer</code></em>;<br>
 	dual-stack-servers [ port <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>quoted_string</code></em> [ port<br>
@@ -266,9 +270,6 @@ options
 	fetches-per-server <em class="replaceable"><code>integer</code></em> [ ( drop | fail ) ];<br>
 	fetches-per-zone <em class="replaceable"><code>integer</code></em> [ ( drop | fail ) ];<br>
 	files ( default | unlimited | <em class="replaceable"><code>sizeval</code></em> );<br>
-	filter-aaaa { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
-	filter-aaaa-on-v4 ( break-dnssec | <em class="replaceable"><code>boolean</code></em> );<br>
-	filter-aaaa-on-v6 ( break-dnssec | <em class="replaceable"><code>boolean</code></em> );<br>
 	flush-zones-on-shutdown <em class="replaceable"><code>boolean</code></em>;<br>
 	forward ( first | only );<br>
 	forwarders [ port <em class="replaceable"><code>integer</code></em> ] [ dscp <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>ipv4_address</code></em><br>
@@ -324,6 +325,8 @@ options
 	memstatistics <em class="replaceable"><code>boolean</code></em>;<br>
 	memstatistics-file <em class="replaceable"><code>quoted_string</code></em>;<br>
 	message-compression <em class="replaceable"><code>boolean</code></em>;<br>
+	min-cache-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
+	min-ncache-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
 	min-refresh-time <em class="replaceable"><code>integer</code></em>;<br>
 	min-retry-time <em class="replaceable"><code>integer</code></em>;<br>
 	minimal-any <em class="replaceable"><code>boolean</code></em>;<br>
@@ -387,18 +390,17 @@ options
 	resolver-retry-interval <em class="replaceable"><code>integer</code></em>;<br>
 	response-padding { <em class="replaceable"><code>address_match_element</code></em>; ... } block-size<br>
 	    <em class="replaceable"><code>integer</code></em>;<br>
-	response-policy { zone <em class="replaceable"><code>quoted_string</code></em> [ log <em class="replaceable"><code>boolean</code></em> ] [<br>
-	    max-policy-ttl <em class="replaceable"><code>ttlval</code></em> ] [ min-update-interval <em class="replaceable"><code>ttlval</code></em> ] [<br>
-	    policy ( cname | disabled | drop | given | no-op | nodata |<br>
-	    nxdomain | passthru | tcp-only <em class="replaceable"><code>quoted_string</code></em> ) ] [<br>
-	    recursive-only <em class="replaceable"><code>boolean</code></em> ] [ nsip-enable <em class="replaceable"><code>boolean</code></em> ] [<br>
-	    nsdname-enable <em class="replaceable"><code>boolean</code></em> ]; ... } [ break-dnssec <em class="replaceable"><code>boolean</code></em> ] [<br>
-	    max-policy-ttl <em class="replaceable"><code>ttlval</code></em> ] [ min-update-interval <em class="replaceable"><code>ttlval</code></em> ] [<br>
-	    min-ns-dots <em class="replaceable"><code>integer</code></em> ] [ nsip-wait-recurse <em class="replaceable"><code>boolean</code></em> ] [<br>
-	    qname-wait-recurse <em class="replaceable"><code>boolean</code></em> ] [ recursive-only <em class="replaceable"><code>boolean</code></em> ] [<br>
-	    nsip-enable <em class="replaceable"><code>boolean</code></em> ] [ nsdname-enable <em class="replaceable"><code>boolean</code></em> ] [<br>
-	    dnsrps-enable <em class="replaceable"><code>boolean</code></em> ] [ dnsrps-options { <em class="replaceable"><code>unspecified-text</code></em><br>
-	    } ];<br>
+	response-policy { zone <em class="replaceable"><code>string</code></em> [ log <em class="replaceable"><code>boolean</code></em> ] [ max-policy-ttl<br>
+	    <em class="replaceable"><code>ttlval</code></em> ] [ min-update-interval <em class="replaceable"><code>ttlval</code></em> ] [ policy ( cname |<br>
+	    disabled | drop | given | no-op | nodata | nxdomain | passthru<br>
+	    | tcp-only <em class="replaceable"><code>quoted_string</code></em> ) ] [ recursive-only <em class="replaceable"><code>boolean</code></em> ] [<br>
+	    nsip-enable <em class="replaceable"><code>boolean</code></em> ] [ nsdname-enable <em class="replaceable"><code>boolean</code></em> ]; ... } [<br>
+	    break-dnssec <em class="replaceable"><code>boolean</code></em> ] [ max-policy-ttl <em class="replaceable"><code>ttlval</code></em> ] [<br>
+	    min-update-interval <em class="replaceable"><code>ttlval</code></em> ] [ min-ns-dots <em class="replaceable"><code>integer</code></em> ] [<br>
+	    nsip-wait-recurse <em class="replaceable"><code>boolean</code></em> ] [ qname-wait-recurse <em class="replaceable"><code>boolean</code></em> ]<br>
+	    [ recursive-only <em class="replaceable"><code>boolean</code></em> ] [ nsip-enable <em class="replaceable"><code>boolean</code></em> ] [<br>
+	    nsdname-enable <em class="replaceable"><code>boolean</code></em> ] [ dnsrps-enable <em class="replaceable"><code>boolean</code></em> ] [<br>
+	    dnsrps-options { <em class="replaceable"><code>unspecified-text</code></em> } ];<br>
 	root-delegation-only [ exclude { <em class="replaceable"><code>string</code></em>; ... } ];<br>
 	root-key-sentinel <em class="replaceable"><code>boolean</code></em>;<br>
 	rrset-order { [ class <em class="replaceable"><code>string</code></em> ] [ type <em class="replaceable"><code>string</code></em> ] [ name<br>
@@ -459,7 +461,16 @@ options
  </div>

  <div class="refsection">
-<a name="id-1.17"></a><h2>SERVER</h2>
+<a name="id-1.17"></a><h2>PLUGIN</h2>
+
+    <div class="literallayout"><p><br>
+plugin ( query ) <em class="replaceable"><code>string</code></em> [ { <em class="replaceable"><code>unspecified-text</code></em><br>
+    } ];<br>
+</p></div>
+  </div>
+
+  <div class="refsection">
+<a name="id-1.18"></a><h2>SERVER</h2>

    <div class="literallayout"><p><br>
 server <em class="replaceable"><code>netprefix</code></em> {<br>
@@ -498,7 +509,7 @@ server
  </div>

  <div class="refsection">
-<a name="id-1.18"></a><h2>STATISTICS-CHANNELS</h2>
+<a name="id-1.19"></a><h2>STATISTICS-CHANNELS</h2>

    <div class="literallayout"><p><br>
 statistics-channels {<br>
@@ -511,7 +522,7 @@ statistics-channels
  </div>

  <div class="refsection">
-<a name="id-1.19"></a><h2>TRUSTED-KEYS</h2>
+<a name="id-1.20"></a><h2>TRUSTED-KEYS</h2>

    <div class="literallayout"><p><br>
 trusted-keys { <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em><br>
@@ -520,7 +531,7 @@ trusted-keys
  </div>

  <div class="refsection">
-<a name="id-1.20"></a><h2>VIEW</h2>
+<a name="id-1.21"></a><h2>VIEW</h2>

    <div class="literallayout"><p><br>
 view <em class="replaceable"><code>string</code></em> [ <em class="replaceable"><code>class</code></em> ] {<br>
@@ -546,9 +557,9 @@ view
 	auth-nxdomain <em class="replaceable"><code>boolean</code></em>; // default changed<br>
 	auto-dnssec ( allow | maintain | off );<br>
 	cache-file <em class="replaceable"><code>quoted_string</code></em>;<br>
-	catalog-zones { zone <em class="replaceable"><code>quoted_string</code></em> [ default-masters [ port<br>
-	    <em class="replaceable"><code>integer</code></em> ] [ dscp <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [<br>
-	    port <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv6_address</code></em> [ port <em class="replaceable"><code>integer</code></em> ] ) [ key<br>
+	catalog-zones { zone <em class="replaceable"><code>string</code></em> [ default-masters [ port <em class="replaceable"><code>integer</code></em> ]<br>
+	    [ dscp <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [ port<br>
+	    <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv6_address</code></em> [ port <em class="replaceable"><code>integer</code></em> ] ) [ key<br>
 	    <em class="replaceable"><code>string</code></em> ]; ... } ] [ zone-directory <em class="replaceable"><code>quoted_string</code></em> ] [<br>
 	    in-memory <em class="replaceable"><code>boolean</code></em> ] [ min-update-interval <em class="replaceable"><code>ttlval</code></em> ]; ... };<br>
 	check-dup-records ( fail | warn | ignore );<br>
@@ -601,8 +612,9 @@ view
 	dnssec-secure-to-insecure <em class="replaceable"><code>boolean</code></em>;<br>
 	dnssec-update-mode ( maintain | no-resign );<br>
 	dnssec-validation ( yes | no | auto );<br>
-	dnstap { ( all | auth | client | forwarder | resolver ) [ ( query |<br>
-	    response ) ]; ... };<br>
+	dnstap { ( all | auth | client | forwarder |<br>
+	    resolver | update ) [ ( query | response ) ];<br>
+	    ... };<br>
 	dual-stack-servers [ port <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>quoted_string</code></em> [ port<br>
 	    <em class="replaceable"><code>integer</code></em> ] [ dscp <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv4_address</code></em> [ port<br>
 	    <em class="replaceable"><code>integer</code></em> ] [ dscp <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv6_address</code></em> [ port<br>
@@ -616,9 +628,6 @@ view
 	fetch-quota-params <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>fixedpoint</code></em> <em class="replaceable"><code>fixedpoint</code></em> <em class="replaceable"><code>fixedpoint</code></em>;<br>
 	fetches-per-server <em class="replaceable"><code>integer</code></em> [ ( drop | fail ) ];<br>
 	fetches-per-zone <em class="replaceable"><code>integer</code></em> [ ( drop | fail ) ];<br>
-	filter-aaaa { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
-	filter-aaaa-on-v4 ( break-dnssec | <em class="replaceable"><code>boolean</code></em> );<br>
-	filter-aaaa-on-v6 ( break-dnssec | <em class="replaceable"><code>boolean</code></em> );<br>
 	forward ( first | only );<br>
 	forwarders [ port <em class="replaceable"><code>integer</code></em> ] [ dscp <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>ipv4_address</code></em><br>
 	    | <em class="replaceable"><code>ipv6_address</code></em> ) [ port <em class="replaceable"><code>integer</code></em> ] [ dscp <em class="replaceable"><code>integer</code></em> ]; ... };<br>
@@ -659,6 +668,8 @@ view
 	max-udp-size <em class="replaceable"><code>integer</code></em>;<br>
 	max-zone-ttl ( unlimited | <em class="replaceable"><code>ttlval</code></em> );<br>
 	message-compression <em class="replaceable"><code>boolean</code></em>;<br>
+	min-cache-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
+	min-ncache-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
 	min-refresh-time <em class="replaceable"><code>integer</code></em>;<br>
 	min-retry-time <em class="replaceable"><code>integer</code></em>;<br>
 	minimal-any <em class="replaceable"><code>boolean</code></em>;<br>
@@ -677,6 +688,8 @@ view
 	nta-lifetime <em class="replaceable"><code>ttlval</code></em>;<br>
 	nta-recheck <em class="replaceable"><code>ttlval</code></em>;<br>
 	nxdomain-redirect <em class="replaceable"><code>string</code></em>;<br>
+	plugin ( query ) <em class="replaceable"><code>string</code></em> [ {<br>
+	    <em class="replaceable"><code>unspecified-text</code></em> } ];<br>
 	preferred-glue <em class="replaceable"><code>string</code></em>;<br>
 	prefetch <em class="replaceable"><code>integer</code></em> [ <em class="replaceable"><code>integer</code></em> ];<br>
 	provide-ixfr <em class="replaceable"><code>boolean</code></em>;<br>
@@ -714,18 +727,17 @@ view
 	resolver-retry-interval <em class="replaceable"><code>integer</code></em>;<br>
 	response-padding { <em class="replaceable"><code>address_match_element</code></em>; ... } block-size<br>
 	    <em class="replaceable"><code>integer</code></em>;<br>
-	response-policy { zone <em class="replaceable"><code>quoted_string</code></em> [ log <em class="replaceable"><code>boolean</code></em> ] [<br>
-	    max-policy-ttl <em class="replaceable"><code>ttlval</code></em> ] [ min-update-interval <em class="replaceable"><code>ttlval</code></em> ] [<br>
-	    policy ( cname | disabled | drop | given | no-op | nodata |<br>
-	    nxdomain | passthru | tcp-only <em class="replaceable"><code>quoted_string</code></em> ) ] [<br>
-	    recursive-only <em class="replaceable"><code>boolean</code></em> ] [ nsip-enable <em class="replaceable"><code>boolean</code></em> ] [<br>
-	    nsdname-enable <em class="replaceable"><code>boolean</code></em> ]; ... } [ break-dnssec <em class="replaceable"><code>boolean</code></em> ] [<br>
-	    max-policy-ttl <em class="replaceable"><code>ttlval</code></em> ] [ min-update-interval <em class="replaceable"><code>ttlval</code></em> ] [<br>
-	    min-ns-dots <em class="replaceable"><code>integer</code></em> ] [ nsip-wait-recurse <em class="replaceable"><code>boolean</code></em> ] [<br>
-	    qname-wait-recurse <em class="replaceable"><code>boolean</code></em> ] [ recursive-only <em class="replaceable"><code>boolean</code></em> ] [<br>
-	    nsip-enable <em class="replaceable"><code>boolean</code></em> ] [ nsdname-enable <em class="replaceable"><code>boolean</code></em> ] [<br>
-	    dnsrps-enable <em class="replaceable"><code>boolean</code></em> ] [ dnsrps-options { <em class="replaceable"><code>unspecified-text</code></em><br>
-	    } ];<br>
+	response-policy { zone <em class="replaceable"><code>string</code></em> [ log <em class="replaceable"><code>boolean</code></em> ] [ max-policy-ttl<br>
+	    <em class="replaceable"><code>ttlval</code></em> ] [ min-update-interval <em class="replaceable"><code>ttlval</code></em> ] [ policy ( cname |<br>
+	    disabled | drop | given | no-op | nodata | nxdomain | passthru<br>
+	    | tcp-only <em class="replaceable"><code>quoted_string</code></em> ) ] [ recursive-only <em class="replaceable"><code>boolean</code></em> ] [<br>
+	    nsip-enable <em class="replaceable"><code>boolean</code></em> ] [ nsdname-enable <em class="replaceable"><code>boolean</code></em> ]; ... } [<br>
+	    break-dnssec <em class="replaceable"><code>boolean</code></em> ] [ max-policy-ttl <em class="replaceable"><code>ttlval</code></em> ] [<br>
+	    min-update-interval <em class="replaceable"><code>ttlval</code></em> ] [ min-ns-dots <em class="replaceable"><code>integer</code></em> ] [<br>
+	    nsip-wait-recurse <em class="replaceable"><code>boolean</code></em> ] [ qname-wait-recurse <em class="replaceable"><code>boolean</code></em> ]<br>
+	    [ recursive-only <em class="replaceable"><code>boolean</code></em> ] [ nsip-enable <em class="replaceable"><code>boolean</code></em> ] [<br>
+	    nsdname-enable <em class="replaceable"><code>boolean</code></em> ] [ dnsrps-enable <em class="replaceable"><code>boolean</code></em> ] [<br>
+	    dnsrps-options { <em class="replaceable"><code>unspecified-text</code></em> } ];<br>
 	root-delegation-only [ exclude { <em class="replaceable"><code>string</code></em>; ... } ];<br>
 	root-key-sentinel <em class="replaceable"><code>boolean</code></em>;<br>
 	rrset-order { [ class <em class="replaceable"><code>string</code></em> ] [ type <em class="replaceable"><code>string</code></em> ] [ name<br>
@@ -861,9 +873,7 @@ view
 		notify-source-v6 ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [ port ( <em class="replaceable"><code>integer</code></em><br>
 		    | * ) ] [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
 		notify-to-soa <em class="replaceable"><code>boolean</code></em>;<br>
-		pubkey <em class="replaceable"><code>integer</code></em><br>
-		    <em class="replaceable"><code>integer</code></em><br>
-		    <em class="replaceable"><code>integer</code></em><br>
+		pubkey <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em><br>
 		request-expire <em class="replaceable"><code>boolean</code></em>;<br>
 		request-ixfr <em class="replaceable"><code>boolean</code></em>;<br>
 		serial-update-method ( date | increment | unixtime );<br>
@@ -883,10 +893,10 @@ view
 		    static-stub | stub );<br>
 		update-check-ksk <em class="replaceable"><code>boolean</code></em>;<br>
 		update-policy ( local | { ( deny | grant ) <em class="replaceable"><code>string</code></em> (<br>
-		    6to4-self | external | krb5-self | krb5-subdomain |<br>
-		    ms-self | ms-subdomain | name | self | selfsub |<br>
-		    selfwild | subdomain | tcp-self | wildcard | zonesub )<br>
-		    [ <em class="replaceable"><code>string</code></em> ] <em class="replaceable"><code>rrtypelist</code></em>; ... };<br>
+		    6to4-self | external | krb5-self | krb5-selfsub |<br>
+		    krb5-subdomain | ms-self | ms-selfsub | ms-subdomain |<br>
+		    name | self | selfsub | selfwild | subdomain | tcp-self<br>
+		    | wildcard | zonesub ) [ <em class="replaceable"><code>string</code></em> ] <em class="replaceable"><code>rrtypelist</code></em>; ... };<br>
 		use-alt-transfer-source <em class="replaceable"><code>boolean</code></em>;<br>
 		zero-no-soa-ttl <em class="replaceable"><code>boolean</code></em>;<br>
 		zone-statistics ( full | terse | none | <em class="replaceable"><code>boolean</code></em> );<br>
@@ -897,7 +907,7 @@ view
  </div>

  <div class="refsection">
-<a name="id-1.21"></a><h2>ZONE</h2>
+<a name="id-1.22"></a><h2>ZONE</h2>

    <div class="literallayout"><p><br>
 zone <em class="replaceable"><code>string</code></em> [ <em class="replaceable"><code>class</code></em> ] {<br>
@@ -966,7 +976,6 @@ zone
 	notify-source-v6 ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [ port ( <em class="replaceable"><code>integer</code></em> | * ) ]<br>
 	    [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
 	notify-to-soa <em class="replaceable"><code>boolean</code></em>;<br>
-	pubkey <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em><br>
 	request-expire <em class="replaceable"><code>boolean</code></em>;<br>
 	request-ixfr <em class="replaceable"><code>boolean</code></em>;<br>
 	serial-update-method ( date | increment | unixtime );<br>
@@ -986,9 +995,10 @@ zone
 	    stub );<br>
 	update-check-ksk <em class="replaceable"><code>boolean</code></em>;<br>
 	update-policy ( local | { ( deny | grant ) <em class="replaceable"><code>string</code></em> ( 6to4-self |<br>
-	    external | krb5-self | krb5-subdomain | ms-self | ms-subdomain<br>
-	    | name | self | selfsub | selfwild | subdomain | tcp-self |<br>
-	    wildcard | zonesub ) [ <em class="replaceable"><code>string</code></em> ] <em class="replaceable"><code>rrtypelist</code></em>; ... };<br>
+	    external | krb5-self | krb5-selfsub | krb5-subdomain | ms-self<br>
+	    | ms-selfsub | ms-subdomain | name | self | selfsub | selfwild<br>
+	    | subdomain | tcp-self | wildcard | zonesub ) [ <em class="replaceable"><code>string</code></em> ]<br>
+	    <em class="replaceable"><code>rrtypelist</code></em>; ... };<br>
 	use-alt-transfer-source <em class="replaceable"><code>boolean</code></em>;<br>
 	zero-no-soa-ttl <em class="replaceable"><code>boolean</code></em>;<br>
 	zone-statistics ( full | terse | none | <em class="replaceable"><code>boolean</code></em> );<br>
@@ -997,14 +1007,14 @@ zone
  </div>

  <div class="refsection">
-<a name="id-1.22"></a><h2>FILES</h2>
+<a name="id-1.23"></a><h2>FILES</h2>

    <p><code class="filename">/etc/named.conf</code>
    </p>
  </div>

  <div class="refsection">
-<a name="id-1.23"></a><h2>SEE ALSO</h2>
+<a name="id-1.24"></a><h2>SEE ALSO</h2>

    <p><span class="citerefentry">
 	<span class="refentrytitle">ddns-confgen</span>(8)
@@ -48,6 +48,7 @@
      <year>2016</year>
      <year>2017</year>
      <year>2018</year>
+      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000, 2001, 2003-2009, 2011, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000, 2001, 2003-2009, 2011, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -3226,7 +3226,7 @@ destroy_listener(void *arg) {
 	/* We don't have to acquire the lock here since it's already unlinked */
 	dns_acl_detach(&listener->acl);

-	DESTROYLOCK(&listener->lock);
+	isc_mutex_destroy(&listener->lock);
 	isc_mem_putanddetach(&listener->mctx, listener, sizeof(*listener));
 }

@@ -3253,11 +3253,7 @@ add_listener(named_server_t *server, named_statschannel_t **listenerp,
 	listener->mctx = NULL;
 	ISC_LINK_INIT(listener, link);

-	result = isc_mutex_init(&listener->lock);
-	if (result != ISC_R_SUCCESS) {
-		isc_mem_put(server->mctx, listener, sizeof(*listener));
-		return (ISC_R_FAILURE);
-	}
+	isc_mutex_init(&listener->lock);

 	isc_mem_attach(server->mctx, &listener->mctx);

@@ -3352,7 +3348,7 @@ cleanup:
 	if (result != ISC_R_SUCCESS) {
 		if (listener->acl != NULL)
 			dns_acl_detach(&listener->acl);
-		DESTROYLOCK(&listener->lock);
+		isc_mutex_destroy(&listener->lock);
 		isc_mem_putanddetach(&listener->mctx, listener,
 				     sizeof(*listener));
 	}
--- a/Show More
+++ b/Show More