Limit the outgoing UDP send queue size

If the operating system UDP queue gets full and the outgoing UDP sending starts to be delayed, BIND 9 could exhibit memory spikes as it tries to enqueue all the outgoing UDP messages. As those are not going to be delivered anyway (as we argued when we stopped enlarging the operating system send and receive buffers), try to send the UDP messages directly using `uv_udp_try_send()` and if that fails, drop the outgoing UDP message.
fix: usr: Do not set SO_INCOMING_CPU
2024-09-16 13:14:35 +02:00 · 2024-09-16 12:56:25 +00:00 · 2024-09-16 12:18:22 +00:00 · 2024-09-16 12:17:42 +00:00 · 2024-09-16 09:31:14 +00:00 · 2024-09-16 09:31:14 +00:00
428 changed files with 11840 additions and 10393 deletions
@@ -1540,3 +1540,5 @@ ffbe6b95371c99b7fb05e6de17a8d6b7bf4f629f
 79d93600116faabd89798522817ad95a69684fff
 # Reformat sources with up-to-date clang-format-18
 b7de2c7cb959fa35099d72c3f9b13938348c74e6
+# Reformat sources with up-to-date clang-format-19
+ff69d07fed2619a9bedf5ccc18cf106b7dd49bef
@@ -10,4 +10,4 @@
 /util/**			 export-ignore
 /util/bindkeys.pl		-export-ignore
 /util/check-make-install.in	-export-ignore
-/util/mksymtbl.pl		-export-ignore
+/util/dtrace.sh		-export-ignore
@@ -15,7 +15,7 @@ variables:
  TEST_PARALLEL_JOBS: 4

  CONFIGURE: ./configure
-  CLANG_VERSION: 18
+  CLANG_VERSION: 19
  CLANG: "clang-${CLANG_VERSION}"
  SCAN_BUILD: "scan-build-${CLANG_VERSION}"
  LLVM_SYMBOLIZER: "/usr/lib/llvm-${CLANG_VERSION}/bin/llvm-symbolizer"
@@ -147,10 +147,6 @@ stages:

 # Debian

-.debian-bullseye-amd64: &debian_bullseye_amd64_image
-  image: "$CI_REGISTRY_IMAGE:debian-bullseye-amd64"
-  <<: *linux_amd64
-
 .debian-bookworm-amd64: &debian_bookworm_amd64_image
  image: "$CI_REGISTRY_IMAGE:debian-bookworm-amd64"
  <<: *linux_amd64
@@ -214,7 +210,7 @@ stages:
  <<: *libvirt_amd64

 .freebsd-14-amd64: &freebsd_14_amd64_image
-  image: "freebsd-14.0-x86_64"
+  image: "freebsd-14.1-x86_64"
  <<: *libvirt_amd64

 .openbsd-amd64: &openbsd_amd64_image
@@ -651,6 +647,28 @@ tarball-create:

 # Jobs for doc builds on Debian 12 "bookworm" (amd64)

+changelog:
+  <<: *base_image
+  <<: *docs_job
+  rules:
+    - if: '$CI_MERGE_REQUEST_TITLE =~ /\s(dev|usr|pkg):/'
+  variables:
+    GIT_AUTHOR_NAME: $GITLAB_USER_NAME
+    GIT_AUTHOR_EMAIL: $GITLAB_USER_EMAIL
+    GIT_COMMITTER_NAME: $GITLAB_USER_NAME
+    GIT_COMMITTER_EMAIL: $GITLAB_USER_EMAIL
+  before_script:
+    - echo -e "$CI_MERGE_REQUEST_TITLE\n" > commitmsg
+    - sed -i 's/^Draft:\s*//' commitmsg
+    - echo -e "$CI_MERGE_REQUEST_DESCRIPTION" >> commitmsg
+    - git commit --allow-empty -F commitmsg
+    - ./contrib/gitchangelog/gitchangelog.py HEAD^..HEAD
+  needs:
+    - job: autoreconf
+      artifacts: true
+  artifacts:
+    untracked: true
+
 docs:
  <<: *default_triggering_rules
  <<: *base_image
@@ -683,7 +701,6 @@ cross-version-config-tests:
    # Disable option checking to prevent problems with new default options in
    # the &configure anchor.
    EXTRA_CONFIGURE: "--disable-option-checking"
-    PYTEST: "/usr/bin/pytest-3"
  script:
    - *configure
    - *setup_interfaces
@@ -693,16 +710,17 @@ cross-version-config-tests:
    - autoreconf -fi
    - *configure
    - make -j${BUILD_PARALLEL_JOBS:-1}
+    - *find_pytest
+    # The cross-version-config-tests job would fail when a system test is
+    # removed from the upcoming release. To avoid this, remove the system test
+    # also from the $BIND_BASELINE_VERSION.
+    - find bin/tests/system/ -mindepth 1 -maxdepth 1 -type d -exec sh -c 'test -e ../"$0" || rm -rfv -- "$0"' {} \;
    - cd bin/tests/system
    # Run the setup phase of all system tests in the most recently tagged BIND 9
    # release using the binaries built for the current BIND 9 version.  This
    # intends to detect obvious backward compatibility issues with the latter.
    - >
-      if [ -f isctest/vars/autoconf.py ]; then
-        echo "${CI_PROJECT_DIR}" > isctest/vars/.ac_vars/TOP_BUILDDIR
-      else
-        sed -i -E "s|(export TOP_BUILDDIR)=.*|\1=${CI_PROJECT_DIR}|" conf.sh;
-      fi
+      echo "${CI_PROJECT_DIR}" > isctest/vars/.ac_vars/TOP_BUILDDIR
    - >
      "$PYTEST" --setup-only --junit-xml="$CI_PROJECT_DIR"/junit.xml -n "${TEST_PARALLEL_JOBS:-1}"
  needs:
@@ -1243,9 +1261,9 @@ unit:clang:asan:
 gcc:tsan:
  variables:
    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -fsanitize=thread"
+    CFLAGS: "${CFLAGS_COMMON} -Wno-stringop-overread -ggdb -O2 -fsanitize=thread"
    LDFLAGS: "-fsanitize=thread"
-    EXTRA_CONFIGURE: "--with-libidn2 --enable-pthread-rwlock --without-jemalloc"
+    EXTRA_CONFIGURE: "--with-libidn2 --enable-pthread-rwlock --without-jemalloc PKG_CONFIG_PATH=/opt/tsan/lib/pkgconfig"
  <<: *tsan_fedora_40_amd64_image
  <<: *build_job

@@ -1272,9 +1290,9 @@ clang:tsan:
  <<: *build_job
  variables:
    CC: "${CLANG}"
-    CFLAGS: "${CFLAGS_COMMON} -fsanitize=thread"
+    CFLAGS: "${CFLAGS_COMMON} -ggdb -O2 -fsanitize=thread"
    LDFLAGS: "-fsanitize=thread"
-    EXTRA_CONFIGURE: "--with-libidn2 --enable-pthread-rwlock --without-jemalloc"
+    EXTRA_CONFIGURE: "--with-libidn2 --enable-pthread-rwlock --without-jemalloc PKG_CONFIG_PATH=/opt/tsan/lib/pkgconfig"

 system:clang:tsan:
  variables:
@@ -1294,54 +1312,33 @@ unit:clang:tsan:
    - job: clang:tsan
      artifacts: true

-# Jobs for Debian 11 "bullseye" (amd64)
+generate-tsan-stress-test-configs:
+  <<: *base_image
+  <<: *default_triggering_rules
+  stage: system
+  script:
+    - util/generate-tsan-stress-jobs.py > tsan-stress-test-configs.yml
+  artifacts:
+    paths:
+      - tsan-stress-test-configs.yml
+  needs: []
+  when: manual

-clang:bullseye:amd64:
+tsan:stress:
+  <<: *default_triggering_rules
+  stage: postcheck
  variables:
-    CC: ${CLANG}
-    CFLAGS: "${CFLAGS_COMMON} -Wenum-conversion"
-  <<: *debian_bullseye_amd64_image
-  <<: *build_job
-
-system:clang:bullseye:amd64:
-  <<: *debian_bullseye_amd64_image
-  <<: *system_test_job
+    PARENT_PIPELINE_ID: $CI_PIPELINE_ID
+  trigger:
+    include:
+      - artifact: tsan-stress-test-configs.yml
+        job: generate-tsan-stress-test-configs
  needs:
-    - job: clang:bullseye:amd64
+    - job: generate-tsan-stress-test-configs
      artifacts: true
-
-unit:clang:bullseye:amd64:
-  <<: *debian_bullseye_amd64_image
-  <<: *unit_test_job
-  needs:
-    - job: clang:bullseye:amd64
+    - job: gcc:tsan
      artifacts: true
-
-gcc:bullseye:amd64:
-  variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON}"
-    # See https://gitlab.isc.org/isc-projects/bind9/-/issues/3444
-    EXTRA_CONFIGURE: "--with-libidn2 --without-jemalloc --disable-leak-detection"
-  <<: *debian_bullseye_amd64_image
-  <<: *build_job
-
-system:gcc:bullseye:amd64:
-  # Set up environment variables that allow the "keyfromlabel" system test to be run
-  variables:
-    OPENSSL_CONF: "/var/tmp/etc/openssl.cnf"
-    SOFTHSM2_CONF: "/var/tmp/softhsm2/softhsm2.conf"
-  <<: *debian_bullseye_amd64_image
-  <<: *system_test_job
-  needs:
-    - job: gcc:bullseye:amd64
-      artifacts: true
-
-unit:gcc:bullseye:amd64:
-  <<: *debian_bullseye_amd64_image
-  <<: *unit_test_job
-  needs:
-    - job: gcc:bullseye:amd64
+    - job: clang:tsan
      artifacts: true

 # Jobs for Clang builds on Debian 12 "bookworm" (amd64)
@@ -1358,10 +1355,6 @@ clang:bookworm:amd64:
  <<: *build_job

 system:clang:bookworm:amd64:
-  # Set up environment variables that allow the "keyfromlabel" system test to be run
-  variables:
-    OPENSSL_CONF: "/var/tmp/etc/openssl.cnf"
-    SOFTHSM2_CONF: "/var/tmp/softhsm2/softhsm2.conf"
  <<: *debian_bookworm_amd64_image
  <<: *system_test_job
  needs:
@@ -1609,7 +1602,7 @@ respdiff:tsan:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -Og -fsanitize=thread"
    LDFLAGS: "-fsanitize=thread"
-    EXTRA_CONFIGURE: "--disable-dnsrps --enable-pthread-rwlock --without-jemalloc"
+    EXTRA_CONFIGURE: "--disable-dnsrps --enable-pthread-rwlock --without-jemalloc PKG_CONFIG_PATH=/opt/tsan/lib/pkgconfig"
    MAX_DISAGREEMENTS_PERCENTAGE: "0.5"
    TSAN_OPTIONS: "${TSAN_OPTIONS_DEBIAN}"
  script:
@@ -1674,6 +1667,10 @@ shotgun:dot:
  <<: *stress_test
  artifacts:
    untracked: true
+    exclude:
+      - "output/ns4/*.dtq*"
+      - "output/ns4/large-delta-rpz*.local"
+      - "output/rpz_*"
    when: always
  only:
    - merge_requests
@@ -1992,23 +1989,46 @@ pairwise:
    variables:
      - $PAIRWISE_TESTING

-backports:
+.post_merge_template: &post_merge
  <<: *base_image
  stage: postmerge
-  rules:
-    - if: '$CI_PIPELINE_SOURCE == "push" && ($CI_COMMIT_REF_NAME =~ /^bind-9.[0-9]+$/ || $CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH)'
+  needs: []
+  # post-merge processes should run even if another MR was merged while the job was running (or queued)
+  interruptible: false
  variables:
    # automated commits will inherit identification from the user who pressed Merge button
    GIT_COMMITTER_NAME: $GITLAB_USER_NAME
    GIT_COMMITTER_EMAIL: $GITLAB_USER_EMAIL
    # avoid leftover branches from previous jobs
    GIT_STRATEGY: clone
-    # assumed max depth of a MR for backport
-    GIT_DEPTH: 200
+    # assumed max depth of a MR for backport or a rebased force-push
+    GIT_DEPTH: 1000
+  before_script:
+    # force-pushes should not trigger process automation (happens only in -sub branches)
+    - >
+      echo "previous branch tip: $CI_COMMIT_BEFORE_SHA"
+    - set +o pipefail; git log --format='%H' | grep --silent "$CI_COMMIT_BEFORE_SHA" && PREVIOUS_TIP_REACHABLE=1
+    - test "$PREVIOUS_TIP_REACHABLE" != "1" && echo "force-push detected, stop" && exit 1
+    # non-fast-forward merges are disabled so we have to have merge commit on top
+    - MERGE_REQUEST_ID="$(git log -1 --format='%b' | sed --silent -e 's/^See merge request [^!]\+!//p')"
+    - >
+      : stop if this is not a merge request
+    - test "$MERGE_REQUEST_ID" -ge 0
+    - git clone --depth 1 https://gitlab.isc.org/isc-projects/bind9-qa.git
+
+backports:
+  <<: *post_merge
+  rules:
+    # -sub branches are handled manually
+    - if: '$CI_PIPELINE_SOURCE == "push" && ($CI_COMMIT_REF_NAME =~ /^bind-9.[0-9]+$/ || $CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH)'
  script:
    # CI job token is not sufficient for push operations
    - git remote get-url origin | sed -e "s/gitlab-ci-token:$CI_JOB_TOKEN/oauth2:$BIND_TEAM_WRITE_TOKEN/" | xargs git remote set-url --push origin
-    # force-pushing is disabled so we have to have merge request on top
-    - MERGE_REQUEST_ID="$(git log -1 --format='%b' | sed --silent -e 's/^See merge request [^!]\+!//p')"
-    - git clone --depth 1 https://gitlab.isc.org/isc-projects/bind9-qa.git
    - bind9-qa/releng/backport_mr.py $CI_PROJECT_ID "$MERGE_REQUEST_ID"
+
+merged-metadata:
+  <<: *post_merge
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "push" && ($CI_COMMIT_REF_NAME =~ /^bind-9.[0-9]+(-sub)?$/ || $CI_COMMIT_REF_NAME =~ /^bind-9.[0-9]+.[0-9]+-release$/ || $CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH)'
+  script:
+    - bind9-qa/releng/after_merge.py "$CI_PROJECT_ID" "$MERGE_REQUEST_ID"
@@ -12,12 +12,14 @@ confidential!
 | Deputy Incident Manager: | @user                                |
 | Public Disclosure Date:  | YYYY-MM-DD                           |
 | CVSS Score:              | [0.0][cvss_score]                    |
+| CWE:                     | [CWE-NNN][cwe_category]
 | Security Advisory:       | isc-private/printing-press!NNN       |
 | Mattermost Channel:      | [CVE-YYYY-NNNN][mattermost_url]      |
 | Support Ticket:          | [URL]                                |
 | Release Checklist:       | #NNNN                                |

 [cvss_score]: https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:X/AC:X/PR:X/UI:X/S:X/C:X/I:X/A:X&version=3.1
+[cwe_category]: https://cwe.mitre.org/data/definitions/NNN.html
 [mattermost_url]:

 :bulb: **Click [here][checklist_explanations] (internal resource) for general information about the security incident handling process.**
@@ -30,12 +32,12 @@ confidential!
  - [ ] [:link:][step_respond]           **(IM)** Respond to the bug reporter
  - [ ] [:link:][step_public_mrs]        **(SwEng)** Ensure there are no public merge requests which inadvertently disclose the issue
  - [ ] [:link:][step_assign_cve_id]     **(IM)** Assign a CVE identifier
-  - [ ] [:link:][step_note_cve_info]     **(SwEng)** Update this issue with the assigned CVE identifier and the CVSS score
+  - [ ] [:link:][step_note_cve_info]     **(SwEng)** Update this issue with the assigned CVE identifier, the CVSS score, and CWE category
  - [ ] [:link:][step_versions_affected] **(SwEng)** Determine the range of product versions affected (including the Subscription Edition)
  - [ ] [:link:][step_workarounds]       **(SwEng)** Determine whether workarounds for the problem exist
  - [ ] [:link:][step_coordinate]        **(SwEng)** If necessary, coordinate with other parties
-  - [ ] [:link:][step_earliest_prepare]  **(Support)** Prepare "earliest" notification text and hand it off to Marketing
-  - [ ] [:link:][step_earliest_send]     **(Marketing)** Update "earliest" notification document in SF portal and send bulk email to earliest customers
+  - [ ] [:link:][step_earliest_prepare]  **(Support)** Prepare "earliest" notification text
+  - [ ] [:link:][step_earliest_send]     **(Support)** Update "earliest" notification ticket in support portal Earliest queue which will notify earliest customers
  - [ ] [:link:][step_advisory_mr]       **(Support)** Create a merge request for the Security Advisory and include all readily available information in it
  - [ ] [:link:][step_reproducer_mr]     **(SwEng)** Prepare a private merge request containing a system test reproducing the problem
  - [ ] [:link:][step_notify_support]    **(SwEng)** Notify Support when a reproducer is ready
@@ -52,11 +54,13 @@ confidential!

 ### At T-5

-  - [ ] [:link:][step_asn_documents]     **(Marketing)** Update the text on the T-5 (from the Printing Press project) and "earliest" ASN documents in the SF portal
-  - [ ] [:link:][step_asn_links]         **(Marketing)** (BIND 9 only) Update the BIND -S information document in SF with download links to the new versions
-  - [ ] [:link:][step_asn_send]          **(Marketing)** Bulk email eligible customers to check the SF portal
+  - [ ] [:link:][step_asn_links]         **(Marketing)** (BIND 9 only) Update the BIND -S information document in the support portal with download links to the new versions
+  - [ ] [:link:][step_asn_send]          **(Support)** Notify eligible customers by adding a ticket to the 5 Day queue in RT with the text of the advisory (earliest, and T-5)
  - [ ] [:link:][step_preannouncement]   **(Marketing)** (BIND 9 only) Send a pre-announcement email to the *bind-announce* mailing list to alert users that the upcoming release will include security fixes

+### At T-3
+  - [ ] [:link:][step_asn_send]          **(Support)** Notify eligible customers by adding a ticket to the 3 Day queue in RT with the text of the advisory (T-3)
+
 ### At T-1

  - [ ] [:link:][step_packager_emails]   **(First IM)** Send notifications to OS packagers
@@ -71,8 +75,8 @@ confidential!
  - [ ] [:link:][step_mitre]             **(First IM)** Advise MITRE about the disclosed CVEs
  - [ ] [:link:][step_merge_advisory]    **(First IM)** Merge the Security Advisory merge request
  - [ ] [:link:][step_embargo_end]       **(IM)** Inform original reporter (if external) that the security disclosure process is complete
-  - [ ] [:link:][step_asn_clear]         **(Marketing)** Update the SF portal to clear the ASN
-  - [ ] [:link:][step_customers]         **(Marketing)** Email ASN recipients that the embargo is lifted
+  - [ ] [:link:][step_asn_clear]         **(Support)** Update the tickets in the ASN queues in RT that the embargo is lifted
+  - [ ] [:link:][step_customers]         **(Marketing)** Open a ticket in the <software name> Announce queue that the release is published

 ### After Public Disclosure

@@ -82,7 +86,7 @@ confidential!
 [step_respond]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#respond-to-the-bug-reporter
 [step_public_mrs]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#ensure-there-are-no-public-merge-requests-which-inadvertently-disclose-the-issue
 [step_assign_cve_id]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#assign-a-cve-identifier
-[step_note_cve_info]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-this-issue-with-the-assigned-cve-identifier-and-the-cvss-score
+[step_note_cve_info]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-this-issue-with-the-assigned-cve-identifier-the-cvss-score-and-the-cwe-category
 [step_versions_affected]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#determine-the-range-of-product-versions-affected-including-the-subscription-edition
 [step_workarounds]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#determine-whether-workarounds-for-the-problem-exist
 [step_coordinate]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#if-necessary-coordinate-with-other-parties
@@ -1,4 +1,10 @@
-[MASTER]
+[IMPORTS]
+
+deprecated-modules=
+    dns.resolver,
+
+[MESSAGES CONTROL]
+
 disable=
    C0103, # invalid-name
    C0114, # missing-module-docstring
@@ -26,4 +26,3 @@ Some of these settings are:
 | `-DISC_MEM_TRACKLINES=0`     | Don't track memory allocations by file and line number; this improves performance but makes debugging more difficult                   |
 | `-DNAMED_RUN_PID_DIR=0`      | Create default PID files in `${localstatedir}/run` rather than `${localstatedir}/run/named/`                                           |
 | `-DNS_CLIENT_DROPPORT=0`     | Disable dropping queries from particular well-known ports                                                                              |
-| `-DOPENSSL_API_COMPAT=10100` | Build using the deprecated OpenSSL APIs so that the `engine` API is available when building with OpenSSL 3.0.0 for PKCS#11 support     |
@@ -33,7 +33,6 @@
 #include <dns/db.h>
 #include <dns/dbiterator.h>
 #include <dns/fixedname.h>
-#include <dns/log.h>
 #include <dns/name.h>
 #include <dns/rdata.h>
 #include <dns/rdataclass.h>
@@ -43,10 +42,6 @@
 #include <dns/types.h>
 #include <dns/zone.h>

-#include <isccfg/log.h>
-
-#include <ns/log.h>
-
 #include "check-tool.h"

 #ifndef CHECK_SIBLING
@@ -97,13 +92,6 @@ dns_zoneopt_t zone_options = DNS_ZONEOPT_CHECKNS | DNS_ZONEOPT_CHECKMX |
 			     DNS_ZONEOPT_CHECKSVCB | DNS_ZONEOPT_CHECKWILDCARD |
 			     DNS_ZONEOPT_WARNMXCNAME | DNS_ZONEOPT_WARNSRVCNAME;

-/*
- * This needs to match the list in bin/named/log.c.
- */
-static isc_logcategory_t categories[] = { { "", 0 },
-					  { "unmatched", 0 },
-					  { NULL, 0 } };
-
 static isc_symtab_t *symtab = NULL;
 static isc_mem_t *sym_mctx;

@@ -549,30 +537,13 @@ checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 }

 isc_result_t
-setup_logging(isc_mem_t *mctx, FILE *errout, isc_log_t **logp) {
-	isc_logdestination_t destination;
-	isc_logconfig_t *logconfig = NULL;
-	isc_log_t *log = NULL;
+setup_logging(FILE *errout) {
+	isc_logconfig_t *logconfig = isc_logconfig_get();
+	isc_log_createandusechannel(
+		logconfig, "default_stderr", ISC_LOG_TOFILEDESC,
+		ISC_LOG_DYNAMIC, ISC_LOGDESTINATION_FILE(errout), 0,
+		ISC_LOGCATEGORY_DEFAULT, ISC_LOGMODULE_DEFAULT);

-	isc_log_create(mctx, &log, &logconfig);
-	isc_log_registercategories(log, categories);
-	isc_log_setcontext(log);
-	dns_log_init(log);
-	dns_log_setcontext(log);
-	cfg_log_init(log);
-	ns_log_init(log);
-
-	destination.file.stream = errout;
-	destination.file.name = NULL;
-	destination.file.versions = ISC_LOG_ROLLNEVER;
-	destination.file.maximum_size = 0;
-	isc_log_createchannel(logconfig, "stderr", ISC_LOG_TOFILEDESC,
-			      ISC_LOG_DYNAMIC, &destination, 0);
-
-	RUNTIME_CHECK(isc_log_usechannel(logconfig, "stderr", NULL, NULL) ==
-		      ISC_R_SUCCESS);
-
-	*logp = log;
 	return (ISC_R_SUCCESS);
 }

@@ -29,7 +29,7 @@
 ISC_LANG_BEGINDECLS

 isc_result_t
-setup_logging(isc_mem_t *mctx, FILE *errout, isc_log_t **logp);
+setup_logging(FILE *errout);

 isc_result_t
 load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,
@@ -30,7 +30,6 @@

 #include <dns/db.h>
 #include <dns/fixedname.h>
-#include <dns/log.h>
 #include <dns/name.h>
 #include <dns/rdataclass.h>
 #include <dns/rootns.h>
@@ -44,8 +43,6 @@

 static const char *program = "named-checkconf";

-isc_log_t *logc = NULL;
-
 #define CHECK(r)                             \
 	do {                                 \
 		result = (r);                \
@@ -54,7 +51,7 @@ isc_log_t *logc = NULL;
 	} while (0)

 /*% usage */
-noreturn static void
+ISC_NORETURN static void
 usage(void);

 static void
@@ -83,7 +80,7 @@ directory_callback(const char *clausename, const cfg_obj_t *obj, void *arg) {
 	directory = cfg_obj_asstring(obj);
 	result = isc_dir_chdir(directory);
 	if (result != ISC_R_SUCCESS) {
-		cfg_obj_log(obj, logc, ISC_LOG_ERROR,
+		cfg_obj_log(obj, ISC_LOG_ERROR,
 			    "change directory to '%s' failed: %s\n", directory,
 			    isc_result_totext(result));
 		return (result);
@@ -593,11 +590,11 @@ main(int argc, char **argv) {
 	const char *conffile = NULL;
 	isc_mem_t *mctx = NULL;
 	isc_result_t result = ISC_R_SUCCESS;
-	bool cleanup_dst = true;
 	bool load_zones = false;
 	bool list_zones = false;
 	bool print = false;
 	bool nodeprecate = false;
+	bool allconfigs = false;
 	unsigned int flags = 0;
 	unsigned int checkflags = BIND_CHECK_PLUGINS | BIND_CHECK_ALGORITHMS;

@@ -606,7 +603,7 @@ main(int argc, char **argv) {
 	/*
 	 * Process memory debugging argument first.
 	 */
-#define CMDLINE_FLAGS "acdhijlm:t:pvxz"
+#define CMDLINE_FLAGS "acdhijlm:nt:pvxz"
 	while ((c = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (c) {
 		case 'm':
@@ -660,6 +657,10 @@ main(int argc, char **argv) {
 		case 'm':
 			break;

+		case 'n':
+			allconfigs = true;
+			break;
+
 		case 't':
 			result = isc_dir_chroot(isc_commandline_argument);
 			if (result != ISC_R_SUCCESS) {
@@ -726,20 +727,20 @@ main(int argc, char **argv) {
 		conffile = NAMED_CONFFILE;
 	}

-	CHECK(setup_logging(mctx, stdout, &logc));
+	CHECK(setup_logging(stdout));

-	CHECK(dst_lib_init(mctx, NULL));
-	cleanup_dst = true;
-
-	CHECK(cfg_parser_create(mctx, logc, &parser));
+	CHECK(cfg_parser_create(mctx, &parser));

 	if (nodeprecate) {
 		cfg_parser_setflags(parser, CFG_PCTX_NODEPRECATED, true);
 	}
+	if (allconfigs) {
+		cfg_parser_setflags(parser, CFG_PCTX_ALLCONFIGS, true);
+	}
 	cfg_parser_setcallback(parser, directory_callback, NULL);

 	CHECK(cfg_parse_file(parser, conffile, &cfg_type_namedconf, &config));
-	CHECK(isccfg_check_namedconf(config, checkflags, logc, mctx));
+	CHECK(isccfg_check_namedconf(config, checkflags, mctx));
 	if (load_zones || list_zones) {
 		CHECK(load_zones_fromconfig(config, mctx, list_zones));
 	}
@@ -757,14 +758,6 @@ cleanup:
 		cfg_parser_destroy(&parser);
 	}

-	if (cleanup_dst) {
-		dst_lib_destroy();
-	}
-
-	if (logc != NULL) {
-		isc_log_destroy(&logc);
-	}
-
 	if (mctx != NULL) {
 		isc_mem_destroy(&mctx);
 	}
@@ -21,7 +21,7 @@ named-checkconf - named configuration file syntax checking tool
 Synopsis
 ~~~~~~~~

-:program:`named-checkconf` [**-achjlvz**] [**-p** [**-x** ]] [**-t** directory] {filename}
+:program:`named-checkconf` [**-achjlnvz**] [**-p** [**-x** ]] [**-t** directory] {filename}

 Description
 ~~~~~~~~~~~
@@ -71,6 +71,10 @@ Options

   This option ignores warnings on deprecated options.

+.. option:: -n
+
+   Do not error on options that are disabled in this build.
+
 .. option:: -p

   This option prints out the :iscman:`named.conf` and included files in canonical form if
@@ -31,7 +31,6 @@

 #include <dns/db.h>
 #include <dns/fixedname.h>
-#include <dns/log.h>
 #include <dns/master.h>
 #include <dns/masterdump.h>
 #include <dns/name.h>
@@ -62,7 +61,7 @@ static enum { progmode_check, progmode_compile } progmode;
 		}                                                             \
 	} while (0)

-noreturn static void
+ISC_NORETURN static void
 usage(void);

 static void
@@ -95,7 +94,6 @@ main(int argc, char **argv) {
 	int c;
 	char *origin = NULL;
 	const char *filename = NULL;
-	isc_log_t *lctx = NULL;
 	isc_result_t result;
 	char classname_in[] = "IN";
 	char *classname = classname_in;
@@ -525,8 +523,7 @@ main(int argc, char **argv) {

 	isc_mem_create(&mctx);
 	if (!quiet) {
-		RUNTIME_CHECK(setup_logging(mctx, errout, &lctx) ==
-			      ISC_R_SUCCESS);
+		RUNTIME_CHECK(setup_logging(errout) == ISC_R_SUCCESS);
 	}

 	origin = argv[isc_commandline_index++];
@@ -566,9 +563,6 @@ main(int argc, char **argv) {
 		fprintf(errout, "OK\n");
 	}
 	destroy();
-	if (lctx != NULL) {
-		isc_log_destroy(&lctx);
-	}
 	isc_mem_destroy(&mctx);

 	return ((result == ISC_R_SUCCESS) ? 0 : 1);
@@ -120,8 +120,6 @@ generate_key(isc_mem_t *mctx, dns_secalg_t alg, int keysize,
 		fatal("unsupported algorithm %d\n", alg);
 	}

-	DO("initialize dst library", dst_lib_init(mctx, NULL));
-
 	DO("generate key",
 	   dst_key_generate(dns_rootname, alg, keysize, 0, 0, DNS_KEYPROTO_ANY,
 			    dns_rdataclass_in, NULL, mctx, &key, NULL));
@@ -132,14 +130,12 @@ generate_key(isc_mem_t *mctx, dns_secalg_t alg, int keysize,

 	isc_buffer_usedregion(&key_rawbuffer, &key_rawregion);

-	DO("bsse64 encode secret",
+	DO("base64 encode secret",
 	   isc_base64_totext(&key_rawregion, -1, "", key_txtbuffer));

 	if (key != NULL) {
 		dst_key_free(&key);
 	}
-
-	dst_lib_destroy();
 }

 /*%
@@ -60,7 +60,7 @@ bool verbose = false;

 const char *keyfile, *keydef;

-noreturn static void
+ISC_NORETURN static void
 usage(int status);

 static void
@@ -53,7 +53,7 @@ const char *progname;
 static enum { progmode_keygen, progmode_confgen } progmode;
 bool verbose = false; /* needed by util.c but not used here */

-noreturn static void
+ISC_NORETURN static void
 usage(int status);

 static void
@@ -36,7 +36,7 @@ ISC_LANG_BEGINDECLS
 void
 notify(const char *fmt, ...) ISC_FORMAT_PRINTF(1, 2);

-noreturn void
+ISC_NORETURN void
 fatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);

 ISC_LANG_ENDDECLS
@@ -52,7 +52,6 @@
 #include <dns/fixedname.h>
 #include <dns/keytable.h>
 #include <dns/keyvalues.h>
-#include <dns/log.h>
 #include <dns/masterdump.h>
 #include <dns/message.h>
 #include <dns/name.h>
@@ -70,7 +69,6 @@

 #include <dst/dst.h>

-#include <isccfg/log.h>
 #include <isccfg/namedconf.h>

 #include <ns/client.h>
@@ -88,10 +86,12 @@

 #define MAXNAME (DNS_NAME_MAXTEXT + 1)

+#define MAX_QUERIES  32
+#define MAX_RESTARTS 11
+
 /* Variables used internally by delv. */
 char *progname = NULL;
 static isc_mem_t *mctx = NULL;
-static isc_log_t *lctx = NULL;
 static dns_view_t *view = NULL;
 static ns_server_t *sctx = NULL;
 static ns_interface_t *ifp = NULL;
@@ -130,6 +130,9 @@ static bool showcomments = true, showdnssec = true, showtrust = true,
 	    multiline = false, short_form = false, print_unknown_format = false,
 	    yaml = false, fulltrace = false;

+static uint32_t maxqueries = MAX_QUERIES;
+static uint32_t restarts = MAX_RESTARTS;
+
 static bool resolve_trace = false, validator_trace = false,
 	    message_trace = false, send_trace = false;

@@ -250,7 +253,7 @@ usage(void) {
 	exit(EXIT_FAILURE);
 }

-noreturn static void
+ISC_NORETURN static void
 fatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);

 static void
@@ -281,12 +284,6 @@ warn(const char *format, ...) {
 	fprintf(stderr, "\n");
 }

-static isc_logcategory_t categories[] = { { "delv", 0 }, { NULL, 0 } };
-#define LOGCATEGORY_DEFAULT (&categories[0])
-#define LOGMODULE_DEFAULT   (&modules[0])
-
-static isc_logmodule_t modules[] = { { "delv", 0 }, { NULL, 0 } };
-
 static void
 delv_log(int level, const char *fmt, ...) ISC_FORMAT_PRINTF(2, 3);

@@ -295,15 +292,15 @@ delv_log(int level, const char *fmt, ...) {
 	va_list ap;
 	char msgbuf[2048];

-	if (!isc_log_wouldlog(lctx, level)) {
+	if (!isc_log_wouldlog(level)) {
 		return;
 	}

 	va_start(ap, fmt);

 	vsnprintf(msgbuf, sizeof(msgbuf), fmt, ap);
-	isc_log_write(lctx, LOGCATEGORY_DEFAULT, LOGMODULE_DEFAULT, level, "%s",
-		      msgbuf);
+	isc_log_write(DELV_LOGCATEGORY_DEFAULT, DELV_LOGMODULE_DEFAULT, level,
+		      "%s", msgbuf);
 	va_end(ap);
 }

@@ -311,76 +308,45 @@ static int loglevel = 0;

 static void
 setup_logging(FILE *errout) {
-	isc_result_t result;
-	isc_logdestination_t destination;
-	isc_logconfig_t *logconfig = NULL;
 	int packetlevel = 10;

-	isc_log_create(mctx, &lctx, &logconfig);
-	isc_log_registercategories(lctx, categories);
-	isc_log_registermodules(lctx, modules);
-	isc_log_setcontext(lctx);
-	dns_log_init(lctx);
-	dns_log_setcontext(lctx);
-	cfg_log_init(lctx);
+	isc_log_setdebuglevel(loglevel);

-	destination.file.stream = errout;
-	destination.file.name = NULL;
-	destination.file.versions = ISC_LOG_ROLLNEVER;
-	destination.file.maximum_size = 0;
-	isc_log_createchannel(logconfig, "stderr", ISC_LOG_TOFILEDESC,
-			      ISC_LOG_DYNAMIC, &destination,
-			      ISC_LOG_PRINTPREFIX);
+	isc_logconfig_t *logconfig = isc_logconfig_get();

-	isc_log_setdebuglevel(lctx, loglevel);
 	isc_log_settag(logconfig, ";; ");

-	result = isc_log_usechannel(logconfig, "stderr",
-				    ISC_LOGCATEGORY_DEFAULT, NULL);
-	if (result != ISC_R_SUCCESS) {
-		fatal("Couldn't attach to log channel 'stderr'");
-	}
+	isc_log_createandusechannel(
+		logconfig, "default_stderr", ISC_LOG_TOFILEDESC,
+		ISC_LOG_DYNAMIC, ISC_LOGDESTINATION_FILE(errout),
+		ISC_LOG_PRINTPREFIX, ISC_LOGCATEGORY_DEFAULT,
+		ISC_LOGMODULE_DEFAULT);

 	if (resolve_trace && loglevel < 1) {
-		isc_log_createchannel(logconfig, "resolver", ISC_LOG_TOFILEDESC,
-				      ISC_LOG_DEBUG(1), &destination,
-				      ISC_LOG_PRINTPREFIX);
-
-		result = isc_log_usechannel(logconfig, "resolver",
-					    DNS_LOGCATEGORY_RESOLVER,
-					    DNS_LOGMODULE_RESOLVER);
-		if (result != ISC_R_SUCCESS) {
-			fatal("Couldn't attach to log channel 'resolver'");
-		}
+		isc_log_createandusechannel(
+			logconfig, "resolver", ISC_LOG_TOFILEDESC,
+			ISC_LOG_DEBUG(1), ISC_LOGDESTINATION_FILE(errout),
+			ISC_LOG_PRINTPREFIX, DNS_LOGCATEGORY_RESOLVER,
+			DNS_LOGMODULE_RESOLVER);
 	}

 	if (validator_trace && loglevel < 3) {
-		isc_log_createchannel(logconfig, "validator",
-				      ISC_LOG_TOFILEDESC, ISC_LOG_DEBUG(3),
-				      &destination, ISC_LOG_PRINTPREFIX);
-
-		result = isc_log_usechannel(logconfig, "validator",
-					    DNS_LOGCATEGORY_DNSSEC,
-					    DNS_LOGMODULE_VALIDATOR);
-		if (result != ISC_R_SUCCESS) {
-			fatal("Couldn't attach to log channel 'validator'");
-		}
+		isc_log_createandusechannel(
+			logconfig, "validator", ISC_LOG_TOFILEDESC,
+			ISC_LOG_DEBUG(3), ISC_LOGDESTINATION_FILE(errout),
+			ISC_LOG_PRINTPREFIX, DNS_LOGCATEGORY_DNSSEC,
+			DNS_LOGMODULE_VALIDATOR);
 	}

 	if (send_trace) {
 		packetlevel = 11;
 	}
 	if ((message_trace || send_trace) && loglevel < packetlevel) {
-		isc_log_createchannel(logconfig, "messages", ISC_LOG_TOFILEDESC,
-				      ISC_LOG_DEBUG(packetlevel), &destination,
-				      ISC_LOG_PRINTPREFIX);
-
-		result = isc_log_usechannel(logconfig, "messages",
-					    DNS_LOGCATEGORY_RESOLVER,
-					    DNS_LOGMODULE_PACKETS);
-		if (result != ISC_R_SUCCESS) {
-			fatal("Couldn't attach to log channel 'messagse'");
-		}
+		isc_log_createandusechannel(
+			logconfig, "messages", ISC_LOG_TOFILEDESC,
+			ISC_LOG_DEBUG(packetlevel),
+			ISC_LOGDESTINATION_FILE(errout), ISC_LOG_PRINTPREFIX,
+			DNS_LOGCATEGORY_RESOLVER, DNS_LOGMODULE_PACKETS);
 	}
 }

@@ -810,14 +776,14 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client, dns_view_t *toview) {

 cleanup:
 	if (result == DST_R_NOCRYPTO) {
-		cfg_obj_log(key, lctx, ISC_LOG_ERROR, "no crypto support");
+		cfg_obj_log(key, ISC_LOG_ERROR, "no crypto support");
 	} else if (result == DST_R_UNSUPPORTEDALG) {
-		cfg_obj_log(key, lctx, ISC_LOG_WARNING,
+		cfg_obj_log(key, ISC_LOG_WARNING,
 			    "skipping trusted key '%s': %s", keynamestr,
 			    isc_result_totext(result));
 		result = ISC_R_SUCCESS;
 	} else if (result != ISC_R_SUCCESS) {
-		cfg_obj_log(key, lctx, ISC_LOG_ERROR,
+		cfg_obj_log(key, ISC_LOG_ERROR,
 			    "failed to add trusted key '%s': %s", keynamestr,
 			    isc_result_totext(result));
 		result = ISC_R_FAILURE;
@@ -872,7 +838,7 @@ setup_dnsseckeys(dns_client_t *client, dns_view_t *toview) {
 		CHECK(convert_name(&afn, &anchor_name, trust_anchor));
 	}

-	CHECK(cfg_parser_create(mctx, dns_lctx, &parser));
+	CHECK(cfg_parser_create(mctx, &parser));

 	if (anchorfile != NULL) {
 		if (access(anchorfile, R_OK) != 0) {
@@ -1191,6 +1157,23 @@ plus_option(char *option) {
 		break;
 	case 'm':
 		switch (cmd[1]) {
+		case 'a': /* maxqueries */
+			FULLCHECK("maxqueries");
+			if (value == NULL) {
+				goto need_value;
+			}
+			if (!state) {
+				goto invalid_option;
+			}
+			result = parse_uint(&maxqueries, value, UINT_MAX,
+					    "maxqueries");
+			if (result != ISC_R_SUCCESS) {
+				fatal("Couldn't parse maxqueries");
+			}
+			if (maxqueries == 0) {
+				fatal("maxqueries must be nonzero");
+			}
+			break;
 		case 't': /* mtrace */
 			FULLCHECK("mtrace");
 			message_trace = state;
@@ -1243,6 +1226,22 @@ plus_option(char *option) {
 		break;
 	case 'r':
 		switch (cmd[1]) {
+		case 'e': /* restarts */
+			FULLCHECK("restarts");
+			if (value == NULL) {
+				goto need_value;
+			}
+			if (!state) {
+				goto invalid_option;
+			}
+			result = parse_uint(&restarts, value, 255, "restarts");
+			if (result != ISC_R_SUCCESS) {
+				fatal("Couldn't parse restarts");
+			}
+			if (restarts == 0) {
+				fatal("restarts must be between 1..255");
+			}
+			break;
 		case 'o': /* root */
 			FULLCHECK("root");
 			if (state && no_sigs) {
@@ -1370,10 +1369,7 @@ plus_option(char *option) {
 		break;
 	default:
 	invalid_option:
-		/*
-		 * We can also add a "need_value:" case here if we ever
-		 * add a plus-option that requires a specified value
-		 */
+	need_value:
 		fprintf(stderr, "Invalid option: +%s\n", option);
 		usage();
 	}
@@ -1898,6 +1894,7 @@ run_resolve(void *arg) {
 	/* Create client */
 	CHECK(dns_client_create(mctx, loopmgr, netmgr, 0, tlsctx_client_cache,
 				&client, srcaddr4, srcaddr6));
+	dns_client_setmaxrestarts(client, restarts);

 	/* Set the nameserver */
 	if (server != NULL) {
@@ -2162,6 +2159,7 @@ run_server(void *arg) {
 	dns_view_setcache(view, cache, false);
 	dns_cache_detach(&cache);
 	dns_view_setdstport(view, destport);
+	dns_view_setmaxrestarts(view, restarts);

 	CHECK(dns_rootns_create(mctx, dns_rdataclass_in, hintfile, &roothints));
 	dns_view_sethints(view, roothints);
@@ -2175,6 +2173,7 @@ run_server(void *arg) {

 	CHECK(dns_view_createresolver(view, netmgr, 0, tlsctx_client_cache,
 				      dispatch, NULL));
+	dns_resolver_setmaxqueries(view->resolver, maxqueries);

 	isc_stats_create(mctx, &resstats, dns_resstatscounter_max);
 	dns_resolver_setstats(view->resolver, resstats);
@@ -2220,11 +2219,6 @@ main(int argc, char *argv[]) {
 	isc_managers_create(&mctx, 1, &loopmgr, &netmgr);
 	loop = isc_loop_main(loopmgr);

-	result = dst_lib_init(mctx, NULL);
-	if (result != ISC_R_SUCCESS) {
-		fatal("dst_lib_init failed: %d", result);
-	}
-
 	parse_args(argc, argv);

 	CHECK(setup_style());
@@ -2266,9 +2260,6 @@ cleanup:
 		dns_master_styledestroy(&style, mctx);
 	}

-	isc_log_destroy(&lctx);
-	dst_lib_destroy();
-
 	isc_managers_destroy(&mctx, &loopmgr, &netmgr);

 	return (0);
@@ -337,6 +337,18 @@ assign values to options like the timeout interval. They have the form
   they are replaced by the string ``[omitted]`` or, in the DNSKEY case, the
   key ID is displayed as the replacement, e.g. ``[ key id = value ]``.

+.. option:: +restarts
+
+   When name server mode (``delv +ns``) is in use, this option sets the
+   maximum number of CNAME queries to follow before terminating resolution.
+   This prevents ``delv`` from hanging in the event of a CNAME loop.
+   The default is 11.
+
+.. option:: +maxqueries
+
+   This option specifies the maximum number of queries to send to resolve
+   a name before giving up. The default is 32.
+
 .. option:: +trust, +notrust

   This option controls whether to display the trust level when printing a record.
@@ -111,7 +111,7 @@ usage(void) {
 	fprintf(stderr, "Press <Help> for complete list of options\n");
 }
 #else  /* if TARGET_OS_IPHONE */
-noreturn static void
+ISC_NORETURN static void
 usage(void);

 static void
@@ -61,7 +61,6 @@

 #include <dns/byaddr.h>
 #include <dns/fixedname.h>
-#include <dns/log.h>
 #include <dns/message.h>
 #include <dns/name.h>
 #include <dns/opcode.h>
@@ -93,14 +92,12 @@ static bool cancel_now = false;

 bool check_ra = false, have_ipv4 = false, have_ipv6 = false,
     specified_source = false, free_now = false, usesearch = false,
-     showsearch = false, is_dst_up = false, keep_open = false, verbose = false,
-     yaml = false;
+     showsearch = false, keep_open = false, verbose = false, yaml = false;
 in_port_t port = 53;
 bool port_set = false;
 unsigned int timeout = 0;
 unsigned int extrabytes;
 isc_mem_t *mctx = NULL;
-isc_log_t *lctx = NULL;
 isc_nm_t *netmgr = NULL;
 isc_loopmgr_t *loopmgr = NULL;
 isc_loop_t *mainloop = NULL;
@@ -1097,7 +1094,7 @@ read_confkey(void) {
 		return (ISC_R_FILENOTFOUND);
 	}

-	result = cfg_parser_create(mctx, NULL, &pctx);
+	result = cfg_parser_create(mctx, &pctx);
 	if (result != ISC_R_SUCCESS) {
 		goto cleanup;
 	}
@@ -1362,22 +1359,15 @@ setup_libs(void) {

 	isc_managers_create(&mctx, 1, &loopmgr, &netmgr);

-	isc_log_create(mctx, &lctx, &logconfig);
-	isc_log_setcontext(lctx);
-	dns_log_init(lctx);
-	dns_log_setcontext(lctx);
-
-	result = isc_log_usechannel(logconfig, "default_debug", NULL, NULL);
-	check_result(result, "isc_log_usechannel");
-
-	isc_log_setdebuglevel(lctx, 0);
+	logconfig = isc_logconfig_get();
+	isc_log_createandusechannel(logconfig, "debug", ISC_LOG_TOFILEDESC,
+				    ISC_LOG_DYNAMIC, ISC_LOGDESTINATION_STDERR,
+				    ISC_LOG_PRINTTIME, ISC_LOGCATEGORY_DEFAULT,
+				    ISC_LOGMODULE_DEFAULT);
+	isc_log_setdebuglevel(0);

 	isc_mem_setname(mctx, "dig");
 	mainloop = isc_loop_main(loopmgr);
-
-	result = dst_lib_init(mctx, NULL);
-	check_result(result, "dst_lib_init");
-	is_dst_up = true;
 }

 typedef struct dig_ednsoptname {
@@ -4237,7 +4227,15 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
 		goto keep_query;
 	}

-	if (msg->counts[DNS_SECTION_QUESTION] != 0) {
+	if (msg->counts[DNS_SECTION_QUESTION] == 0) {
+		if (l->doing_xfr) {
+			if (query->msg_count == 0) {
+				dighost_warning("missing question section");
+			}
+		} else if (!l->header_only && msg->opcode == dns_opcode_query) {
+			dighost_warning("missing question section");
+		}
+	} else {
 		match = true;
 		for (result = dns_message_firstname(msg, DNS_SECTION_QUESTION);
 		     result == ISC_R_SUCCESS && match;
@@ -4714,12 +4712,6 @@ cleanup_openssl_refs(void) {
 		debug("freeing SIG(0) key %p", sig0key);
 		dst_key_free(&sig0key);
 	}
-
-	if (is_dst_up) {
-		debug("destroy DST lib");
-		dst_lib_destroy();
-		is_dst_up = false;
-	}
 }

 /*%
@@ -4750,9 +4742,6 @@ destroy_libs(void) {
 		isc_buffer_free(&namebuf);
 	}

-	debug("Removing log context");
-	isc_log_destroy(&lctx);
-
 	debug("Destroy memory");
 	if (memdebugging != 0) {
 		isc_mem_stats(mctx, stderr);
@@ -293,13 +293,13 @@ getaddresses(dig_lookup_t *lookup, const char *host, isc_result_t *resultp);
 isc_result_t
 get_reverse(char *reverse, size_t len, char *value, bool strict);

-noreturn void
+ISC_NORETURN void
 fatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);

 void
 warn(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);

-noreturn void
+ISC_NORETURN void
 digexit(void);

 void
@@ -99,7 +99,7 @@ rcode_totext(dns_rcode_t rcode) {
 	return (totext.deconsttext);
 }

-noreturn static void
+ISC_NORETURN static void
 show_usage(void);

 static void
@@ -836,7 +836,7 @@ fgets_next_command(void *arg) {
 	cmdline = fgets(cmdlinebuf, COMMSIZE, stdin);
 }

-noreturn static void
+ISC_NORETURN static void
 usage(void);

 static void
@@ -29,6 +29,7 @@
 #include <isc/dir.h>
 #include <isc/file.h>
 #include <isc/hash.h>
+#include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
 #include <isc/serial.h>
@@ -43,7 +44,6 @@
 #include <dns/ds.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
-#include <dns/log.h>
 #include <dns/master.h>
 #include <dns/name.h>
 #include <dns/rdata.h>
@@ -63,7 +63,6 @@ const char *program = "dnssec-cds";
 /*
 * Infrastructure
 */
-static isc_log_t *lctx = NULL;
 static isc_mem_t *mctx = NULL;

 /*
@@ -144,7 +143,6 @@ static dns_dbnode_t *parent_node = NULL;
 static dns_db_t *update_db = NULL;
 static dns_dbnode_t *update_node = NULL;
 static dns_dbversion_t *update_version = NULL;
-static bool cleanup_dst = false;
 static bool print_mem_stats = false;

 static void
@@ -1029,7 +1027,7 @@ nsdiff(uint32_t ttl, dns_rdataset_t *oldset, dns_rdataset_t *newset) {
 	}
 }

-noreturn static void
+ISC_NORETURN static void
 usage(void);

 static void
@@ -1071,12 +1069,6 @@ cleanup(void) {
 		free_keytable(&new_key_tbl);
 	}
 	free_all_sets();
-	if (lctx != NULL) {
-		cleanup_logging(&lctx);
-	}
-	if (cleanup_dst) {
-		dst_lib_destroy();
-	}
 	if (mctx != NULL) {
 		if (print_mem_stats && verbose > 10) {
 			isc_mem_stats(mctx, stdout);
@@ -1090,7 +1082,6 @@ main(int argc, char *argv[]) {
 	const char *child_path = NULL;
 	const char *ds_path = NULL;
 	const char *inplace = NULL;
-	isc_result_t result;
 	bool prefer_cdnskey = false;
 	bool nsupdate = false;
 	uint32_t ttl = 0;
@@ -1178,14 +1169,7 @@ main(int argc, char *argv[]) {
 		dtype[0] = DNS_DSDIGEST_SHA256;
 	}

-	setup_logging(mctx, &lctx);
-
-	result = dst_lib_init(mctx, NULL);
-	if (result != ISC_R_SUCCESS) {
-		fatal("could not initialize dst: %s",
-		      isc_result_totext(result));
-	}
-	cleanup_dst = true;
+	setup_logging();

 	if (ds_path == NULL) {
 		fatal("missing -d DS pathname");
@@ -22,6 +22,7 @@
 #include <isc/commandline.h>
 #include <isc/dir.h>
 #include <isc/hash.h>
+#include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
 #include <isc/string.h>
@@ -33,7 +34,6 @@
 #include <dns/ds.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
-#include <dns/log.h>
 #include <dns/master.h>
 #include <dns/name.h>
 #include <dns/rdata.h>
@@ -324,7 +324,7 @@ emits(bool showall, bool cds, dns_rdata_t *rdata) {
 	}
 }

-noreturn static void
+ISC_NORETURN static void
 usage(void);

 static void
@@ -368,7 +368,6 @@ main(int argc, char **argv) {
 	bool usekeyset = false;
 	bool showall = false;
 	isc_result_t result;
-	isc_log_t *log = NULL;
 	dns_rdataset_t rdataset;
 	dns_rdata_t rdata;

@@ -489,13 +488,7 @@ main(int argc, char **argv) {
 		fatal("extraneous arguments");
 	}

-	result = dst_lib_init(mctx, NULL);
-	if (result != ISC_R_SUCCESS) {
-		fatal("could not initialize dst: %s",
-		      isc_result_totext(result));
-	}
-
-	setup_logging(mctx, &log);
+	setup_logging();

 	dns_rdataset_init(&rdataset);

@@ -548,8 +541,6 @@ main(int argc, char **argv) {
 	if (dns_rdataset_isassociated(&rdataset)) {
 		dns_rdataset_disassociate(&rdataset);
 	}
-	cleanup_logging(&log);
-	dst_lib_destroy();
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
@@ -20,6 +20,7 @@
 #include <isc/buffer.h>
 #include <isc/commandline.h>
 #include <isc/hash.h>
+#include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
 #include <isc/string.h>
@@ -31,7 +32,6 @@
 #include <dns/ds.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
-#include <dns/log.h>
 #include <dns/master.h>
 #include <dns/name.h>
 #include <dns/rdata.h>
@@ -262,7 +262,7 @@ emit(const char *dir, dns_rdata_t *rdata) {
 	dst_key_free(&key);
 }

-noreturn static void
+ISC_NORETURN static void
 usage(void);

 static void
@@ -299,7 +299,6 @@ main(int argc, char **argv) {
 	char *endp;
 	int ch;
 	isc_result_t result;
-	isc_log_t *log = NULL;
 	dns_rdataset_t rdataset;
 	dns_rdata_t rdata;
 	isc_stdtime_t now = isc_stdtime_now();
@@ -408,13 +407,7 @@ main(int argc, char **argv) {
 		fatal("extraneous arguments");
 	}

-	result = dst_lib_init(mctx, NULL);
-	if (result != ISC_R_SUCCESS) {
-		fatal("could not initialize dst: %s",
-		      isc_result_totext(result));
-	}
-
-	setup_logging(mctx, &log);
+	setup_logging();

 	dns_rdataset_init(&rdataset);

@@ -458,8 +451,6 @@ main(int argc, char **argv) {
 	if (dns_rdataset_isassociated(&rdataset)) {
 		dns_rdataset_disassociate(&rdataset);
 	}
-	cleanup_logging(&log);
-	dst_lib_destroy();
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
@@ -21,6 +21,7 @@
 #include <isc/attributes.h>
 #include <isc/buffer.h>
 #include <isc/commandline.h>
+#include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/region.h>
 #include <isc/result.h>
@@ -30,7 +31,6 @@
 #include <dns/dnssec.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
-#include <dns/log.h>
 #include <dns/name.h>
 #include <dns/rdataclass.h>
 #include <dns/secalg.h>
@@ -43,7 +43,9 @@

 const char *program = "dnssec-keyfromlabel";

-noreturn static void
+static uint16_t tag_min = 0, tag_max = 0xffff;
+
+ISC_NORETURN static void
 usage(void);

 static void
@@ -63,13 +65,12 @@ usage(void) {
 			"        ED25519 | ED448\n");
 	fprintf(stderr, "    -3: use NSEC3-capable algorithm\n");
 	fprintf(stderr, "    -c class (default: IN)\n");
-	fprintf(stderr, "    -E <engine>:\n");
-	fprintf(stderr, "        name of an OpenSSL engine to use\n");
 	fprintf(stderr, "    -f keyflag: KSK | REVOKE\n");
 	fprintf(stderr, "    -K directory: directory in which to place "
 			"key files\n");
 	fprintf(stderr, "    -k: generate a TYPE=KEY key\n");
 	fprintf(stderr, "    -L ttl: default key TTL\n");
+	fprintf(stderr, "    -M <min>:<max>: allowed Key ID range\n");
 	fprintf(stderr, "    -n nametype: ZONE | HOST | ENTITY | USER | "
 			"OTHER\n");
 	fprintf(stderr, "        (DNSKEY generation defaults to ZONE\n");
@@ -112,7 +113,6 @@ main(int argc, char **argv) {
 	const char *directory = NULL;
 	const char *predecessor = NULL;
 	dst_key_t *prevkey = NULL;
-	const char *engine = NULL;
 	char *classname = NULL;
 	char *endp;
 	dst_key_t *key = NULL;
@@ -128,7 +128,6 @@ main(int argc, char **argv) {
 	isc_textregion_t r;
 	char filename[255];
 	isc_buffer_t buf;
-	isc_log_t *log = NULL;
 	dns_rdataclass_t rdclass;
 	int options = DST_TYPE_PRIVATE | DST_TYPE_PUBLIC;
 	char *label = NULL;
@@ -160,7 +159,7 @@ main(int argc, char **argv) {

 	isc_commandline_errprint = false;

-#define CMDLINE_FLAGS "3A:a:Cc:D:E:Ff:GhI:i:kK:L:l:n:P:p:R:S:t:v:Vy"
+#define CMDLINE_FLAGS "3A:a:Cc:D:E:Ff:GhI:i:kK:L:l:M:n:P:p:R:S:t:v:Vy"
 	while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (ch) {
 		case '3':
@@ -176,7 +175,7 @@ main(int argc, char **argv) {
 			classname = isc_commandline_argument;
 			break;
 		case 'E':
-			engine = isc_commandline_argument;
+			fatal("%s", isc_result_totext(DST_R_NOENGINE));
 			break;
 		case 'f':
 			c = (unsigned char)(isc_commandline_argument[0]);
@@ -207,6 +206,20 @@ main(int argc, char **argv) {
 		case 'l':
 			label = isc_mem_strdup(mctx, isc_commandline_argument);
 			break;
+		case 'M': {
+			unsigned long ul;
+			tag_min = ul = strtoul(isc_commandline_argument, &endp,
+					       10);
+			if (*endp != ':' || ul > 0xffff) {
+				fatal("-M range invalid");
+			}
+			tag_max = ul = strtoul(endp + 1, &endp, 10);
+			if (*endp != '\0' || ul > 0xffff || tag_max <= tag_min)
+			{
+				fatal("-M range invalid");
+			}
+			break;
+		}
 		case 'n':
 			nametype = isc_commandline_argument;
 			break;
@@ -335,12 +348,7 @@ main(int argc, char **argv) {
 		}
 	}

-	ret = dst_lib_init(mctx, engine);
-	if (ret != ISC_R_SUCCESS) {
-		fatal("could not initialize dst: %s", isc_result_totext(ret));
-	}
-
-	setup_logging(mctx, &log);
+	setup_logging();

 	if (predecessor == NULL) {
 		if (label == NULL) {
@@ -595,8 +603,8 @@ main(int argc, char **argv) {
 	isc_buffer_init(&buf, filename, sizeof(filename) - 1);

 	/* associate the key */
-	ret = dst_key_fromlabel(name, alg, flags, protocol, rdclass, engine,
-				label, NULL, mctx, &key);
+	ret = dst_key_fromlabel(name, alg, flags, protocol, rdclass, label,
+				NULL, mctx, &key);

 	if (ret != ISC_R_SUCCESS) {
 		char namestr[DNS_NAME_FORMATSIZE];
@@ -686,7 +694,8 @@ main(int argc, char **argv) {
 	 * is a risk of ID collision due to this key or another key
 	 * being revoked.
 	 */
-	if (key_collision(key, name, directory, mctx, &exact)) {
+	if (key_collision(key, name, directory, mctx, tag_min, tag_max, &exact))
+	{
 		isc_buffer_clear(&buf);
 		ret = dst_key_buildfilename(key, 0, directory, &buf);
 		if (ret != ISC_R_SUCCESS) {
@@ -731,8 +740,6 @@ main(int argc, char **argv) {
 		dst_key_free(&prevkey);
 	}

-	cleanup_logging(&log);
-	dst_lib_destroy();
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
@@ -21,7 +21,7 @@ dnssec-keyfromlabel - DNSSEC key generation tool
 Synopsis
 ~~~~~~~~

-:program:`dnssec-keyfromlabel` {**-l** label} [**-3**] [**-a** algorithm] [**-A** date/offset] [**-c** class] [**-D** date/offset] [**-D** sync date/offset] [**-E** engine] [**-f** flag] [**-G**] [**-I** date/offset] [**-i** interval] [**-k**] [**-K** directory] [**-L** ttl] [**-n** nametype] [**-P** date/offset] [**-P** sync date/offset] [**-p** protocol] [**-R** date/offset] [**-S** key] [**-t** type] [**-v** level] [**-V**] [**-y**] {name}
+:program:`dnssec-keyfromlabel` {**-l** label} [**-3**] [**-a** algorithm] [**-A** date/offset] [**-c** class] [**-D** date/offset] [**-D** sync date/offset] [**-f** flag] [**-G**] [**-I** date/offset] [**-i** interval] [**-k**] [**-K** directory] [**-L** ttl] [**-M** tag_min:tag_max] [**-n** nametype] [**-P** date/offset] [**-P** sync date/offset] [**-p** protocol] [**-R** date/offset] [**-S** key] [**-t** type] [**-v** level] [**-V**] [**-y**] {name}

 Description
 ~~~~~~~~~~~
@@ -63,22 +63,12 @@ Options
   versions, then the NSEC3 version is used; for example,
   ``dnssec-keygen -3a RSASHA1`` specifies the NSEC3RSASHA1 algorithm.

-.. option:: -E engine
-
-   This option specifies the cryptographic hardware to use.
-
-   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
-   engine identifier that drives the cryptographic accelerator or
-   hardware service module (usually ``pkcs11``).
-
 .. option:: -l label

   This option specifies the label for a key pair in the crypto hardware.

   When BIND 9 is built with OpenSSL-based PKCS#11 support, the label is
-   an arbitrary string that identifies a particular key. It may be
-   preceded by an optional OpenSSL engine name, followed by a colon, as
-   in ``pkcs11:keylabel``.
+   an arbitrary string that identifies a particular key.

 .. option:: -n nametype

@@ -133,6 +123,18 @@ Options
   place, in which case the existing TTL would take precedence. Setting
   the default TTL to ``0`` or ``none`` removes it.

+.. option:: -M tag_min:tag_max
+
+   This option sets the range of key tag values
+   that ``dnssec-keyfromlabel`` will accept. If the key tag of the new
+   key or the key tag of the revoked version of the new key is
+   outside this range, the new key will be rejected.  This is
+   designed to be used when generating keys in a multi-signer
+   scenario, where each operator is given a range of key tags to
+   prevent collisions among different operators.  The valid
+   values for ``tag_min`` and ``tag_max`` are [0..65535].  The
+   default allows all key tag values to be accepted.
+
 .. option:: -p protocol

   This option sets the protocol value for the key. The protocol is a number between
@@ -39,6 +39,7 @@
 #include <isc/buffer.h>
 #include <isc/commandline.h>
 #include <isc/fips.h>
+#include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/region.h>
 #include <isc/result.h>
@@ -49,14 +50,13 @@
 #include <dns/fixedname.h>
 #include <dns/kasp.h>
 #include <dns/keyvalues.h>
-#include <dns/log.h>
 #include <dns/name.h>
 #include <dns/rdataclass.h>
 #include <dns/secalg.h>

 #include <dst/dst.h>

-#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
 #include <openssl/err.h>
 #include <openssl/provider.h>
 #endif
@@ -72,9 +72,7 @@ const char *program = "dnssec-keygen";
 static int min_rsa = 1024;
 static int min_dh = 128;

-isc_log_t *lctx = NULL;
-
-noreturn static void
+ISC_NORETURN static void
 usage(void);

 static void
@@ -91,6 +89,8 @@ struct keygen_ctx {
 	char *type;
 	int protocol;
 	int size;
+	uint16_t tag_min;
+	uint16_t tag_max;
 	int signatory;
 	dns_rdataclass_t rdclass;
 	int options;
@@ -176,11 +176,10 @@ usage(void) {
 	fprintf(stderr, "        (DNSKEY generation defaults to ZONE)\n");
 	fprintf(stderr, "    -c <class>: (default: IN)\n");
 	fprintf(stderr, "    -d <digest bits> (0 => max, default)\n");
-	fprintf(stderr, "    -E <engine>:\n");
-	fprintf(stderr, "        name of an OpenSSL engine to use\n");
 	fprintf(stderr, "    -f <keyflag>: ZSK | KSK | REVOKE\n");
 	fprintf(stderr, "    -F: FIPS mode\n");
 	fprintf(stderr, "    -L <ttl>: default key TTL\n");
+	fprintf(stderr, "    -M <min>:<max>: allowed Key ID range\n");
 	fprintf(stderr, "    -p <protocol>: (default: 3 [dnssec])\n");
 	fprintf(stderr, "    -s <strength>: strength value this key signs DNS "
 			"records with (default: 0)\n");
@@ -253,7 +252,6 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 	char filename[255];
 	char algstr[DNS_SECALG_FORMATSIZE];
 	uint16_t flags = 0;
-	int param = 0;
 	bool null_key = false;
 	bool conflict = false;
 	bool show_progress = false;
@@ -614,12 +612,12 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 				ctx->keystore, name, ctx->policy, ctx->rdclass,
 				mctx, ctx->alg, ctx->size, flags, &key);
 		} else if (!ctx->quiet && show_progress) {
-			ret = dst_key_generate(name, ctx->alg, ctx->size, param,
+			ret = dst_key_generate(name, ctx->alg, ctx->size, 0,
 					       flags, ctx->protocol,
 					       ctx->rdclass, NULL, mctx, &key,
 					       &progress);
 		} else {
-			ret = dst_key_generate(name, ctx->alg, ctx->size, param,
+			ret = dst_key_generate(name, ctx->alg, ctx->size, 0,
 					       flags, ctx->protocol,
 					       ctx->rdclass, NULL, mctx, &key,
 					       NULL);
@@ -758,7 +756,9 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 		 * if there is a risk of ID collision due to this key
 		 * or another key being revoked.
 		 */
-		if (key_collision(key, name, ctx->directory, mctx, NULL)) {
+		if (key_collision(key, name, ctx->directory, mctx, ctx->tag_min,
+				  ctx->tag_max, NULL))
+		{
 			conflict = true;
 			if (null_key) {
 				dst_key_free(&key);
@@ -843,11 +843,10 @@ main(int argc, char **argv) {
 	isc_mem_t *mctx = NULL;
 	isc_result_t ret;
 	isc_textregion_t r;
-	const char *engine = NULL;
 	unsigned char c;
 	int ch;
 	bool set_fips_mode = false;
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
 	OSSL_PROVIDER *fips = NULL, *base = NULL;
 #endif

@@ -868,8 +867,8 @@ main(int argc, char **argv) {
 	/*
 	 * Process memory debugging argument first.
 	 */
-#define CMDLINE_FLAGS                                        \
-	"3A:a:b:Cc:D:d:E:Ff:GhI:i:K:k:L:l:m:n:P:p:qR:r:S:s:" \
+#define CMDLINE_FLAGS                                          \
+	"3A:a:b:Cc:D:d:E:Ff:GhI:i:K:k:L:l:M:m:n:P:p:qR:r:S:s:" \
 	"T:t:v:V"
 	while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (ch) {
@@ -922,7 +921,7 @@ main(int argc, char **argv) {
 			}
 			break;
 		case 'E':
-			engine = isc_commandline_argument;
+			fatal("%s", isc_result_totext(DST_R_NOENGINE));
 			break;
 		case 'f':
 			c = (unsigned char)(isc_commandline_argument[0]);
@@ -958,6 +957,21 @@ main(int argc, char **argv) {
 		case 'n':
 			ctx.nametype = isc_commandline_argument;
 			break;
+		case 'M': {
+			unsigned long ul;
+			ctx.tag_min = ul = strtoul(isc_commandline_argument,
+						   &endp, 10);
+			if (*endp != ':' || ul > 0xffff) {
+				fatal("-M range invalid");
+			}
+			ctx.tag_max = ul = strtoul(endp + 1, &endp, 10);
+			if (*endp != '\0' || ul > 0xffff ||
+			    ctx.tag_max <= ctx.tag_min)
+			{
+				fatal("-M range invalid");
+			}
+			break;
+		}
 		case 'm':
 			break;
 		case 'p':
@@ -1121,7 +1135,7 @@ main(int argc, char **argv) {
 	}

 	if (set_fips_mode) {
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
 		fips = OSSL_PROVIDER_load(NULL, "fips");
 		if (fips == NULL) {
 			ERR_clear_error();
@@ -1141,20 +1155,15 @@ main(int argc, char **argv) {
 		}
 	}

-	ret = dst_lib_init(mctx, engine);
-	if (ret != ISC_R_SUCCESS) {
-		fatal("could not initialize dst: %s", isc_result_totext(ret));
-	}
-
 	/*
-	 * After dst_lib_init which will set FIPS mode if requested
-	 * at build time.  The minumums are both raised to 2048.
+	 * The DST subsystem will set FIPS mode if requested at build time.
+	 * The minimum sizes are both raised to 2048.
 	 */
 	if (isc_fips_mode()) {
 		min_rsa = min_dh = 2048;
 	}

-	setup_logging(mctx, &lctx);
+	setup_logging();

 	ctx.rdclass = strtoclass(classname);

@@ -1226,6 +1235,8 @@ main(int argc, char **argv) {
 			ctx.ksk = true;
 			ctx.zsk = true;
 			ctx.lifetime = 0;
+			ctx.tag_min = 0;
+			ctx.tag_max = 0xffff;

 			keygen(&ctx, mctx, argc, argv);
 		} else {
@@ -1234,7 +1245,7 @@ main(int argc, char **argv) {
 			dns_kasp_t *kasp = NULL;
 			dns_kasp_key_t *kaspkey = NULL;

-			RUNTIME_CHECK(cfg_parser_create(mctx, lctx, &parser) ==
+			RUNTIME_CHECK(cfg_parser_create(mctx, &parser) ==
 				      ISC_R_SUCCESS);
 			if (cfg_parse_file(parser, ctx.configfile,
 					   &cfg_type_namedconf,
@@ -1245,8 +1256,8 @@ main(int argc, char **argv) {
 				      ctx.policy, ctx.configfile);
 			}

-			kasp_from_conf(config, mctx, lctx, ctx.policy,
-				       ctx.directory, engine, &kasp);
+			kasp_from_conf(config, mctx, ctx.policy, ctx.directory,
+				       &kasp);
 			if (kasp == NULL) {
 				fatal("failed to load dnssec-policy '%s'",
 				      ctx.policy);
@@ -1274,6 +1285,8 @@ main(int argc, char **argv) {
 				if (ctx.keystore != NULL) {
 					check_keystore_options(&ctx);
 				}
+				ctx.tag_min = dns_kasp_key_tagmin(kaspkey);
+				ctx.tag_max = dns_kasp_key_tagmax(kaspkey);
 				if ((ctx.ksk && !ctx.wantksk && ctx.wantzsk) ||
 				    (ctx.zsk && !ctx.wantzsk && ctx.wantksk))
 				{
@@ -1290,14 +1303,12 @@ main(int argc, char **argv) {
 		keygen(&ctx, mctx, argc, argv);
 	}

-	cleanup_logging(&lctx);
-	dst_lib_destroy();
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
 	isc_mem_destroy(&mctx);

-#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
 	if (base != NULL) {
 		OSSL_PROVIDER_unload(base);
 	}
@@ -21,7 +21,7 @@ dnssec-keygen: DNSSEC key generation tool
 Synopsis
 ~~~~~~~~

-:program:`dnssec-keygen` [**-3**] [**-A** date/offset] [**-a** algorithm] [**-b** keysize] [**-C**] [**-c** class] [**-D** date/offset] [**-d** bits] [**-D** sync date/offset] [**-E** engine] [**-f** flag] [**-F**] [**-G**] [**-h**] [**-I** date/offset] [**-i** interval] [**-K** directory] [**-k** policy] [**-L** ttl] [**-l** file] [**-n** nametype] [**-P** date/offset] [**-P** sync date/offset] [**-p** protocol] [**-q**] [**-R** date/offset] [**-S** key] [**-s** strength] [**-T** rrtype] [**-t** type] [**-V**] [**-v** level] {name}
+:program:`dnssec-keygen` [**-3**] [**-A** date/offset] [**-a** algorithm] [**-b** keysize] [**-C**] [**-c** class] [**-D** date/offset] [**-d** bits] [**-D** sync date/offset] [**-f** flag] [**-F**] [**-G**] [**-h**] [**-I** date/offset] [**-i** interval] [**-K** directory] [**-k** policy] [**-L** ttl] [**-l** file] [**-M** tag_min:tag_max] [**-n** nametype] [**-P** date/offset] [**-P** sync date/offset] [**-p** protocol] [**-q**] [**-R** date/offset] [**-S** key] [**-s** strength] [**-T** rrtype] [**-t** type] [**-V**] [**-v** level] {name}

 Description
 ~~~~~~~~~~~
@@ -94,14 +94,6 @@ Options
   and 4096 bits. This option is ignored for algorithms ECDSAP256SHA256,
   ECDSAP384SHA384, ED25519, and ED448.

-.. option:: -E engine
-
-   This option specifies the cryptographic hardware to use, when applicable.
-
-   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
-   engine identifier that drives the cryptographic accelerator or
-   hardware service module (usually ``pkcs11``).
-
 .. option:: -f flag

   This option sets the specified flag in the flag field of the KEY/DNSKEY record.
@@ -158,6 +150,19 @@ Options
   This option provides a configuration file that contains a ``dnssec-policy`` statement
   (matching the policy set with :option:`-k`).

+.. option:: -M tag_min:tag_max
+
+   This option sets the range of acceptable key tag values that ``dnssec-keygen``
+   will produce. If the key tag of the new key or the key tag of
+   the revoked version of the new key is outside this range,
+   the new key will be rejected and another new key will be generated.
+   This is designed to be used when generating keys in a multi-signer
+   scenario, where each operator is given a range of key tags to
+   prevent collisions among different operators.  The valid values
+   for ``tag_min`` and ``tag_max`` are [0..65535].  The default allows all
+   key tag values to be produced.  This option is ignored when ``-k policy``
+   is specified.
+
 .. option:: -n nametype

   This option specifies the owner type of the key. The value of ``nametype`` must
@@ -39,9 +39,7 @@ const char *program = "dnssec-ksr";
 /*
 * Infrastructure
 */
-static isc_log_t *lctx = NULL;
 static isc_mem_t *mctx = NULL;
-const char *engine = NULL;
 /*
 * The domain we are working on
 */
@@ -122,7 +120,6 @@ usage(int ret) {
 	fprintf(stderr, "Version: %s\n", PACKAGE_VERSION);
 	fprintf(stderr, "\n");
 	fprintf(stderr, "Options:\n");
-	fprintf(stderr, "    -E <engine>: name of an OpenSSL engine to use\n");
 	fprintf(stderr, "    -e <date/offset>: end date\n");
 	fprintf(stderr, "    -F: FIPS mode\n");
 	fprintf(stderr, "    -f: KSR file to sign\n");
@@ -166,15 +163,14 @@ getkasp(ksr_ctx_t *ksr, dns_kasp_t **kasp) {
 	cfg_parser_t *parser = NULL;
 	cfg_obj_t *config = NULL;

-	RUNTIME_CHECK(cfg_parser_create(mctx, lctx, &parser) == ISC_R_SUCCESS);
+	RUNTIME_CHECK(cfg_parser_create(mctx, &parser) == ISC_R_SUCCESS);
 	if (cfg_parse_file(parser, ksr->configfile, &cfg_type_namedconf,
 			   &config) != ISC_R_SUCCESS)
 	{
 		fatal("unable to load dnssec-policy '%s' from '%s'",
 		      ksr->policy, ksr->configfile);
 	}
-	kasp_from_conf(config, mctx, lctx, ksr->policy, ksr->keydir, engine,
-		       kasp);
+	kasp_from_conf(config, mctx, ksr->policy, ksr->keydir, kasp);
 	if (*kasp == NULL) {
 		fatal("failed to load dnssec-policy '%s'", ksr->policy);
 	}
@@ -440,7 +436,10 @@ create_zsk(ksr_ctx_t *ksr, dns_kasp_key_t *kaspkey, dns_dnsseckeylist_t *keys,
 		}

 		/* Do not overwrite an existing key. */
-		if (key_collision(key, name, ksr->keydir, mctx, NULL)) {
+		if (key_collision(key, name, ksr->keydir, mctx,
+				  dns_kasp_key_tagmin(kaspkey),
+				  dns_kasp_key_tagmax(kaspkey), NULL))
+		{
 			conflict = true;
 			if (verbose > 0) {
 				isc_buffer_clear(&buf);
@@ -1198,7 +1197,7 @@ main(int argc, char *argv[]) {
 	int ch;
 	char *endp;
 	bool set_fips_mode = false;
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
 	OSSL_PROVIDER *fips = NULL, *base = NULL;
 #endif
 	ksr_ctx_t ksr = {
@@ -1213,7 +1212,7 @@ main(int argc, char *argv[]) {
 	while ((ch = isc_commandline_parse(argc, argv, OPTIONS)) != -1) {
 		switch (ch) {
 		case 'E':
-			engine = isc_commandline_argument;
+			fatal("%s", isc_result_totext(DST_R_NOENGINE));
 			break;
 		case 'e':
 			ksr.end = strtotime(isc_commandline_argument, ksr.now,
@@ -1267,23 +1266,18 @@ main(int argc, char *argv[]) {
 		fatal("must provide a command and zone name");
 	}

-	ret = dst_lib_init(mctx, engine);
-	if (ret != ISC_R_SUCCESS) {
-		fatal("could not initialize dst: %s", isc_result_totext(ret));
-	}
-
 	/*
-	 * After dst_lib_init which will set FIPS mode if requested
-	 * at build time.  The minumums are both raised to 2048.
+	 * The DST subsystem will set FIPS mode if requested at build time.
+	 * The minimum sizes are both raised to 2048.
 	 */
 	if (isc_fips_mode()) {
 		min_rsa = min_dh = 2048;
 	}

-	setup_logging(mctx, &lctx);
+	setup_logging();

 	if (set_fips_mode) {
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
 		fips = OSSL_PROVIDER_load(NULL, "fips");
 		if (fips == NULL) {
 			fatal("Failed to load FIPS provider");
@@ -21,7 +21,7 @@ dnssec-ksr - Create signed key response (SKR) files for offline KSK setups
 Synopsis
 ~~~~~~~~

-:program:`dnssec-ksr` [**-E** engine] [**-e** date/offset] [**-F**] [**-h**] [**-i** date/offset] [**-K** directory] [**-k** policy] [**-l** file] [**-V**] [**-v** level] {command} {zone}
+:program:`dnssec-ksr` [**-e** date/offset] [**-F**] [**-h**] [**-i** date/offset] [**-K** directory] [**-k** policy] [**-l** file] [**-V**] [**-v** level] {command} {zone}

 Description
 ~~~~~~~~~~~
@@ -40,14 +40,6 @@ server.
 Options
 ~~~~~~~

-.. option:: -E engine
-
-   This option specifies the cryptographic hardware to use, when applicable.
-
-   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
-   engine identifier that drives the cryptographic accelerator or
-   hardware service module (usually ``pkcs11``).
-
 .. option:: -e date/offset

   This option sets the end date for which keys or SKRs need to be generated
@@ -38,7 +38,7 @@ const char *program = "dnssec-revoke";

 static isc_mem_t *mctx = NULL;

-noreturn static void
+ISC_NORETURN static void
 usage(void);

 static void
@@ -46,7 +46,6 @@ usage(void) {
 	fprintf(stderr, "Usage:\n");
 	fprintf(stderr, "    %s [options] keyfile\n\n", program);
 	fprintf(stderr, "Version: %s\n", PACKAGE_VERSION);
-	fprintf(stderr, "    -E engine:    specify OpenSSL engine\n");
 	fprintf(stderr, "    -f:           force overwrite\n");
 	fprintf(stderr, "    -h:           help\n");
 	fprintf(stderr, "    -K directory: use directory for key files\n");
@@ -64,7 +63,6 @@ usage(void) {
 int
 main(int argc, char **argv) {
 	isc_result_t result;
-	const char *engine = NULL;
 	char const *filename = NULL;
 	char *dir = NULL;
 	char newname[1024], oldname[1024];
@@ -89,7 +87,7 @@ main(int argc, char **argv) {
 	while ((ch = isc_commandline_parse(argc, argv, "E:fK:rRhv:V")) != -1) {
 		switch (ch) {
 		case 'E':
-			engine = isc_commandline_argument;
+			fatal("%s", isc_result_totext(DST_R_NOENGINE));
 			break;
 		case 'f':
 			force = true;
@@ -159,12 +157,6 @@ main(int argc, char **argv) {
 		}
 	}

-	result = dst_lib_init(mctx, engine);
-	if (result != ISC_R_SUCCESS) {
-		fatal("Could not initialize dst: %s",
-		      isc_result_totext(result));
-	}
-
 	result = dst_key_fromnamedfile(
 		filename, dir, DST_TYPE_PUBLIC | DST_TYPE_PRIVATE, mctx, &key);
 	if (result != ISC_R_SUCCESS) {
@@ -248,7 +240,6 @@ main(int argc, char **argv) {

 cleanup:
 	dst_key_free(&key);
-	dst_lib_destroy();
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
@@ -21,7 +21,7 @@ dnssec-revoke - set the REVOKED bit on a DNSSEC key
 Synopsis
 ~~~~~~~~

-:program:`dnssec-revoke` [**-hr**] [**-v** level] [**-V**] [**-K** directory] [**-E** engine] [**-f**] [**-R**] {keyfile}
+:program:`dnssec-revoke` [**-hr**] [**-v** level] [**-V**] [**-K** directory] [**-f**] [**-R**] {keyfile}

 Description
 ~~~~~~~~~~~
@@ -53,14 +53,6 @@ Options

   This option prints version information.

-.. option:: -E engine
-
-   This option specifies the cryptographic hardware to use, when applicable.
-
-   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
-   engine identifier that drives the cryptographic accelerator or
-   hardware service module (usually ``pkcs11``).
-
 .. option:: -f

   This option indicates a forced overwrite and causes :program:`dnssec-revoke` to write the new key pair,
@@ -25,6 +25,7 @@
 #include <isc/commandline.h>
 #include <isc/file.h>
 #include <isc/hash.h>
+#include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
 #include <isc/string.h>
@@ -32,7 +33,6 @@
 #include <isc/util.h>

 #include <dns/keyvalues.h>
-#include <dns/log.h>

 #include <dst/dst.h>

@@ -42,7 +42,7 @@ const char *program = "dnssec-settime";

 static isc_mem_t *mctx = NULL;

-noreturn static void
+ISC_NORETURN static void
 usage(void);

 static void
@@ -51,7 +51,6 @@ usage(void) {
 	fprintf(stderr, "    %s [options] keyfile\n\n", program);
 	fprintf(stderr, "Version: %s\n", PACKAGE_VERSION);
 	fprintf(stderr, "General options:\n");
-	fprintf(stderr, "    -E engine:          specify OpenSSL engine\n");
 	fprintf(stderr, "    -f:                 force update of old-style "
 			"keys\n");
 	fprintf(stderr, "    -K directory:       set key file location\n");
@@ -186,7 +185,6 @@ writekey(dst_key_t *key, const char *directory, bool write_state) {
 int
 main(int argc, char **argv) {
 	isc_result_t result;
-	const char *engine = NULL;
 	const char *filename = NULL;
 	char *directory = NULL;
 	char keystr[DST_KEY_FORMATSIZE];
@@ -228,7 +226,6 @@ main(int argc, char **argv) {
 	bool epoch = false;
 	bool changed = false;
 	bool write_state = false;
-	isc_log_t *log = NULL;
 	isc_stdtime_t syncadd = 0, syncdel = 0;
 	bool unsetsyncadd = false, setsyncadd = false;
 	bool unsetsyncdel = false, setsyncdel = false;
@@ -247,7 +244,7 @@ main(int argc, char **argv) {

 	isc_mem_create(&mctx);

-	setup_logging(mctx, &log);
+	setup_logging();

 	isc_commandline_errprint = false;

@@ -314,7 +311,7 @@ main(int argc, char **argv) {
 					   &setdstime);
 			break;
 		case 'E':
-			engine = isc_commandline_argument;
+			fatal("%s", isc_result_totext(DST_R_NOENGINE));
 			break;
 		case 'f':
 			force = true;
@@ -555,12 +552,6 @@ main(int argc, char **argv) {
 		fatal("Options -g, -d, -k, -r and -z require -s to be set");
 	}

-	result = dst_lib_init(mctx, engine);
-	if (result != ISC_R_SUCCESS) {
-		fatal("Could not initialize dst: %s",
-		      isc_result_totext(result));
-	}
-
 	if (predecessor != NULL) {
 		int major, minor;

@@ -952,11 +943,9 @@ main(int argc, char **argv) {
 		dst_key_free(&prevkey);
 	}
 	dst_key_free(&key);
-	dst_lib_destroy();
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
-	cleanup_logging(&log);
 	isc_mem_free(mctx, directory);
 	isc_mem_destroy(&mctx);

@@ -21,7 +21,7 @@ dnssec-settime: set the key timing metadata for a DNSSEC key
 Synopsis
 ~~~~~~~~

-:program:`dnssec-settime` [**-f**] [**-K** directory] [**-L** ttl] [**-P** date/offset] [**-P** ds date/offset] [**-P** sync date/offset] [**-A** date/offset] [**-R** date/offset] [**-I** date/offset] [**-D** date/offset] [**-D** ds date/offset] [**-D** sync date/offset] [**-S** key] [**-i** interval] [**-h**] [**-V**] [**-v** level] [**-E** engine] {keyfile} [**-s**] [**-g** state] [**-d** state date/offset] [**-k** state date/offset] [**-r** state date/offset] [**-z** state date/offset]
+:program:`dnssec-settime` [**-f**] [**-K** directory] [**-L** ttl] [**-P** date/offset] [**-P** ds date/offset] [**-P** sync date/offset] [**-A** date/offset] [**-R** date/offset] [**-I** date/offset] [**-D** date/offset] [**-D** ds date/offset] [**-D** sync date/offset] [**-S** key] [**-i** interval] [**-h**] [**-V**] [**-v** level] {keyfile} [**-s**] [**-g** state] [**-d** state date/offset] [**-k** state date/offset] [**-r** state date/offset] [**-z** state date/offset]

 Description
 ~~~~~~~~~~~
@@ -97,14 +97,6 @@ Options

   This option sets the debugging level.

-.. option:: -E engine
-
-   This option specifies the cryptographic hardware to use, when applicable.
-
-   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
-   engine identifier that drives the cryptographic accelerator or
-   hardware service module (usually ``pkcs11``).
-
 Timing Options
 ~~~~~~~~~~~~~~

@@ -45,6 +45,7 @@
 #include <isc/fips.h>
 #include <isc/hash.h>
 #include <isc/hex.h>
+#include <isc/log.h>
 #include <isc/loop.h>
 #include <isc/managers.h>
 #include <isc/md.h>
@@ -70,7 +71,6 @@
 #include <dns/fixedname.h>
 #include <dns/kasp.h>
 #include <dns/keyvalues.h>
-#include <dns/log.h>
 #include <dns/master.h>
 #include <dns/masterdump.h>
 #include <dns/nsec.h>
@@ -88,7 +88,7 @@
 #include <dns/zoneverify.h>

 #include <dst/dst.h>
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
 #include <openssl/err.h>
 #include <openssl/provider.h>
 #endif
@@ -140,10 +140,10 @@ static dns_masterformat_t inputformat = dns_masterformat_text;
 static dns_masterformat_t outputformat = dns_masterformat_text;
 static uint32_t rawversion = 1, serialnum = 0;
 static bool snset = false;
-static unsigned int nsigned = 0, nretained = 0, ndropped = 0;
-static unsigned int nverified = 0, nverifyfailed = 0;
+static atomic_uint_fast32_t nsigned = 0, nretained = 0, ndropped = 0;
+static atomic_uint_fast32_t nverified = 0, nverifyfailed = 0;
 static const char *directory = NULL, *dsdir = NULL;
-static isc_mutex_t namelock, statslock;
+static isc_mutex_t namelock;
 static isc_nm_t *netmgr = NULL;
 static isc_loopmgr_t *loopmgr = NULL;
 static dns_db_t *gdb;		  /* The database */
@@ -182,11 +182,9 @@ static dns_ttl_t maxttl = 0;
 static bool no_max_check = false;
 static const char *sync_records = "cdnskey,cds:sha-256";

-#define INCSTAT(counter)            \
-	if (printstats) {           \
-		LOCK(&statslock);   \
-		counter++;          \
-		UNLOCK(&statslock); \
+#define INCSTAT(counter)                               \
+	if (printstats) {                              \
+		atomic_fetch_add_relaxed(&counter, 1); \
 	}

 /*%
@@ -320,9 +318,8 @@ signwithkey(dns_name_t *name, dns_rdataset_t *rdataset, dst_key_t *key,
 	}

 	tuple = NULL;
-	result = dns_difftuple_create(mctx, DNS_DIFFOP_ADDRESIGN, name, ttl,
-				      &trdata, &tuple);
-	check_result(result, "dns_difftuple_create");
+	dns_difftuple_create(mctx, DNS_DIFFOP_ADDRESIGN, name, ttl, &trdata,
+			     &tuple);
 	dns_diff_append(add, &tuple);
 }

@@ -634,24 +631,20 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 			if (sigset.ttl != ttl) {
 				vbprintf(2, "\tfixing ttl %s\n", sigstr);
 				tuple = NULL;
-				result = dns_difftuple_create(
-					mctx, DNS_DIFFOP_DELRESIGN, name,
-					sigset.ttl, &sigrdata, &tuple);
-				check_result(result, "dns_difftuple_create");
+				dns_difftuple_create(mctx, DNS_DIFFOP_DELRESIGN,
+						     name, sigset.ttl,
+						     &sigrdata, &tuple);
 				dns_diff_append(del, &tuple);
-				result = dns_difftuple_create(
-					mctx, DNS_DIFFOP_ADDRESIGN, name, ttl,
-					&sigrdata, &tuple);
-				check_result(result, "dns_difftuple_create");
+				dns_difftuple_create(mctx, DNS_DIFFOP_ADDRESIGN,
+						     name, ttl, &sigrdata,
+						     &tuple);
 				dns_diff_append(add, &tuple);
 			}
 		} else {
 			tuple = NULL;
 			vbprintf(2, "\tremoving signature by %s\n", sigstr);
-			result = dns_difftuple_create(
-				mctx, DNS_DIFFOP_DELRESIGN, name, sigset.ttl,
-				&sigrdata, &tuple);
-			check_result(result, "dns_difftuple_create");
+			dns_difftuple_create(mctx, DNS_DIFFOP_DELRESIGN, name,
+					     sigset.ttl, &sigrdata, &tuple);
 			dns_diff_append(del, &tuple);
 			INCSTAT(ndropped);
 		}
@@ -1080,9 +1073,8 @@ loadds(dns_name_t *name, uint32_t ttl, dns_rdataset_t *dsset) {
 					   dsbuf, &ds);
 		check_result(result, "dns_ds_buildrdata");

-		result = dns_difftuple_create(mctx, DNS_DIFFOP_ADDRESIGN, name,
-					      ttl, &ds, &tuple);
-		check_result(result, "dns_difftuple_create");
+		dns_difftuple_create(mctx, DNS_DIFFOP_ADDRESIGN, name, ttl, &ds,
+				     &tuple);
 		dns_diff_append(&diff, &tuple);
 	}

@@ -2201,10 +2193,9 @@ rrset_cleanup(dns_name_t *name, dns_rdataset_t *rdataset, dns_diff_t *add,
 			{
 				vbprintf(2, "removing duplicate at %s/%s\n",
 					 namestr, typestr);
-				result = dns_difftuple_create(
-					mctx, DNS_DIFFOP_DELRESIGN, name,
-					rdataset->ttl, &rdata2, &tuple);
-				check_result(result, "dns_difftuple_create");
+				dns_difftuple_create(mctx, DNS_DIFFOP_DELRESIGN,
+						     name, rdataset->ttl,
+						     &rdata2, &tuple);
 				dns_diff_append(del, &tuple);
 			} else if (set_maxttl && rdataset->ttl > maxttl) {
 				vbprintf(2,
@@ -2212,16 +2203,14 @@ rrset_cleanup(dns_name_t *name, dns_rdataset_t *rdataset, dns_diff_t *add,
 					 "from %d to %d\n",
 					 namestr, typestr, rdataset->ttl,
 					 maxttl);
-				result = dns_difftuple_create(
-					mctx, DNS_DIFFOP_DELRESIGN, name,
-					rdataset->ttl, &rdata2, &tuple);
-				check_result(result, "dns_difftuple_create");
+				dns_difftuple_create(mctx, DNS_DIFFOP_DELRESIGN,
+						     name, rdataset->ttl,
+						     &rdata2, &tuple);
 				dns_diff_append(del, &tuple);
 				tuple = NULL;
-				result = dns_difftuple_create(
-					mctx, DNS_DIFFOP_ADDRESIGN, name,
-					maxttl, &rdata2, &tuple);
-				check_result(result, "dns_difftuple_create");
+				dns_difftuple_create(mctx, DNS_DIFFOP_ADDRESIGN,
+						     name, maxttl, &rdata2,
+						     &tuple);
 				dns_diff_append(add, &tuple);
 			}
 		}
@@ -3154,15 +3143,13 @@ writeset(const char *prefix, dns_rdatatype_t type) {
 						   DNS_DSDIGEST_SHA256, dsbuf,
 						   &ds);
 			check_result(result, "dns_ds_buildrdata");
-			result = dns_difftuple_create(mctx,
-						      DNS_DIFFOP_ADDRESIGN,
-						      name, 0, &ds, &tuple);
+			dns_difftuple_create(mctx, DNS_DIFFOP_ADDRESIGN, name,
+					     0, &ds, &tuple);
 		} else {
-			result = dns_difftuple_create(
-				mctx, DNS_DIFFOP_ADDRESIGN, gorigin,
-				zone_soa_min_ttl, &rdata, &tuple);
+			dns_difftuple_create(mctx, DNS_DIFFOP_ADDRESIGN,
+					     gorigin, zone_soa_min_ttl, &rdata,
+					     &tuple);
 		}
-		check_result(result, "dns_difftuple_create");
 		dns_diff_append(&diff, &tuple);
 	}

@@ -3212,7 +3199,7 @@ print_version(FILE *fp) {
 	fprintf(fp, "; %s version %s\n", program, PACKAGE_VERSION);
 }

-noreturn static void
+ISC_NORETURN static void
 usage(void);

 static void
@@ -3274,8 +3261,6 @@ usage(void) {
 	fprintf(stderr, "\t-a:\t");
 	fprintf(stderr, "verify generated signatures\n");
 	fprintf(stderr, "\t-c class (IN)\n");
-	fprintf(stderr, "\t-E engine:\n");
-	fprintf(stderr, "\t\tname of an OpenSSL engine to use\n");
 	fprintf(stderr, "\t-P:\t");
 	fprintf(stderr, "disable post-sign verification\n");
 	fprintf(stderr, "\t-Q:\t");
@@ -3322,21 +3307,24 @@ print_stats(isc_time_t *timer_start, isc_time_t *timer_finish,
 	uint64_t sig_ms;  /* Signatures per millisecond */
 	FILE *out = output_stdout ? stderr : stdout;

-	fprintf(out, "Signatures generated:               %10u\n", nsigned);
-	fprintf(out, "Signatures retained:                %10u\n", nretained);
-	fprintf(out, "Signatures dropped:                 %10u\n", ndropped);
-	fprintf(out, "Signatures successfully verified:   %10u\n", nverified);
-	fprintf(out,
-		"Signatures unsuccessfully "
-		"verified: %10u\n",
-		nverifyfailed);
+	fprintf(out, "Signatures generated:               %10" PRIuFAST32 "\n",
+		atomic_load(&nsigned));
+	fprintf(out, "Signatures retained:                %10" PRIuFAST32 "\n",
+		atomic_load(&nretained));
+	fprintf(out, "Signatures dropped:                 %10" PRIuFAST32 "\n",
+		atomic_load(&ndropped));
+	fprintf(out, "Signatures successfully verified:   %10" PRIuFAST32 "\n",
+		atomic_load(&nverified));
+	fprintf(out, "Signatures unsuccessfully verified: %10" PRIuFAST32 "\n",
+		atomic_load(&nverifyfailed));

 	time_us = isc_time_microdiff(sign_finish, sign_start);
 	time_ms = time_us / 1000;
 	fprintf(out, "Signing time in seconds:           %7u.%03u\n",
 		(unsigned int)(time_ms / 1000), (unsigned int)(time_ms % 1000));
 	if (time_us > 0) {
-		sig_ms = ((uint64_t)nsigned * 1000000000) / time_us;
+		sig_ms = ((uint64_t)atomic_load(&nsigned) * 1000000000) /
+			 time_us;
 		fprintf(out, "Signatures per second:             %7u.%03u\n",
 			(unsigned int)sig_ms / 1000,
 			(unsigned int)sig_ms % 1000);
@@ -3363,8 +3351,6 @@ main(int argc, char *argv[]) {
 	isc_time_t sign_start, sign_finish;
 	dns_dnsseckey_t *key;
 	isc_result_t result, vresult;
-	isc_log_t *log = NULL;
-	const char *engine = NULL;
 	bool free_output = false;
 	int tempfilelen = 0;
 	dns_rdataclass_t rdclass;
@@ -3375,7 +3361,7 @@ main(int argc, char *argv[]) {
 	bool set_iter = false;
 	bool nonsecify = false;
 	bool set_fips_mode = false;
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
 	OSSL_PROVIDER *fips = NULL, *base = NULL;
 #endif

@@ -3472,7 +3458,7 @@ main(int argc, char *argv[]) {
 			break;

 		case 'E':
-			engine = isc_commandline_argument;
+			fatal("%s", isc_result_totext(DST_R_NOENGINE));
 			break;

 		case 'e':
@@ -3739,7 +3725,7 @@ main(int argc, char *argv[]) {
 	isc_managers_create(&mctx, nloops, &loopmgr, &netmgr);

 	if (set_fips_mode) {
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
 		fips = OSSL_PROVIDER_load(NULL, "fips");
 		if (fips == NULL) {
 			ERR_clear_error();
@@ -3759,13 +3745,7 @@ main(int argc, char *argv[]) {
 		}
 	}

-	result = dst_lib_init(mctx, engine);
-	if (result != ISC_R_SUCCESS) {
-		fatal("could not initialize dst: %s",
-		      isc_result_totext(result));
-	}
-
-	setup_logging(mctx, &log);
+	setup_logging();

 	argc -= isc_commandline_index;
 	argv += isc_commandline_index;
@@ -4047,10 +4027,6 @@ main(int argc, char *argv[]) {

 	isc_mutex_init(&namelock);

-	if (printstats) {
-		isc_mutex_init(&statslock);
-	}
-
 	presign();
 	sign_start = isc_time_now();
 	signapex();
@@ -4136,13 +4112,11 @@ main(int argc, char *argv[]) {

 	dns_master_styledestroy(&dsstyle, mctx);

-	cleanup_logging(&log);
-	dst_lib_destroy();
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}

-#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
 	if (base != NULL) {
 		OSSL_PROVIDER_unload(base);
 	}
@@ -4157,7 +4131,6 @@ main(int argc, char *argv[]) {
 		timer_finish = isc_time_now();
 		print_stats(&timer_start, &timer_finish, &sign_start,
 			    &sign_finish);
-		isc_mutex_destroy(&statslock);
 	}
 	isc_mutex_destroy(&namelock);

@@ -21,7 +21,7 @@ dnssec-signzone - DNSSEC zone signing tool
 Synopsis
 ~~~~~~~~

-:program:`dnssec-signzone` [**-a**] [**-c** class] [**-d** directory] [**-D**] [**-E** engine] [**-e** end-time] [**-f** output-file] [**-F**] [**-g**] [**-G sync-records**] [**-h**] [**-i** interval] [**-I** input-format] [**-j** jitter] [**-J** filename] [**-K** directory] [**-k** key] [**-L** serial] [**-M** maxttl] [**-N** soa-serial-format] [**-o** origin] [**-O** output-format] [**-P**] [**-Q**] [**-q**] [**-R**] [**-S**] [**-s** start-time] [**-T** ttl] [**-t**] [**-u**] [**-v** level] [**-V**] [**-X** extended end-time] [**-x**] [**-z**] [**-3** salt] [**-H** iterations] [**-A**] {zonefile} [key...]
+:program:`dnssec-signzone` [**-a**] [**-c** class] [**-d** directory] [**-D**] [**-e** end-time] [**-f** output-file] [**-F**] [**-g**] [**-G sync-records**] [**-h**] [**-i** interval] [**-I** input-format] [**-j** jitter] [**-J** filename] [**-K** directory] [**-k** key] [**-L** serial] [**-M** maxttl] [**-N** soa-serial-format] [**-o** origin] [**-O** output-format] [**-P**] [**-Q**] [**-q**] [**-R**] [**-S**] [**-s** start-time] [**-T** ttl] [**-t**] [**-u**] [**-v** level] [**-V**] [**-X** extended end-time] [**-x**] [**-z**] [**-3** salt] [**-H** iterations] [**-A**] {zonefile} [key...]

 Description
 ~~~~~~~~~~~
@@ -62,15 +62,6 @@ Options
   ``$INCLUDE``. This option cannot be combined with :option:`-O raw <-O>`
   or serial-number updating.

-.. option:: -E engine
-
-   This option specifies the hardware to use for cryptographic
-   operations, such as a secure key store used for signing, when applicable.
-
-   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
-   engine identifier that drives the cryptographic accelerator or
-   hardware service module (usually ``pkcs11``).
-
 .. option:: -F

   This options turns on FIPS (US Federal Information Processing Standards)
@@ -23,6 +23,7 @@
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/hex.h>
+#include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/mutex.h>
 #include <isc/os.h>
@@ -42,7 +43,6 @@
 #include <dns/ds.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
-#include <dns/log.h>
 #include <dns/master.h>
 #include <dns/masterdump.h>
 #include <dns/nsec.h>
@@ -136,7 +136,7 @@ loadzone(char *file, char *origin, dns_rdataclass_t rdclass, dns_db_t **db) {
 	}
 }

-noreturn static void
+ISC_NORETURN static void
 usage(void);

 static void
@@ -157,8 +157,6 @@ usage(void) {
 	fprintf(stderr, "\t-I format:\n");
 	fprintf(stderr, "\t\tfile format of input zonefile (text)\n");
 	fprintf(stderr, "\t-c class (IN)\n");
-	fprintf(stderr, "\t-E engine:\n");
-	fprintf(stderr, "\t\tname of an OpenSSL engine to use\n");
 	fprintf(stderr, "\t-x:\tDNSKEY record signed with KSKs only, "
 			"not ZSKs\n");
 	fprintf(stderr, "\t-z:\tAll records signed with KSKs\n");
@@ -170,8 +168,6 @@ main(int argc, char *argv[]) {
 	char *origin = NULL, *file = NULL;
 	char *inputformatstr = NULL;
 	isc_result_t result;
-	isc_log_t *log = NULL;
-	const char *engine = NULL;
 	char *classname = NULL;
 	dns_rdataclass_t rdclass;
 	char *endp;
@@ -215,7 +211,7 @@ main(int argc, char *argv[]) {
 			break;

 		case 'E':
-			engine = isc_commandline_argument;
+			fatal("%s", isc_result_totext(DST_R_NOENGINE));
 			break;

 		case 'I':
@@ -275,17 +271,11 @@ main(int argc, char *argv[]) {
 		}
 	}

-	result = dst_lib_init(mctx, engine);
-	if (result != ISC_R_SUCCESS) {
-		fatal("could not initialize dst: %s",
-		      isc_result_totext(result));
-	}
-
 	now = isc_stdtime_now();

 	rdclass = strtoclass(classname);

-	setup_logging(mctx, &log);
+	setup_logging();

 	argc -= isc_commandline_index;
 	argv += isc_commandline_index;
@@ -335,8 +325,6 @@ main(int argc, char *argv[]) {
 	dns_db_closeversion(gdb, &gversion, false);
 	dns_db_detach(&gdb);

-	cleanup_logging(&log);
-	dst_lib_destroy();
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
@@ -21,7 +21,7 @@ dnssec-verify - DNSSEC zone verification tool
 Synopsis
 ~~~~~~~~

-:program:`dnssec-verify` [**-c** class] [**-E** engine] [**-I** input-format] [**-J** filename] [**-o** origin] [**-q**] [**-v** level] [**-V**] [**-x**] [**-z**] {zonefile}
+:program:`dnssec-verify` [**-c** class] [**-I** input-format] [**-J** filename] [**-o** origin] [**-q**] [**-v** level] [**-V**] [**-x**] [**-z**] {zonefile}

 Description
 ~~~~~~~~~~~
@@ -37,14 +37,6 @@ Options

   This option specifies the DNS class of the zone.

-.. option:: -E engine
-
-   This option specifies the cryptographic hardware to use, when applicable.
-
-   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
-   engine identifier that drives the cryptographic accelerator or
-   hardware service module (usually ``pkcs11``).
-
 .. option:: -I input-format

   This option sets the format of the input zone file. Possible formats are ``text``
@@ -29,6 +29,7 @@
 #include <isc/file.h>
 #include <isc/heap.h>
 #include <isc/list.h>
+#include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
 #include <isc/string.h>
@@ -43,7 +44,6 @@
 #include <dns/fixedname.h>
 #include <dns/journal.h>
 #include <dns/keyvalues.h>
-#include <dns/log.h>
 #include <dns/name.h>
 #include <dns/nsec.h>
 #include <dns/nsec3.h>
@@ -128,10 +128,8 @@ sig_format(dns_rdata_rrsig_t *sig, char *cp, unsigned int size) {
 }

 void
-setup_logging(isc_mem_t *mctx, isc_log_t **logp) {
-	isc_logdestination_t destination;
+setup_logging(void) {
 	isc_logconfig_t *logconfig = NULL;
-	isc_log_t *log = NULL;
 	int level;

 	if (verbose < 0) {
@@ -153,10 +151,8 @@ setup_logging(isc_mem_t *mctx, isc_log_t **logp) {
 		break;
 	}

-	isc_log_create(mctx, &log, &logconfig);
-	isc_log_setcontext(log);
-	dns_log_init(log);
-	dns_log_setcontext(log);
+	logconfig = isc_logconfig_get();
+
 	isc_log_settag(logconfig, program);

 	/*
@@ -165,36 +161,11 @@ setup_logging(isc_mem_t *mctx, isc_log_t **logp) {
 	 *  - the program name and logging level are printed
 	 *  - no time stamp is printed
 	 */
-	destination.file.stream = stderr;
-	destination.file.name = NULL;
-	destination.file.versions = ISC_LOG_ROLLNEVER;
-	destination.file.maximum_size = 0;
-	isc_log_createchannel(logconfig, "stderr", ISC_LOG_TOFILEDESC, level,
-			      &destination,
-			      ISC_LOG_PRINTTAG | ISC_LOG_PRINTLEVEL);
-
-	RUNTIME_CHECK(isc_log_usechannel(logconfig, "stderr", NULL, NULL) ==
-		      ISC_R_SUCCESS);
-
-	*logp = log;
-}
-
-void
-cleanup_logging(isc_log_t **logp) {
-	isc_log_t *log;
-
-	REQUIRE(logp != NULL);
-
-	log = *logp;
-	*logp = NULL;
-
-	if (log == NULL) {
-		return;
-	}
-
-	isc_log_destroy(&log);
-	isc_log_setcontext(NULL);
-	dns_log_setcontext(NULL);
+	isc_log_createandusechannel(
+		logconfig, "default_stderr", ISC_LOG_TOFILEDESC, level,
+		ISC_LOGDESTINATION_STDERR,
+		ISC_LOG_PRINTTAG | ISC_LOG_PRINTLEVEL, ISC_LOGCATEGORY_DEFAULT,
+		ISC_LOGMODULE_DEFAULT);
 }

 static isc_stdtime_t
@@ -479,7 +450,7 @@ set_keyversion(dst_key_t *key) {

 bool
 key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
-	      isc_mem_t *mctx, bool *exact) {
+	      isc_mem_t *mctx, uint16_t min, uint16_t max, bool *exact) {
 	isc_result_t result;
 	bool conflict = false;
 	dns_dnsseckeylist_t matchkeys;
@@ -497,6 +468,21 @@ key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
 	rid = dst_key_rid(dstkey);
 	alg = dst_key_alg(dstkey);

+	if (min != max) {
+		if (id < min || id > max) {
+			fprintf(stderr, "Key ID %d outside of [%u..%u]\n", id,
+				min, max);
+			return (true);
+		}
+		if (rid < min || rid > max) {
+			fprintf(stderr,
+				"Revoked Key ID %d (for tag %d) outside of "
+				"[%u..%u]\n",
+				rid, id, min, max);
+			return (true);
+		}
+	}
+
 	ISC_LIST_INIT(matchkeys);
 	result = dns_dnssec_findmatchingkeys(name, NULL, dir, NULL, now, mctx,
 					     &matchkeys);
@@ -604,9 +590,8 @@ cleanup:
 }

 void
-kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, isc_log_t *lctx,
-	       const char *name, const char *keydir, const char *engine,
-	       dns_kasp_t **kaspp) {
+kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
+	       const char *keydir, dns_kasp_t **kaspp) {
 	isc_result_t result = ISC_R_NOTFOUND;
 	const cfg_listelt_t *element;
 	const cfg_obj_t *kasps = NULL;
@@ -625,8 +610,7 @@ kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, isc_log_t *lctx,
 	{
 		cfg_obj_t *kconfig = cfg_listelt_value(element);
 		ks = NULL;
-		result = cfg_keystore_fromconfig(kconfig, mctx, lctx, engine,
-						 &kslist, NULL);
+		result = cfg_keystore_fromconfig(kconfig, mctx, &kslist, NULL);
 		if (result != ISC_R_SUCCESS) {
 			fatal("failed to configure key-store '%s': %s",
 			      cfg_obj_asstring(cfg_tuple_get(kconfig, "name")),
@@ -635,7 +619,7 @@ kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, isc_log_t *lctx,
 	}
 	/* Default key-directory key store. */
 	ks = NULL;
-	(void)cfg_keystore_fromconfig(NULL, mctx, lctx, engine, &kslist, &ks);
+	(void)cfg_keystore_fromconfig(NULL, mctx, &kslist, &ks);
 	INSIST(ks != NULL);
 	if (keydir != NULL) {
 		/* '-K keydir' takes priority */
@@ -655,8 +639,8 @@ kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, isc_log_t *lctx,
 			continue;
 		}

-		result = cfg_kasp_fromconfig(kconfig, NULL, true, mctx, lctx,
-					     &kslist, &kasplist, &kasp);
+		result = cfg_kasp_fromconfig(kconfig, NULL, true, mctx, &kslist,
+					     &kasplist, &kasp);
 		if (result != ISC_R_SUCCESS) {
 			fatal("failed to configure dnssec-policy '%s': %s",
 			      cfg_obj_asstring(cfg_tuple_get(kconfig, "name")),
@@ -54,7 +54,7 @@ extern uint8_t dtype[8];

 typedef void(fatalcallback_t)(void);

-noreturn void
+ISC_NORETURN void
 fatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);

 void
@@ -66,7 +66,7 @@ check_result(isc_result_t result, const char *message);
 void
 vbprintf(int level, const char *fmt, ...) ISC_FORMAT_PRINTF(2, 3);

-noreturn void
+ISC_NORETURN void
 version(const char *program);

 void
@@ -75,10 +75,7 @@ sig_format(dns_rdata_rrsig_t *sig, char *cp, unsigned int size);
 	(DNS_NAME_FORMATSIZE + DNS_SECALG_FORMATSIZE + sizeof("65535"))

 void
-setup_logging(isc_mem_t *mctx, isc_log_t **logp);
-
-void
-cleanup_logging(isc_log_t **logp);
+setup_logging(void);

 dns_ttl_t
 strtottl(const char *str);
@@ -109,7 +106,7 @@ set_keyversion(dst_key_t *key);

 bool
 key_collision(dst_key_t *key, dns_name_t *name, const char *dir,
-	      isc_mem_t *mctx, bool *exact);
+	      isc_mem_t *mctx, uint16_t min, uint16_t max, bool *exact);

 bool
 isoptarg(const char *arg, char **argv, void (*usage)(void));
@@ -118,6 +115,5 @@ void
 loadjournal(isc_mem_t *mctx, dns_db_t *db, const char *journal);

 void
-kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, isc_log_t *lctx,
-	       const char *name, const char *keydir, const char *engine,
-	       dns_kasp_t **kaspp);
+kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
+	       const char *keydir, dns_kasp_t **kaspp);
@@ -63,7 +63,6 @@ options {\n\
 	geoip-directory \".\";\n"
 #endif /* if defined(HAVE_GEOIP2) */
 			    "\
-	heartbeat-interval 60;\n\
 	interface-interval 60;\n\
 	listen-on {any;};\n\
 	listen-on-v6 {any;};\n\
@@ -170,7 +169,8 @@ options {\n\
 	max-clients-per-query 100;\n\
 	max-ncache-ttl 10800; /* 3 hours */\n\
 	max-recursion-depth 7;\n\
-	max-recursion-queries 100;\n\
+	max-recursion-queries 32;\n\
+	max-query-restarts 11;\n\
 	max-stale-ttl 86400; /* 1 day */\n\
 	message-compression yes;\n\
 	min-ncache-ttl 0; /* 0 hours */\n\
@@ -189,6 +189,7 @@ options {\n\
 	recursion true;\n\
 	request-expire true;\n\
 	request-ixfr true;\n\
+	request-ixfr-max-diffs 0;\n\
 	require-server-cookie no;\n\
 	root-key-sentinel yes;\n\
 	servfail-ttl 1;\n\
@@ -215,7 +216,6 @@ options {\n\
 	check-sibling yes;\n\
 	check-srv-cname warn;\n\
 	check-wildcard yes;\n\
-	dialup no;\n\
 	dnssec-loadkeys-interval 60;\n\
 #	forward <none>\n\
 #	forwarders <none>\n\
@@ -298,6 +298,7 @@ dnssec-policy \"default\" {\n\
 	cds-digest-types { 2; };\n\
 	dnskey-ttl " DNS_KASP_KEY_TTL ";\n\
 	inline-signing yes;\n\
+	offline-ksk no;\n\
 	publish-safety " DNS_KASP_PUBLISH_SAFETY "; \n\
 	retire-safety " DNS_KASP_RETIRE_SAFETY "; \n\
 	purge-keys " DNS_KASP_PURGE_KEYS "; \n\
@@ -355,7 +356,9 @@ named_config_parsedefaults(cfg_parser_t *parser, cfg_obj_t **conf) {
 	isc_buffer_init(&b, defaultconf, sizeof(defaultconf) - 1);
 	isc_buffer_add(&b, sizeof(defaultconf) - 1);
 	return (cfg_parse_buffer(parser, &b, __FILE__, 0, &cfg_type_namedconf,
-				 CFG_PCTX_NODEPRECATED, conf));
+				 CFG_PCTX_NODEPRECATED | CFG_PCTX_NOOBSOLETE |
+					 CFG_PCTX_NOEXPERIMENTAL,
+				 conf));
 }

 const char *
@@ -448,8 +451,8 @@ named_config_getclass(const cfg_obj_t *classobj, dns_rdataclass_t defclass,
 	r.length = strlen(r.base);
 	result = dns_rdataclass_fromtext(classp, &r);
 	if (result != ISC_R_SUCCESS) {
-		cfg_obj_log(classobj, named_g_lctx, ISC_LOG_ERROR,
-			    "unknown class '%s'", r.base);
+		cfg_obj_log(classobj, ISC_LOG_ERROR, "unknown class '%s'",
+			    r.base);
 	}
 	return (result);
 }
@@ -468,8 +471,8 @@ named_config_gettype(const cfg_obj_t *typeobj, dns_rdatatype_t deftype,
 	r.length = strlen(r.base);
 	result = dns_rdatatype_fromtext(typep, &r);
 	if (result != ISC_R_SUCCESS) {
-		cfg_obj_log(typeobj, named_g_lctx, ISC_LOG_ERROR,
-			    "unknown type '%s'", r.base);
+		cfg_obj_log(typeobj, ISC_LOG_ERROR, "unknown type '%s'",
+			    r.base);
 	}
 	return (result);
 }
@@ -660,7 +663,7 @@ newlist:
 	if (cfg_obj_isuint32(portobj)) {
 		uint32_t val = cfg_obj_asuint32(portobj);
 		if (val > UINT16_MAX) {
-			cfg_obj_log(portobj, named_g_lctx, ISC_LOG_ERROR,
+			cfg_obj_log(portobj, ISC_LOG_ERROR,
 				    "port '%u' out of range", val);
 			result = ISC_R_RANGE;
 			goto cleanup;
@@ -715,7 +718,7 @@ resume:
 			tresult = named_config_getremotesdef(config, listtype,
 							     listname, &list);
 			if (tresult == ISC_R_NOTFOUND) {
-				cfg_obj_log(addr, named_g_lctx, ISC_LOG_ERROR,
+				cfg_obj_log(addr, ISC_LOG_ERROR,
 					    "%s \"%s\" not found", listtype,
 					    listname);

@@ -887,8 +890,7 @@ named_config_getport(const cfg_obj_t *config, const char *type,
 	result = named_config_get(maps, type, &portobj);
 	INSIST(result == ISC_R_SUCCESS);
 	if (cfg_obj_asuint32(portobj) >= UINT16_MAX) {
-		cfg_obj_log(portobj, named_g_lctx, ISC_LOG_ERROR,
-			    "port '%u' out of range",
+		cfg_obj_log(portobj, ISC_LOG_ERROR, "port '%u' out of range",
 			    cfg_obj_asuint32(portobj));
 		return (ISC_R_RANGE);
 	}
@@ -135,7 +135,7 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 	    !command_compare(command, NAMED_COMMAND_TESTGEN) &&
 	    !command_compare(command, NAMED_COMMAND_ZONESTATUS))
 	{
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_CONTROL, log_level,
 			      "rejecting restricted control channel "
 			      "command '%s'",
@@ -144,9 +144,9 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		goto cleanup;
 	}

-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_CONTROL, log_level,
-		      "received control channel command '%s'", cmdline);
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_CONTROL,
+		      log_level, "received control channel command '%s'",
+		      cmdline);

 	/*
 	 * After the lengthy "halt" and "stop", the commands are
@@ -203,7 +203,7 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 	{
 		result = named_server_changezone(named_g_server, cmdline, text);
 	} else if (command_compare(command, NAMED_COMMAND_CLOSELOGS)) {
-		isc_log_closefilelogs(named_g_lctx);
+		isc_log_closefilelogs();
 		result = ISC_R_SUCCESS;
 	} else if (command_compare(command, NAMED_COMMAND_DELZONE)) {
 		result = named_server_delzone(named_g_server, lex, text);
@@ -228,6 +228,8 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		result = named_server_flushnode(named_g_server, lex, true);
 	} else if (command_compare(command, NAMED_COMMAND_FREEZE)) {
 		result = named_server_freeze(named_g_server, true, lex, text);
+	} else if (command_compare(command, NAMED_COMMAND_SKR)) {
+		result = named_server_skr(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_LOADKEYS) ||
 		   command_compare(command, NAMED_COMMAND_SIGN))
 	{
@@ -238,7 +240,7 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		result = named_server_notifycommand(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_NOTRACE)) {
 		named_g_debuglevel = 0;
-		isc_log_setdebuglevel(named_g_lctx, named_g_debuglevel);
+		isc_log_setdebuglevel(named_g_debuglevel);
 		result = ISC_R_SUCCESS;
 	} else if (command_compare(command, NAMED_COMMAND_NTA)) {
 		result = named_server_nta(named_g_server, lex, readonly, text);
@@ -287,7 +289,7 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 	} else if (command_compare(command, NAMED_COMMAND_ZONESTATUS)) {
 		result = named_server_zonestatus(named_g_server, lex, text);
 	} else {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_CONTROL, ISC_LOG_WARNING,
 			      "unknown control channel command '%s'", command);
 		result = DNS_R_UNKNOWNCOMMAND;
@@ -225,9 +225,9 @@ shutdown_listener(controllistener_t *listener) {

 	char socktext[ISC_SOCKADDR_FORMATSIZE];
 	isc_sockaddr_format(&listener->address, socktext, sizeof(socktext));
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_CONTROL, ISC_LOG_NOTICE,
-		      "stopping command channel on %s", socktext);
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_CONTROL,
+		      ISC_LOG_NOTICE, "stopping command channel on %s",
+		      socktext);

 	isc_nm_stoplistening(listener->sock);
 	isc_nmsocket_close(&listener->sock);
@@ -272,7 +272,7 @@ control_senddone(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 		isc_sockaddr_t peeraddr = isc_nmhandle_peeraddr(handle);

 		isc_sockaddr_format(&peeraddr, socktext, sizeof(socktext));
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_CONTROL, ISC_LOG_WARNING,
 			      "error sending command response to %s: %s",
 			      socktext, isc_result_totext(result));
@@ -291,9 +291,8 @@ log_invalid(isccc_ccmsg_t *ccmsg, isc_result_t result) {
 	isc_sockaddr_t peeraddr = isc_nmhandle_peeraddr(ccmsg->handle);

 	isc_sockaddr_format(&peeraddr, socktext, sizeof(socktext));
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_CONTROL, ISC_LOG_ERROR,
-		      "invalid command from %s: %s", socktext,
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_CONTROL,
+		      ISC_LOG_ERROR, "invalid command from %s: %s", socktext,
 		      isc_result_totext(result));
 }

@@ -588,9 +587,8 @@ conn_free(controlconnection_t *conn) {
 	}
 #endif /* ifdef ENABLE_AFL */

-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_CONTROL, ISC_LOG_DEBUG(3),
-		      "freeing control connection");
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_CONTROL,
+		      ISC_LOG_DEBUG(3), "freeing control connection");

 	isc_mem_put(listener->mctx, conn, sizeof(*conn));

@@ -601,7 +599,7 @@ static void
 newconnection(controllistener_t *listener, isc_nmhandle_t *handle) {
 	/* Don't create new connection if we are shutting down */
 	if (listener->shuttingdown) {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_CONTROL, ISC_LOG_DEBUG(3),
 			      "rejected new control connection: %s",
 			      isc_result_totext(ISC_R_SHUTTINGDOWN));
@@ -609,9 +607,8 @@ newconnection(controllistener_t *listener, isc_nmhandle_t *handle) {
 	}

 	controlconnection_t *conn = isc_mem_get(listener->mctx, sizeof(*conn));
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_CONTROL, ISC_LOG_DEBUG(3),
-		      "allocate new control connection");
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_CONTROL,
+		      ISC_LOG_DEBUG(3), "allocate new control connection");

 	*conn = (controlconnection_t){
 		.alg = DST_ALG_UNKNOWN,
@@ -648,7 +645,7 @@ control_newconn(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 	if (!address_ok(&peeraddr, listener)) {
 		char socktext[ISC_SOCKADDR_FORMATSIZE];
 		isc_sockaddr_format(&peeraddr, socktext, sizeof(socktext));
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_CONTROL, ISC_LOG_WARNING,
 			      "rejected command channel message from %s",
 			      socktext);
@@ -760,7 +757,7 @@ register_keys(const cfg_obj_t *control, const cfg_obj_t *keylist,

 		result = cfgkeylist_find(keylist, keyid->keyname, &keydef);
 		if (result != ISC_R_SUCCESS) {
-			cfg_obj_log(control, named_g_lctx, ISC_LOG_WARNING,
+			cfg_obj_log(control, ISC_LOG_WARNING,
 				    "couldn't find key '%s' for use with "
 				    "command channel %s",
 				    keyid->keyname, socktext);
@@ -783,8 +780,7 @@ register_keys(const cfg_obj_t *control, const cfg_obj_t *keylist,
 			result = named_config_getkeyalgorithm(algstr, &algtype,
 							      NULL);
 			if (result != ISC_R_SUCCESS) {
-				cfg_obj_log(control, named_g_lctx,
-					    ISC_LOG_WARNING,
+				cfg_obj_log(control, ISC_LOG_WARNING,
 					    "unsupported algorithm '%s' in "
 					    "key '%s' for use with command "
 					    "channel %s",
@@ -799,8 +795,7 @@ register_keys(const cfg_obj_t *control, const cfg_obj_t *keylist,
 			result = isc_base64_decodestring(secretstr, &b);

 			if (result != ISC_R_SUCCESS) {
-				cfg_obj_log(keydef, named_g_lctx,
-					    ISC_LOG_WARNING,
+				cfg_obj_log(keydef, ISC_LOG_WARNING,
 					    "secret for key '%s' on "
 					    "command channel %s: %s",
 					    keyid->keyname, socktext,
@@ -834,14 +829,14 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
 	unsigned int algtype;
 	isc_buffer_t b;

-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_CONTROL, ISC_LOG_INFO,
-		      "configuring command channel from '%s'", named_g_keyfile);
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_CONTROL,
+		      ISC_LOG_INFO, "configuring command channel from '%s'",
+		      named_g_keyfile);
 	if (!isc_file_exists(named_g_keyfile)) {
 		return (ISC_R_FILENOTFOUND);
 	}

-	CHECK(cfg_parser_create(mctx, named_g_lctx, &pctx));
+	CHECK(cfg_parser_create(mctx, &pctx));
 	CHECK(cfg_parse_file(pctx, named_g_keyfile, &cfg_type_rndckey,
 			     &config));
 	CHECK(cfg_map_get(config, "key", &key));
@@ -857,7 +852,7 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
 		CHECK(ISC_R_NOMEMORY);
 	}

-	CHECK(isccfg_check_key(key, named_g_lctx));
+	CHECK(isccfg_check_key(key));

 	(void)cfg_map_get(key, "algorithm", &algobj);
 	(void)cfg_map_get(key, "secret", &secretobj);
@@ -868,7 +863,7 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {

 	result = named_config_getkeyalgorithm(algstr, &algtype, NULL);
 	if (result != ISC_R_SUCCESS) {
-		cfg_obj_log(key, named_g_lctx, ISC_LOG_WARNING,
+		cfg_obj_log(key, ISC_LOG_WARNING,
 			    "unsupported algorithm '%s' in "
 			    "key '%s' for use with command "
 			    "channel",
@@ -881,7 +876,7 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
 	result = isc_base64_decodestring(secretstr, &b);

 	if (result != ISC_R_SUCCESS) {
-		cfg_obj_log(key, named_g_lctx, ISC_LOG_WARNING,
+		cfg_obj_log(key, ISC_LOG_WARNING,
 			    "secret for key '%s' on command channel: %s",
 			    keyid->keyname, isc_result_totext(result));
 		goto cleanup;
@@ -1009,12 +1004,12 @@ update_listener(named_controls_t *cp, controllistener_t **listenerp,
 		 * sake of avoiding this message would be too much trouble.
 		 */
 		if (control != NULL) {
-			cfg_obj_log(control, named_g_lctx, ISC_LOG_WARNING,
+			cfg_obj_log(control, ISC_LOG_WARNING,
 				    "couldn't install new keys for "
 				    "command channel %s: %s",
 				    socktext, isc_result_totext(result));
 		} else {
-			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			isc_log_write(NAMED_LOGCATEGORY_GENERAL,
 				      NAMED_LOGMODULE_CONTROL, ISC_LOG_WARNING,
 				      "couldn't install new keys for "
 				      "command channel %s: %s",
@@ -1027,9 +1022,8 @@ update_listener(named_controls_t *cp, controllistener_t **listenerp,
 	 */
 	if (control != NULL && type == isc_socktype_tcp) {
 		allow = cfg_tuple_get(control, "allow");
-		result = cfg_acl_fromconfig(allow, config, named_g_lctx,
-					    aclconfctx, listener->mctx, 0,
-					    &new_acl);
+		result = cfg_acl_fromconfig(allow, config, aclconfctx,
+					    listener->mctx, 0, &new_acl);
 	} else {
 		result = dns_acl_any(listener->mctx, &new_acl);
 	}
@@ -1049,12 +1043,12 @@ update_listener(named_controls_t *cp, controllistener_t **listenerp,
 		dns_acl_detach(&new_acl);
 		/* XXXDCL say the old acl is still used? */
 	} else if (control != NULL) {
-		cfg_obj_log(control, named_g_lctx, ISC_LOG_WARNING,
+		cfg_obj_log(control, ISC_LOG_WARNING,
 			    "couldn't install new acl for "
 			    "command channel %s: %s",
 			    socktext, isc_result_totext(result));
 	} else {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_CONTROL, ISC_LOG_WARNING,
 			      "couldn't install new acl for "
 			      "command channel %s: %s",
@@ -1101,8 +1095,8 @@ add_listener(named_controls_t *cp, controllistener_t **listenerp,
 		const cfg_obj_t *readonly = NULL;

 		allow = cfg_tuple_get(control, "allow");
-		CHECK(cfg_acl_fromconfig(allow, config, named_g_lctx,
-					 aclconfctx, mctx, 0, &new_acl));
+		CHECK(cfg_acl_fromconfig(allow, config, aclconfctx, mctx, 0,
+					 &new_acl));

 		readonly = cfg_tuple_get(control, "read-only");
 		if (!cfg_obj_isvoid(readonly)) {
@@ -1128,7 +1122,7 @@ add_listener(named_controls_t *cp, controllistener_t **listenerp,
 	} else {
 		result = get_rndckey(mctx, &listener->keys);
 		if (result != ISC_R_SUCCESS && control != NULL) {
-			cfg_obj_log(control, named_g_lctx, ISC_LOG_WARNING,
+			cfg_obj_log(control, ISC_LOG_WARNING,
 				    "couldn't install keys for "
 				    "command channel %s: %s",
 				    socktext, isc_result_totext(result));
@@ -1146,9 +1140,9 @@ add_listener(named_controls_t *cp, controllistener_t **listenerp,
 			       &listener->address, control_newconn, listener, 5,
 			       NULL, &listener->sock));

-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_CONTROL, ISC_LOG_NOTICE,
-		      "command channel listening on %s", socktext);
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_CONTROL,
+		      ISC_LOG_NOTICE, "command channel listening on %s",
+		      socktext);
 	*listenerp = listener;
 	return;

@@ -1159,11 +1153,11 @@ cleanup:

 shuttingdown:
 	if (control != NULL) {
-		cfg_obj_log(control, named_g_lctx, ISC_LOG_WARNING,
+		cfg_obj_log(control, ISC_LOG_WARNING,
 			    "couldn't add command channel %s: %s", socktext,
 			    isc_result_totext(result));
 	} else {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_CONTROL, ISC_LOG_NOTICE,
 			      "couldn't add command channel %s: %s", socktext,
 			      isc_result_totext(result));
@@ -1208,8 +1202,7 @@ named_controls_configure(named_controls_t *cp, const cfg_obj_t *config,

 			(void)cfg_map_get(controls, "unix", &unixcontrols);
 			if (unixcontrols != NULL) {
-				cfg_obj_log(controls, named_g_lctx,
-					    ISC_LOG_ERROR,
+				cfg_obj_log(controls, ISC_LOG_ERROR,
 					    "UNIX domain sockets are not "
 					    "supported");
 				return (ISC_R_FAILURE);
@@ -1245,8 +1238,7 @@ named_controls_configure(named_controls_t *cp, const cfg_obj_t *config,
 				isc_sockaddr_format(&addr, socktext,
 						    sizeof(socktext));

-				isc_log_write(named_g_lctx,
-					      NAMED_LOGCATEGORY_GENERAL,
+				isc_log_write(NAMED_LOGCATEGORY_GENERAL,
 					      NAMED_LOGMODULE_CONTROL,
 					      ISC_LOG_DEBUG(9),
 					      "processing control channel %s",
@@ -17,13 +17,13 @@
 #include <stdlib.h>
 #include <string.h>

+#include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
 #include <isc/util.h>
 #include <isc/uv.h>

 #include <dns/dlz_dlopen.h>
-#include <dns/log.h>

 #include <dlz/dlz_dlopen_driver.h>
 #include <named/globals.h>
@@ -80,7 +80,7 @@ static void
 dlopen_log(int level, const char *fmt, ...) {
 	va_list ap;
 	va_start(ap, fmt);
-	isc_log_vwrite(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_DLZ,
+	isc_log_vwrite(DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_DLZ,
 		       ISC_LOG_DEBUG(level), fmt, ap);
 	va_end(ap);
 }
@@ -26,13 +26,12 @@
 #include <unistd.h>

 #include <isc/condition.h>
+#include <isc/log.h>
 #include <isc/loop.h>
 #include <isc/mutex.h>
 #include <isc/thread.h>
 #include <isc/util.h>

-#include <dns/log.h>
-
 #include <named/globals.h>
 #include <named/log.h>
 #include <named/server.h>
@@ -39,8 +39,8 @@ open_geoip2(const char *dir, const char *dbfile, MMDB_s *mmdb) {

 	n = snprintf(pathbuf, sizeof(pathbuf), "%s/%s", dir, dbfile);
 	if (n >= sizeof(pathbuf)) {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+			      ISC_LOG_ERROR,
 			      "GeoIP2 database '%s/%s': path too long", dir,
 			      dbfile);
 		return (NULL);
@@ -48,14 +48,14 @@ open_geoip2(const char *dir, const char *dbfile, MMDB_s *mmdb) {

 	ret = MMDB_open(pathbuf, MMDB_MODE_MMAP, mmdb);
 	if (ret == MMDB_SUCCESS) {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
-			      "opened GeoIP2 database '%s'", pathbuf);
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+			      ISC_LOG_INFO, "opened GeoIP2 database '%s'",
+			      pathbuf);
 		return (mmdb);
 	}

-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_SERVER, ISC_LOG_DEBUG(1),
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+		      ISC_LOG_DEBUG(1),
 		      "unable to open GeoIP2 database '%s' (status %d)",
 		      pathbuf, ret);

@@ -79,9 +79,9 @@ named_geoip_load(char *dir) {
 #if defined(HAVE_GEOIP2)
 	REQUIRE(dir != NULL);

-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
-		      "looking for GeoIP2 databases in '%s'", dir);
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+		      ISC_LOG_INFO, "looking for GeoIP2 databases in '%s'",
+		      dir);

 	named_g_geoip->country = open_geoip2(dir, "GeoIP2-Country.mmdb",
 					     &geoip_country);
@@ -61,6 +61,7 @@
 #define NAMED_COMMAND_SHOWZONE	   "showzone"
 #define NAMED_COMMAND_SIGN	   "sign"
 #define NAMED_COMMAND_SIGNING	   "signing"
+#define NAMED_COMMAND_SKR	   "skr"
 #define NAMED_COMMAND_STATUS	   "status"
 #define NAMED_COMMAND_STOP	   "stop"
 #define NAMED_COMMAND_SYNC	   "sync"
@@ -86,10 +86,8 @@ EXTERN named_server_t *named_g_server INIT(NULL);
 /*
 * Logging.
 */
-EXTERN isc_log_t *named_g_lctx		     INIT(NULL);
-EXTERN isc_logcategory_t *named_g_categories INIT(NULL);
-EXTERN isc_logmodule_t *named_g_modules	     INIT(NULL);
-EXTERN unsigned int named_g_debuglevel	     INIT(0);
+EXTERN bool named_g_logging	       INIT(false);
+EXTERN unsigned int named_g_debuglevel INIT(0);

 /*
 * Current configuration information.
@@ -129,8 +127,6 @@ EXTERN const char *named_g_defaultpidfile INIT(NAMED_LOCALSTATEDIR "/run/"

 EXTERN const char *named_g_username INIT(NULL);

-EXTERN const char *named_g_engine INIT(NULL);
-
 EXTERN isc_time_t		  named_g_boottime;
 EXTERN isc_time_t		  named_g_configtime;
 EXTERN bool named_g_memstatistics INIT(false);
@@ -18,22 +18,8 @@
 #include <isc/log.h>
 #include <isc/types.h>

-#include <dns/log.h>
-
 #include <named/globals.h> /* Required for named_g_(categories|modules). */

-/* Unused slot 0. */
-#define NAMED_LOGCATEGORY_UNMATCHED (&named_g_categories[1])
-
-/*
- * Backwards compatibility.
- */
-#define NAMED_LOGCATEGORY_GENERAL ISC_LOGCATEGORY_GENERAL
-
-#define NAMED_LOGMODULE_MAIN	(&named_g_modules[0])
-#define NAMED_LOGMODULE_SERVER	(&named_g_modules[1])
-#define NAMED_LOGMODULE_CONTROL (&named_g_modules[2])
-
 isc_result_t
 named_log_init(bool safe);
 /*%
@@ -79,6 +65,3 @@ named_log_setunmatchedcategory(isc_logconfig_t *lcfg);
 /*%
 * Set up "category unmatched" to go to the right places.
 */
-
-void
-named_log_shutdown(void);
@@ -26,7 +26,7 @@
 */
 #define NAMED_MAIN_ARGS "46A:c:Cd:D:E:fFgL:M:m:n:N:p:sS:t:T:U:u:vVx:X:"

-noreturn void
+ISC_NORETURN void
 named_main_earlyfatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);

 void
@@ -39,10 +39,13 @@ void
 named_os_inituserinfo(const char *username);

 void
-named_os_changeuser(void);
+named_os_changeuser(bool permanent);
+
+void
+named_os_restoreuser(void);

 uid_t
-ns_os_uid(void);
+named_os_uid(void);

 void
 named_os_adjustnofile(void);
@@ -75,7 +75,6 @@ struct named_server {
 	isc_timer_t *tat_timer;

 	uint32_t interface_interval;
-	uint32_t heartbeat_interval;

 	atomic_int reload_status;

@@ -376,3 +375,9 @@ named_server_servestale(named_server_t *server, isc_lex_t *lex,
 isc_result_t
 named_server_fetchlimit(named_server_t *server, isc_lex_t *lex,
 			isc_buffer_t **text);
+
+/*%
+ * Import SKR file for offline KSK signing.
+ */
+isc_result_t
+named_server_skr(named_server_t *server, isc_lex_t *lex, isc_buffer_t **text);
@@ -15,67 +15,29 @@

 #include <stdlib.h>

+#include <isc/log.h>
 #include <isc/result.h>
 #include <isc/util.h>

-#include <dns/log.h>
-
-#include <isccfg/log.h>
-
-#include <ns/log.h>
-
 #include <named/log.h>

 #ifndef ISC_FACILITY
 #define ISC_FACILITY LOG_DAEMON
 #endif /* ifndef ISC_FACILITY */

-/*%
- * When adding a new category, be sure to add the appropriate
- * \#define to <named/log.h> and to update the list in
- * bin/check/check-tool.c.
- */
-static isc_logcategory_t categories[] = { { "", 0 },
-					  { "unmatched", 0 },
-					  { NULL, 0 } };
-
-/*%
- * When adding a new module, be sure to add the appropriate
- * \#define to <dns/log.h>.
- */
-static isc_logmodule_t modules[] = {
-	{ "main", 0 }, { "server", 0 }, { "control", 0 }, { NULL, 0 }
-};
-
 isc_result_t
 named_log_init(bool safe) {
 	isc_result_t result;
 	isc_logconfig_t *lcfg = NULL;
-	isc_mem_t *log_mctx = NULL;
-
-	named_g_categories = categories;
-	named_g_modules = modules;

 	/*
-	 * Setup a logging context.
+	 * This is not technically needed, as we are calling named_log_init()
+	 * only at the start of named process.  But since the named binary is
+	 * the only place that also calls isc_logconfig_set(), this is a good
+	 * hygiene.
 	 */
-	isc_mem_create(&log_mctx);
-	isc_mem_setname(log_mctx, "named_log");
-	isc_log_create(log_mctx, &named_g_lctx, &lcfg);
-	isc_mem_detach(&log_mctx);
-
-	/*
-	 * named-checktool.c:setup_logging() needs to be kept in sync.
-	 */
-	isc_log_registercategories(named_g_lctx, named_g_categories);
-	isc_log_registermodules(named_g_lctx, named_g_modules);
-	isc_log_setcontext(named_g_lctx);
-	dns_log_init(named_g_lctx);
-	dns_log_setcontext(named_g_lctx);
-	cfg_log_init(named_g_lctx);
-	ns_log_init(named_g_lctx);
-	ns_log_setcontext(named_g_lctx);
-
+	rcu_read_lock();
+	lcfg = isc_logconfig_get();
 	if (safe) {
 		named_log_setsafechannels(lcfg);
 	} else {
@@ -88,13 +50,14 @@ named_log_init(bool safe) {
 	}

 	named_log_setdefaultsslkeylogfile(lcfg);
+	rcu_read_unlock();
+
+	named_g_logging = true;

 	return (ISC_R_SUCCESS);

 cleanup:
-	isc_log_destroy(&named_g_lctx);
-	isc_log_setcontext(NULL);
-	dns_log_setcontext(NULL);
+	rcu_read_unlock();

 	return (result);
 }
@@ -139,7 +102,7 @@ named_log_setdefaultchannels(isc_logconfig_t *lcfg) {
 	/*
 	 * Set the initial debug level.
 	 */
-	isc_log_setdebuglevel(named_g_lctx, named_g_debuglevel);
+	isc_log_setdebuglevel(named_g_debuglevel);
 }

 void
@@ -154,9 +117,9 @@ named_log_setsafechannels(isc_logconfig_t *lcfg) {
 		 * Setting the debug level to zero should get the output
 		 * discarded a bit faster.
 		 */
-		isc_log_setdebuglevel(named_g_lctx, 0);
+		isc_log_setdebuglevel(0);
 	} else {
-		isc_log_setdebuglevel(named_g_lctx, named_g_debuglevel);
+		isc_log_setdebuglevel(named_g_debuglevel);
 	}

 	if (named_g_logfile != NULL) {
@@ -199,7 +162,6 @@ named_log_setdefaultsslkeylogfile(isc_logconfig_t *lcfg) {
 			.maximum_size = 100 * 1024 * 1024,
 		},
 	};
-	isc_result_t result;

 	if (sslkeylogfile_path == NULL ||
 	    strcmp(sslkeylogfile_path, "config") == 0)
@@ -207,11 +169,10 @@ named_log_setdefaultsslkeylogfile(isc_logconfig_t *lcfg) {
 		return;
 	}

-	isc_log_createchannel(lcfg, "default_sslkeylogfile", ISC_LOG_TOFILE,
-			      ISC_LOG_INFO, &destination, 0);
-	result = isc_log_usechannel(lcfg, "default_sslkeylogfile",
-				    ISC_LOGCATEGORY_SSLKEYLOG, NULL);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+	isc_log_createandusechannel(lcfg, "default_sslkeylogfile",
+				    ISC_LOG_TOFILE, ISC_LOG_INFO, &destination,
+				    0, ISC_LOGCATEGORY_SSLKEYLOG,
+				    ISC_LOGMODULE_DEFAULT);
 }

 isc_result_t
@@ -219,7 +180,8 @@ named_log_setdefaultcategory(isc_logconfig_t *lcfg) {
 	isc_result_t result = ISC_R_SUCCESS;

 	result = isc_log_usechannel(lcfg, "default_debug",
-				    ISC_LOGCATEGORY_DEFAULT, NULL);
+				    ISC_LOGCATEGORY_DEFAULT,
+				    ISC_LOGMODULE_DEFAULT);
 	if (result != ISC_R_SUCCESS) {
 		goto cleanup;
 	}
@@ -228,11 +190,11 @@ named_log_setdefaultcategory(isc_logconfig_t *lcfg) {
 		if (named_g_logfile != NULL) {
 			result = isc_log_usechannel(lcfg, "default_logfile",
 						    ISC_LOGCATEGORY_DEFAULT,
-						    NULL);
+						    ISC_LOGMODULE_DEFAULT);
 		} else if (!named_g_nosyslog) {
 			result = isc_log_usechannel(lcfg, "default_syslog",
 						    ISC_LOGCATEGORY_DEFAULT,
-						    NULL);
+						    ISC_LOGMODULE_DEFAULT);
 		}
 	}

@@ -245,13 +207,6 @@ named_log_setunmatchedcategory(isc_logconfig_t *lcfg) {
 	isc_result_t result;

 	result = isc_log_usechannel(lcfg, "null", NAMED_LOGCATEGORY_UNMATCHED,
-				    NULL);
+				    ISC_LOGMODULE_DEFAULT);
 	return (result);
 }
-
-void
-named_log_shutdown(void) {
-	isc_log_destroy(&named_g_lctx);
-	isc_log_setcontext(NULL);
-	dns_log_setcontext(NULL);
-}
@@ -24,7 +24,6 @@
 #include <isc/util.h>

 #include <isccfg/cfg.h>
-#include <isccfg/log.h>

 #include <named/log.h>
 #include <named/logconf.h>
@@ -44,15 +43,14 @@ static isc_result_t
 category_fromconf(const cfg_obj_t *ccat, isc_logconfig_t *logconfig) {
 	isc_result_t result;
 	const char *catname;
-	isc_logcategory_t *category;
-	isc_logmodule_t *module;
+	isc_logcategory_t category;
 	const cfg_obj_t *destinations = NULL;
 	const cfg_listelt_t *element = NULL;

 	catname = cfg_obj_asstring(cfg_tuple_get(ccat, "name"));
-	category = isc_log_categorybyname(named_g_lctx, catname);
-	if (category == NULL) {
-		cfg_obj_log(ccat, named_g_lctx, ISC_LOG_ERROR,
+	category = isc_log_categorybyname(catname);
+	if (category == ISC_LOGCATEGORY_INVALID) {
+		cfg_obj_log(ccat, ISC_LOG_ERROR,
 			    "unknown logging category '%s' ignored", catname);
 		/*
 		 * Allow further processing by returning success.
@@ -64,8 +62,6 @@ category_fromconf(const cfg_obj_t *ccat, isc_logconfig_t *logconfig) {
 		return (ISC_R_SUCCESS);
 	}

-	module = NULL;
-
 	destinations = cfg_tuple_get(ccat, "destinations");
 	for (element = cfg_list_first(destinations); element != NULL;
 	     element = cfg_list_next(element))
@@ -74,9 +70,9 @@ category_fromconf(const cfg_obj_t *ccat, isc_logconfig_t *logconfig) {
 		const char *channelname = cfg_obj_asstring(channel);

 		result = isc_log_usechannel(logconfig, channelname, category,
-					    module);
+					    ISC_LOGMODULE_DEFAULT);
 		if (result != ISC_R_SUCCESS) {
-			isc_log_write(named_g_lctx, CFG_LOGCATEGORY_CONFIG,
+			isc_log_write(CFG_LOGCATEGORY_CONFIG,
 				      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 				      "logging channel '%s': %s", channelname,
 				      isc_result_totext(result));
@@ -127,7 +123,7 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *logconfig) {
 	}

 	if (i != 1) {
-		cfg_obj_log(channel, named_g_lctx, ISC_LOG_ERROR,
+		cfg_obj_log(channel, ISC_LOG_ERROR,
 			    "channel '%s': exactly one of file, syslog, "
 			    "null, and stderr must be present",
 			    channelname);
@@ -88,7 +88,7 @@
 #include <openssl/crypto.h>
 #include <openssl/evp.h>
 #include <openssl/opensslv.h>
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
 #include <openssl/err.h>
 #include <openssl/provider.h>
 #endif
@@ -152,7 +152,7 @@ static bool transferstuck = false;
 static bool disable6 = false;
 static bool disable4 = false;

-#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
 static OSSL_PROVIDER *fips = NULL, *base = NULL;
 #endif

@@ -161,10 +161,9 @@ named_main_earlywarning(const char *format, ...) {
 	va_list args;

 	va_start(args, format);
-	if (named_g_lctx != NULL) {
-		isc_log_vwrite(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			       NAMED_LOGMODULE_MAIN, ISC_LOG_WARNING, format,
-			       args);
+	if (named_g_logging) {
+		isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			       ISC_LOG_WARNING, format, args);
 	} else {
 		fprintf(stderr, "%s: ", program_name);
 		vfprintf(stderr, format, args);
@@ -179,12 +178,11 @@ named_main_earlyfatal(const char *format, ...) {
 	va_list args;

 	va_start(args, format);
-	if (named_g_lctx != NULL) {
-		isc_log_vwrite(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			       NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL, format,
-			       args);
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL,
+	if (named_g_logging) {
+		isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			       ISC_LOG_CRITICAL, format, args);
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			      ISC_LOG_CRITICAL,
 			      "exiting (due to early fatal error)");
 	} else {
 		fprintf(stderr, "%s: ", program_name);
@@ -197,7 +195,7 @@ named_main_earlyfatal(const char *format, ...) {
 	_exit(EXIT_FAILURE);
 }

-noreturn static void
+ISC_NORETURN static void
 assertion_failed(const char *file, int line, isc_assertiontype_t type,
 		 const char *cond);

@@ -208,21 +206,20 @@ assertion_failed(const char *file, int line, isc_assertiontype_t type,
 	 * Handle assertion failures.
 	 */

-	if (named_g_lctx != NULL) {
+	if (named_g_logging) {
 		/*
 		 * Reset the assertion callback in case it is the log
 		 * routines causing the assertion.
 		 */
 		isc_assertion_setcallback(NULL);

-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL,
-			      "%s:%d: %s(%s) failed", file, line,
-			      isc_assertion_typetotext(type), cond);
-		isc_backtrace_log(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			      ISC_LOG_CRITICAL, "%s:%d: %s(%s) failed", file,
+			      line, isc_assertion_typetotext(type), cond);
+		isc_backtrace_log(NAMED_LOGCATEGORY_GENERAL,
 				  NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL);
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL,
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			      ISC_LOG_CRITICAL,
 			      "exiting (due to assertion failure)");
 	} else {
 		fprintf(stderr, "%s:%d: %s(%s) failed\n", file, line,
@@ -236,7 +233,7 @@ assertion_failed(const char *file, int line, isc_assertiontype_t type,
 	_exit(EXIT_FAILURE);
 }

-noreturn static void
+ISC_NORETURN static void
 library_fatal_error(const char *file, int line, const char *func,
 		    const char *format, va_list args) ISC_FORMAT_PRINTF(3, 0);

@@ -247,21 +244,20 @@ library_fatal_error(const char *file, int line, const char *func,
 	 * Handle isc_error_fatal() calls from our libraries.
 	 */

-	if (named_g_lctx != NULL) {
+	if (named_g_logging) {
 		/*
 		 * Reset the error callback in case it is the log
 		 * routines causing the assertion.
 		 */
 		isc_error_setfatal(NULL);

-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL,
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			      ISC_LOG_CRITICAL,
 			      "%s:%d:%s(): fatal error: ", file, line, func);
-		isc_log_vwrite(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			       NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL, format,
-			       args);
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL,
+		isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			       ISC_LOG_CRITICAL, format, args);
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			      ISC_LOG_CRITICAL,
 			      "exiting (due to fatal error in library)");
 	} else {
 		fprintf(stderr, "%s:%d:%s(): fatal error: ", file, line, func);
@@ -288,14 +284,13 @@ library_unexpected_error(const char *file, int line, const char *func,
 	 * Handle isc_error_unexpected() calls from our libraries.
 	 */

-	if (named_g_lctx != NULL) {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_MAIN, ISC_LOG_ERROR,
+	if (named_g_logging) {
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			      ISC_LOG_ERROR,
 			      "%s:%d:%s(): unexpected error: ", file, line,
 			      func);
-		isc_log_vwrite(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			       NAMED_LOGMODULE_MAIN, ISC_LOG_ERROR, format,
-			       args);
+		isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			       ISC_LOG_ERROR, format, args);
 	} else {
 		fprintf(stderr, "%s:%d:%s(): fatal error: ", file, line, func);
 		vfprintf(stderr, format, args);
@@ -307,7 +302,7 @@ library_unexpected_error(const char *file, int line, const char *func,
 static void
 usage(void) {
 	fprintf(stderr, "usage: named [-4|-6] [-c conffile] [-d debuglevel] "
-			"[-D comment] [-E engine]\n"
+			"[-D comment]\n"
 			"             [-f|-g] [-L logfile] [-n number_of_cpus] "
 			"[-p port] [-s]\n"
 			"             [-S sockets] [-t chrootdir] [-u "
@@ -510,9 +505,8 @@ list_hmac_algorithms(isc_buffer_t *b) {

 static void
 logit(isc_buffer_t *b) {
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE, "%.*s",
-		      (int)isc_buffer_usedlength(b),
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "%.*s", (int)isc_buffer_usedlength(b),
 		      (char *)isc_buffer_base(b));
 }

@@ -556,8 +550,6 @@ format_supported_algorithms(void (*emit)(isc_buffer_t *b)) {
 static void
 printversion(bool verbose) {
 	char rndcconf[PATH_MAX], *dot = NULL;
-	isc_mem_t *mctx = NULL;
-	isc_result_t result;
 	isc_buffer_t b;
 	char buf[512];
 #if defined(HAVE_GEOIP2)
@@ -590,16 +582,8 @@ printversion(bool verbose) {
 	printf("compiled by Solaris Studio %x\n", __SUNPRO_C);
 #endif /* ifdef __SUNPRO_C */
 	printf("compiled with OpenSSL version: %s\n", OPENSSL_VERSION_TEXT);
-#if !defined(LIBRESSL_VERSION_NUMBER) && \
-	OPENSSL_VERSION_NUMBER >= 0x10100000L /* 1.1.0 or higher */
 	printf("linked to OpenSSL version: %s\n",
 	       OpenSSL_version(OPENSSL_VERSION));
-
-#else  /* if !defined(LIBRESSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER >= \
-	* 0x10100000L */
-	printf("linked to OpenSSL version: %s\n",
-	       SSLeay_version(SSLEAY_VERSION));
-#endif /* OPENSSL_VERSION_NUMBER >= 0x10100000L */
 	printf("compiled with libuv version: %d.%d.%d\n", UV_VERSION_MAJOR,
 	       UV_VERSION_MINOR, UV_VERSION_PATCH);
 	printf("linked to libuv version: %s\n", uv_version_string());
@@ -639,17 +623,9 @@ printversion(bool verbose) {
 #endif /* if defined(HAVE_DNSTAP) */
 	printf("threads support is enabled\n");

-	isc_mem_create(&mctx);
-	result = dst_lib_init(mctx, named_g_engine);
-	if (result == ISC_R_SUCCESS) {
-		isc_buffer_init(&b, buf, sizeof(buf));
-		format_supported_algorithms(printit);
-		printf("\n");
-		dst_lib_destroy();
-	} else {
-		printf("DST initialization failure: %s\n",
-		       isc_result_totext(result));
-	}
+	isc_buffer_init(&b, buf, sizeof(buf));
+	format_supported_algorithms(printit);
+	printf("\n");

 	/*
 	 * The default rndc.conf and rndc.key paths are in the same
@@ -673,7 +649,9 @@ printversion(bool verbose) {
 	printf("  named PID file:       %s\n", named_g_defaultpidfile);
 #if defined(HAVE_GEOIP2)
 #define RTC(x) RUNTIME_CHECK((x) == ISC_R_SUCCESS)
-	RTC(cfg_parser_create(mctx, named_g_lctx, &parser));
+	isc_mem_t *mctx = NULL;
+	isc_mem_create(&mctx);
+	RTC(cfg_parser_create(mctx, &parser));
 	RTC(named_config_parsedefaults(parser, &config));
 	RTC(cfg_map_get(config, "options", &defaults));
 	RTC(cfg_map_get(defaults, "geoip-directory", &obj));
@@ -902,7 +880,8 @@ parse_command_line(int argc, char *argv[]) {
 			/* Descriptive comment for 'ps'. */
 			break;
 		case 'E':
-			named_g_engine = isc_commandline_argument;
+			named_main_earlyfatal(
+				"%s", isc_result_totext(DST_R_NOENGINE));
 			break;
 		case 'f':
 			named_g_foreground = true;
@@ -968,7 +947,7 @@ parse_command_line(int argc, char *argv[]) {
 			named_main_earlyfatal("option '-X' has been removed");
 			break;
 		case 'F':
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
 			fips = OSSL_PROVIDER_load(NULL, "fips");
 			if (fips == NULL) {
 				ERR_clear_error();
@@ -1032,11 +1011,11 @@ create_managers(void) {
 		named_g_cpus = named_g_cpus_detected;
 	}

-	isc_log_write(
-		named_g_lctx, NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-		ISC_LOG_INFO, "found %u CPU%s, using %u worker thread%s",
-		named_g_cpus_detected, named_g_cpus_detected == 1 ? "" : "s",
-		named_g_cpus, named_g_cpus == 1 ? "" : "s");
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+		      ISC_LOG_INFO, "found %u CPU%s, using %u worker thread%s",
+		      named_g_cpus_detected,
+		      named_g_cpus_detected == 1 ? "" : "s", named_g_cpus,
+		      named_g_cpus == 1 ? "" : "s");

 	isc_managers_create(&named_g_mctx, named_g_cpus, &named_g_loopmgr,
 			    &named_g_netmgr);
@@ -1116,150 +1095,129 @@ setup(void) {
 		named_os_daemonize();
 	}

-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "starting %s%s <id:%s>", PACKAGE_STRING,
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "starting %s%s <id:%s>", PACKAGE_STRING,
 		      PACKAGE_DESCRIPTION, PACKAGE_SRCID);

-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE, "running on %s",
-		      named_os_uname());
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "running on %s", named_os_uname());

-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE, "built with %s",
-		      PACKAGE_CONFIGARGS);
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "built with %s", PACKAGE_CONFIGARGS);

-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "running as: %s%s%s", program_name, saved_command_line,
-		      ellipsis);
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "running as: %s%s%s", program_name,
+		      saved_command_line, ellipsis);
 #ifdef __clang__
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "compiled by CLANG %s", __VERSION__);
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "compiled by CLANG %s", __VERSION__);
 #else /* ifdef __clang__ */
 #if defined(__ICC) || defined(__INTEL_COMPILER)
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "compiled by ICC %s", __VERSION__);
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "compiled by ICC %s", __VERSION__);
 #else /* if defined(__ICC) || defined(__INTEL_COMPILER) */
 #ifdef __GNUC__
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "compiled by GCC %s", __VERSION__);
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "compiled by GCC %s", __VERSION__);
 #endif /* ifdef __GNUC__ */
 #endif /* if defined(__ICC) || defined(__INTEL_COMPILER) */
 #endif /* ifdef __clang__ */
 #ifdef __SUNPRO_C
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "compiled by Solaris Studio %x", __SUNPRO_C);
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "compiled by Solaris Studio %x",
+		      __SUNPRO_C);
 #endif /* ifdef __SUNPRO_C */
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "compiled with OpenSSL version: %s",
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "compiled with OpenSSL version: %s",
 		      OPENSSL_VERSION_TEXT);
-#if !defined(LIBRESSL_VERSION_NUMBER) && \
-	OPENSSL_VERSION_NUMBER >= 0x10100000L /* 1.1.0 or higher */
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "linked to OpenSSL version: %s",
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "linked to OpenSSL version: %s",
 		      OpenSSL_version(OPENSSL_VERSION));
-#else  /* if !defined(LIBRESSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER >= \
-	* 0x10100000L */
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "linked to OpenSSL version: %s",
-		      SSLeay_version(SSLEAY_VERSION));
-#endif /* OPENSSL_VERSION_NUMBER >= 0x10100000L */
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "compiled with libuv version: %d.%d.%d", UV_VERSION_MAJOR,
-		      UV_VERSION_MINOR, UV_VERSION_PATCH);
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "linked to libuv version: %s", uv_version_string());
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "compiled with %s version: %s", RCU_FLAVOR, RCU_VERSION);
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "compiled with libuv version: %d.%d.%d",
+		      UV_VERSION_MAJOR, UV_VERSION_MINOR, UV_VERSION_PATCH);
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "linked to libuv version: %s",
+		      uv_version_string());
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "compiled with %s version: %s",
+		      RCU_FLAVOR, RCU_VERSION);
 #if defined(JEMALLOC_VERSION)
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE,
 		      "compiled with jemalloc version: %u.%u.%u",
 		      JEMALLOC_VERSION_MAJOR, JEMALLOC_VERSION_MINOR,
 		      JEMALLOC_VERSION_BUGFIX);
 #elif defined(M_VERSION)
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE,
 		      "compiled with system jemalloc version: %u", M_VERSION);
 #endif
 #if HAVE_LIBNGHTTP2
 	nghttp2_info *nginfo = NULL;
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "compiled with libnghttp2 version: %s", NGHTTP2_VERSION);
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "compiled with libnghttp2 version: %s",
+		      NGHTTP2_VERSION);
 	nginfo = nghttp2_version(1);
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "linked to libnghttp2 version: %s", nginfo->version_str);
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "linked to libnghttp2 version: %s",
+		      nginfo->version_str);
 #endif
 #ifdef HAVE_LIBXML2
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "compiled with libxml2 version: %s",
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "compiled with libxml2 version: %s",
 		      LIBXML_DOTTED_VERSION);
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "linked to libxml2 version: %s", xmlParserVersion);
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "linked to libxml2 version: %s",
+		      xmlParserVersion);
 #endif /* ifdef HAVE_LIBXML2 */
 #if defined(HAVE_JSON_C)
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "compiled with json-c version: %s", JSON_C_VERSION);
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "linked to json-c version: %s", json_c_version());
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "compiled with json-c version: %s",
+		      JSON_C_VERSION);
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "linked to json-c version: %s",
+		      json_c_version());
 #endif /* if defined(HAVE_JSON_C) */
 #if defined(HAVE_ZLIB) && defined(ZLIB_VERSION)
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "compiled with zlib version: %s", ZLIB_VERSION);
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "linked to zlib version: %s", zlibVersion());
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "compiled with zlib version: %s",
+		      ZLIB_VERSION);
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "linked to zlib version: %s",
+		      zlibVersion());
 #endif /* if defined(HAVE_ZLIB) && defined(ZLIB_VERSION) */
 #if defined(HAVE_GEOIP2)
 	/* Unfortunately, no version define on link time */
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "linked to maxminddb version: %s", MMDB_lib_version());
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "linked to maxminddb version: %s",
+		      MMDB_lib_version());
 #endif /* if defined(HAVE_GEOIP2) */
 #if defined(HAVE_DNSTAP)
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "compiled with protobuf-c version: %s",
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "compiled with protobuf-c version: %s",
 		      PROTOBUF_C_VERSION);
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "linked to protobuf-c version: %s", protobuf_c_version());
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "linked to protobuf-c version: %s",
+		      protobuf_c_version());
 #endif /* if defined(HAVE_DNSTAP) */
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE,
 		      "----------------------------------------------------");
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE,
 		      "BIND 9 is maintained by Internet Systems Consortium,");
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE,
 		      "Inc. (ISC), a non-profit 501(c)(3) public-benefit ");
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE,
 		      "corporation.  Support and training for BIND 9 are ");
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE,
 		      "available at https://www.isc.org/support");
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE,
 		      "----------------------------------------------------");

 	/*
@@ -1316,10 +1274,6 @@ setup(void) {
 	ENSURE(named_g_server != NULL);
 	sctx = named_g_server->sctx;

-	/*
-	 * Report supported algorithms now that dst_lib_init() has
-	 * been called via named_server_create().
-	 */
 	format_supported_algorithms(logit);

 	/*
@@ -1395,9 +1349,8 @@ cleanup(void) {
 	 */
 	dlz_dlopen_clear();

-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE, "exiting");
-	named_log_shutdown();
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "exiting");
 }

 static char *memstats = NULL;
@@ -1623,7 +1576,7 @@ main(int argc, char *argv[]) {

 	named_os_shutdown();

-#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
 	if (base != NULL) {
 		OSSL_PROVIDER_unload(base);
 	}
@@ -21,7 +21,7 @@ named - Internet domain name server
 Synopsis
 ~~~~~~~~

-:program:`named` [ [**-4**] | [**-6**] ] [**-c** config-file] [**-C**] [**-d** debug-level] [**-D** string] [**-E** engine-name] [**-f**] [**-g**] [**-L** logfile] [**-M** option] [**-m** flag] [**-n** #cpus] [**-p** port] [**-s**] [**-t** directory] [**-u** user] [**-v**] [**-V**] ]
+:program:`named` [ [**-4**] | [**-6**] ] [**-c** config-file] [**-C**] [**-d** debug-level] [**-D** string] [**-f**] [**-g**] [**-L** logfile] [**-M** option] [**-m** flag] [**-n** #cpus] [**-p** port] [**-s**] [**-t** directory] [**-u** user] [**-v**] [**-V**] ]

 Description
 ~~~~~~~~~~~
@@ -73,15 +73,6 @@ Options
   This option specifies a string that is used to identify a instance of :program:`named`
   in a process listing. The contents of ``string`` are not examined.

-.. option:: -E engine-name
-
-   When applicable, this option specifies the hardware to use for cryptographic
-   operations, such as a secure key store used for signing.
-
-   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
-   engine identifier that drives the cryptographic accelerator or
-   hardware service module (usually ``pkcs11``).
-
 .. option:: -f

   This option runs the server in the foreground (i.e., do not daemonize).
@@ -61,6 +61,9 @@ static struct passwd *runas_pw = NULL;
 static bool done_setuid = false;
 static int dfd[2] = { -1, -1 };

+static uid_t saved_uid = (uid_t)-1;
+static gid_t saved_gid = (gid_t)-1;
+
 #if HAVE_LIBCAP

 static bool non_root = false;
@@ -249,115 +252,6 @@ linux_keepcaps(void) {

 #endif /* HAVE_LIBCAP */

-/*
- * First define compatibility shims if {set,get}res{uid,gid} are not available
- */
-
-#if !HAVE_GETRESGID
-static int
-getresgid(gid_t *rgid, gid_t *egid, gid_t *sgid) {
-	*rgid = -1;
-	*egid = getegid();
-	*sgid = -1;
-
-	return (0);
-}
-#endif /* !HAVE_GETRESGID */
-
-#if !HAVE_SETRESGID
-static int
-setresgid(gid_t rgid, gid_t egid, gid_t sgid) {
-	REQUIRE(rgid == (gid_t)-1);
-	REQUIRE(sgid == (gid_t)-1);
-
-#if HAVE_SETREGID
-	return (setregid(rgid, egid));
-#else  /* HAVE_SETREGID */
-	return (setegid(egid));
-#endif /* HAVE_SETREGID */
-}
-#endif /* !HAVE_SETRESGID */
-
-#if !HAVE_GETRESUID
-static int
-getresuid(uid_t *ruid, uid_t *euid, uid_t *suid) {
-	*ruid = -1;
-	*euid = geteuid();
-	*suid = -1;
-
-	return (0);
-}
-#endif /* !HAVE_GETRESUID */
-
-#if !HAVE_SETRESUID
-static int
-setresuid(uid_t ruid, uid_t euid, uid_t suid) {
-	REQUIRE(ruid == (uid_t)-1);
-	REQUIRE(suid == (uid_t)-1);
-
-#if HAVE_SETREGID
-	return (setregid(ruid, euid));
-#else  /* HAVE_SETREGID */
-	return (setegid(euid));
-#endif /* HAVE_SETREGID */
-}
-#endif /* !HAVE_SETRESUID */
-
-static int
-set_effective_gid(gid_t gid) {
-	gid_t oldgid;
-
-	if (getresgid(&(gid_t){ 0 }, &oldgid, &(gid_t){ 0 }) == -1) {
-		return (-1);
-	}
-
-	if (oldgid == gid) {
-		return (0);
-	}
-
-	if (setresgid(-1, gid, -1) == -1) {
-		return (-1);
-	}
-
-	if (getresgid(&(gid_t){ 0 }, &oldgid, &(gid_t){ 0 }) == -1) {
-		return (-1);
-	}
-
-	if (oldgid != gid) {
-		return (-1);
-	}
-
-	return (0);
-}
-
-static int
-set_effective_uid(uid_t uid) {
-	uid_t olduid;
-
-	if (getresuid(&(uid_t){ 0 }, &olduid, &(uid_t){ 0 }) == -1) {
-		return (-1);
-	}
-
-	if (olduid == uid) {
-		return (0);
-	}
-
-	if (setresuid(-1, uid, -1) == -1) {
-		return (-1);
-	}
-
-	if (getresuid(&(uid_t){ 0 }, &olduid, &(uid_t){ 0 }) == -1) {
-		return (-1);
-	}
-
-	if (olduid != uid) {
-		return (-1);
-	}
-
-	/* Success */
-	return (0);
-}
-
 static void
 setperms(uid_t uid, gid_t gid) {
 	char strbuf[ISC_STRERRORSIZE];
@@ -366,13 +260,13 @@ setperms(uid_t uid, gid_t gid) {
 	 * Drop the gid privilege first, because in some cases the gid privilege
 	 * cannot be dropped after the uid privilege has been dropped.
 	 */
-	if (set_effective_gid(gid) == -1) {
+	if (setegid(gid) == -1) {
 		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlywarning("unable to set effective gid to %d: %s",
 					gid, strbuf);
 	}

-	if (set_effective_uid(uid) == -1) {
+	if (seteuid(uid) == -1) {
 		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlywarning("unable to set effective uid to %d: %s",
 					uid, strbuf);
@@ -570,20 +464,41 @@ named_os_inituserinfo(const char *username) {
 }

 void
-named_os_changeuser(void) {
+named_os_restoreuser(void) {
+	if (runas_pw == NULL || done_setuid) {
+		return;
+	}
+
+	REQUIRE(saved_uid != (uid_t)-1);
+	REQUIRE(saved_gid != (gid_t)-1);
+
+	setperms(saved_uid, saved_gid);
+}
+
+void
+named_os_changeuser(bool permanent) {
 	char strbuf[ISC_STRERRORSIZE];
 	if (runas_pw == NULL || done_setuid) {
 		return;
 	}

+	if (!permanent) {
+		saved_uid = getuid();
+		saved_gid = getgid();
+
+		setperms(runas_pw->pw_uid, runas_pw->pw_gid);
+
+		return;
+	}
+
 	done_setuid = true;

-	if (setgid(runas_pw->pw_gid) < 0) {
+	if (setgid(runas_pw->pw_gid) == -1) {
 		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlyfatal("setgid(): %s", strbuf);
 	}

-	if (setuid(runas_pw->pw_uid) < 0) {
+	if (setuid(runas_pw->pw_uid) == -1) {
 		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlyfatal("setuid(): %s", strbuf);
 	}
@@ -604,7 +519,7 @@ named_os_changeuser(void) {
 }

 uid_t
-ns_os_uid(void) {
+named_os_uid(void) {
 	if (runas_pw == NULL) {
 		return (0);
 	}
@@ -626,8 +541,8 @@ named_os_adjustnofile(void) {
 	rlim_old = rl.rlim_cur;

 	if (rl.rlim_cur == rl.rlim_max) {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			      ISC_LOG_NOTICE,
 			      "the limit on open files is already at the "
 			      "maximum allowed value: "
 			      "%" PRIu64,
@@ -641,8 +556,8 @@ named_os_adjustnofile(void) {
 		goto fail;
 	}

-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE,
 		      "adjusted limit on open files from "
 		      "%" PRIu64 " to "
 		      "%" PRIu64,
@@ -660,7 +575,7 @@ void
 named_os_minprivs(void) {
 #if HAVE_LIBCAP
 	linux_keepcaps();
-	named_os_changeuser();
+	named_os_changeuser(true);
 	linux_minprivs();
 #endif /* HAVE_LIBCAP */
 }
@@ -787,19 +702,16 @@ named_os_openfile(const char *filename, mode_t mode, bool switch_user) {
 	free(f);

 	if (switch_user && runas_pw != NULL) {
-		uid_t olduid = getuid();
-		gid_t oldgid = getgid();
-
 		/*
-		 * Set UID/GID to the one we'll be running with
+		 * Temporarily set UID/GID to the one we'll be running with
 		 * eventually.
 		 */
-		setperms(runas_pw->pw_uid, runas_pw->pw_gid);
+		named_os_changeuser(false);

 		fd = safe_open(filename, mode, false);

 		/* Restore UID/GID to previous uid/gid */
-		setperms(olduid, oldgid);
+		named_os_restoreuser();

 		if (fd == -1) {
 			fd = safe_open(filename, mode, false);
@@ -472,6 +472,8 @@ init_desc(void) {
 			"ClientQuota");
 	SET_RESSTATDESC(nextitem, "waited for next item", "NextItem");
 	SET_RESSTATDESC(priming, "priming queries", "Priming");
+	SET_RESSTATDESC(forwardonlyfail, "all forwarders failed",
+			"ForwardOnlyFail");

 	INSIST(i == dns_resstatscounter_max);

@@ -936,9 +938,8 @@ dump_counters(isc_statsformat_t type, void *arg, const char *category,
 	return (ISC_R_SUCCESS);
 #ifdef HAVE_LIBXML2
 cleanup:
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
-		      "failed at dump_counters()");
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+		      ISC_LOG_ERROR, "failed at dump_counters()");
 	return (ISC_R_FAILURE);
 #endif /* ifdef HAVE_LIBXML2 */
 }
@@ -999,9 +1000,8 @@ rdtypestat_dump(dns_rdatastatstype_t type, uint64_t val, void *arg) {
 	return;
 #ifdef HAVE_LIBXML2
 cleanup:
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
-		      "failed at rdtypestat_dump()");
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+		      ISC_LOG_ERROR, "failed at rdtypestat_dump()");
 	dumparg->result = ISC_R_FAILURE;
 	return;
 #endif /* ifdef HAVE_LIBXML2 */
@@ -1088,9 +1088,8 @@ rdatasetstats_dump(dns_rdatastatstype_t type, uint64_t val, void *arg) {
 	return;
 #ifdef HAVE_LIBXML2
 cleanup:
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
-		      "failed at rdatasetstats_dump()");
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+		      ISC_LOG_ERROR, "failed at rdatasetstats_dump()");
 	dumparg->result = ISC_R_FAILURE;
 #endif /* ifdef HAVE_LIBXML2 */
 }
@@ -1143,9 +1142,8 @@ opcodestat_dump(dns_opcode_t code, uint64_t val, void *arg) {

 #ifdef HAVE_LIBXML2
 cleanup:
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
-		      "failed at opcodestat_dump()");
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+		      ISC_LOG_ERROR, "failed at opcodestat_dump()");
 	dumparg->result = ISC_R_FAILURE;
 	return;
 #endif /* ifdef HAVE_LIBXML2 */
@@ -1199,9 +1197,8 @@ rcodestat_dump(dns_rcode_t code, uint64_t val, void *arg) {

 #ifdef HAVE_LIBXML2
 cleanup:
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
-		      "failed at rcodestat_dump()");
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+		      ISC_LOG_ERROR, "failed at rcodestat_dump()");
 	dumparg->result = ISC_R_FAILURE;
 	return;
 #endif /* ifdef HAVE_LIBXML2 */
@@ -1256,9 +1253,8 @@ dnssecsignstat_dump(uint32_t kval, uint64_t val, void *arg) {
 	return;
 #ifdef HAVE_LIBXML2
 cleanup:
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
-		      "failed at dnssecsignstat_dump()");
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+		      ISC_LOG_ERROR, "failed at dnssecsignstat_dump()");
 	dumparg->result = ISC_R_FAILURE;
 	return;
 #endif /* ifdef HAVE_LIBXML2 */
@@ -1452,9 +1448,8 @@ zone_xmlrender(dns_zone_t *zone, void *arg) {

 	return (ISC_R_SUCCESS);
 cleanup:
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
-		      "Failed at zone_xmlrender()");
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+		      ISC_LOG_ERROR, "Failed at zone_xmlrender()");
 	return (ISC_R_FAILURE);
 }

@@ -1725,9 +1720,8 @@ cleanup:
 		dns_xfrin_detach(&xfr);
 	}

-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
-		      "Failed at xfrin_xmlrender()");
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+		      ISC_LOG_ERROR, "Failed at xfrin_xmlrender()");

 	return (ISC_R_FAILURE);
 }
@@ -2134,9 +2128,8 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
 	return (ISC_R_SUCCESS);

 cleanup:
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
-		      "failed generating XML response");
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+		      ISC_LOG_ERROR, "failed generating XML response");
 	if (writer != NULL) {
 		xmlFreeTextWriter(writer);
 	}
@@ -2173,9 +2166,8 @@ render_xml(uint32_t flags, void *arg, unsigned int *retcode,
 		*freecb = wrap_xmlfree;
 		*freecb_args = NULL;
 	} else {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
-			      "failed at rendering XML()");
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+			      ISC_LOG_ERROR, "failed at rendering XML()");
 	}

 	return (result);
@@ -3376,9 +3368,8 @@ render_json(uint32_t flags, void *arg, unsigned int *retcode,
 		*freecb = wrap_jsonfree;
 		*freecb_args = bindstats;
 	} else {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
-			      "failed at rendering JSON()");
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+			      ISC_LOG_ERROR, "failed at rendering JSON()");
 	}

 	return (result);
@@ -3474,6 +3465,11 @@ render_json_traffic(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,

 #endif /* HAVE_JSON_C */

+#if HAVE_LIBXML2
+/*
+ * This is only needed if we have libxml2 and was confusingly returned if
+ * neither of libxml2 or json-c is configured.
+ */
 static isc_result_t
 render_xsl(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo, void *args,
 	   unsigned int *retcode, const char **retmsg, const char **mimetype,
@@ -3529,18 +3525,20 @@ send:
 end:
 	return (ISC_R_SUCCESS);
 }
+#endif

 static void
 shutdown_listener(named_statschannel_t *listener) {
 	char socktext[ISC_SOCKADDR_FORMATSIZE];
 	isc_sockaddr_format(&listener->address, socktext, sizeof(socktext));
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_SERVER, ISC_LOG_NOTICE,
-		      "stopping statistics channel on %s", socktext);
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+		      ISC_LOG_NOTICE, "stopping statistics channel on %s",
+		      socktext);

 	isc_httpdmgr_shutdown(&listener->httpdmgr);
 }

+#if defined(HAVE_LIBXML2) || defined(HAVE_JSON_C)
 static bool
 client_ok(const isc_sockaddr_t *fromaddr, void *arg) {
 	named_statschannel_t *listener = arg;
@@ -3565,13 +3563,15 @@ client_ok(const isc_sockaddr_t *fromaddr, void *arg) {
 	UNLOCK(&listener->lock);

 	isc_sockaddr_format(fromaddr, socktext, sizeof(socktext));
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
-		      "rejected statistics connection from %s", socktext);
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+		      ISC_LOG_WARNING, "rejected statistics connection from %s",
+		      socktext);

 	return (false);
 }
+#endif

+#if defined(HAVE_LIBXML2) || defined(HAVE_JSON_C)
 static void
 destroy_listener(void *arg) {
 	named_statschannel_t *listener = (named_statschannel_t *)arg;
@@ -3585,12 +3585,24 @@ destroy_listener(void *arg) {
 	isc_mutex_destroy(&listener->lock);
 	isc_mem_putanddetach(&listener->mctx, listener, sizeof(*listener));
 }
+#endif

 static isc_result_t
 add_listener(named_server_t *server, named_statschannel_t **listenerp,
 	     const cfg_obj_t *listen_params, const cfg_obj_t *config,
 	     isc_sockaddr_t *addr, cfg_aclconfctx_t *aclconfctx,
 	     const char *socktext) {
+#if !defined(HAVE_LIBXML2) && !defined(HAVE_JSON_C)
+	UNUSED(server);
+	UNUSED(listenerp);
+	UNUSED(listen_params);
+	UNUSED(config);
+	UNUSED(addr);
+	UNUSED(aclconfctx);
+	UNUSED(socktext);
+
+	return (ISC_R_NOTIMPLEMENTED);
+#else
 	isc_result_t result;
 	named_statschannel_t *listener = NULL;
 	const cfg_obj_t *allow = NULL;
@@ -3605,9 +3617,8 @@ add_listener(named_server_t *server, named_statschannel_t **listenerp,

 	allow = cfg_tuple_get(listen_params, "allow");
 	if (allow != NULL && cfg_obj_islist(allow)) {
-		result = cfg_acl_fromconfig(allow, config, named_g_lctx,
-					    aclconfctx, listener->mctx, 0,
-					    &new_acl);
+		result = cfg_acl_fromconfig(allow, config, aclconfctx,
+					    listener->mctx, 0, &new_acl);
 	} else {
 		result = dns_acl_any(listener->mctx, &new_acl);
 	}
@@ -3656,6 +3667,8 @@ add_listener(named_server_t *server, named_statschannel_t **listenerp,
 	isc_httpdmgr_addurl(listener->httpdmgr,
 			    "/xml/v" STATS_XML_VERSION_MAJOR "/traffic", false,
 			    render_xml_traffic, server);
+	isc_httpdmgr_addurl(listener->httpdmgr, "/bind9.xsl", true, render_xsl,
+			    server);
 #endif /* ifdef HAVE_LIBXML2 */
 #ifdef HAVE_JSON_C
 	isc_httpdmgr_addurl(listener->httpdmgr, "/json", false, render_json_all,
@@ -3685,13 +3698,11 @@ add_listener(named_server_t *server, named_statschannel_t **listenerp,
 			    "/json/v" STATS_JSON_VERSION_MAJOR "/traffic",
 			    false, render_json_traffic, server);
 #endif /* ifdef HAVE_JSON_C */
-	isc_httpdmgr_addurl(listener->httpdmgr, "/bind9.xsl", true, render_xsl,
-			    server);

 	*listenerp = listener;
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_SERVER, ISC_LOG_NOTICE,
-		      "statistics channel listening on %s", socktext);
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+		      ISC_LOG_NOTICE, "statistics channel listening on %s",
+		      socktext);

 	return (ISC_R_SUCCESS);

@@ -3703,6 +3714,7 @@ cleanup:
 	isc_mem_putanddetach(&listener->mctx, listener, sizeof(*listener));

 	return (result);
+#endif
 }

 static void
@@ -3733,9 +3745,8 @@ update_listener(named_server_t *server, named_statschannel_t **listenerp,
 	 */
 	allow = cfg_tuple_get(listen_params, "allow");
 	if (allow != NULL && cfg_obj_islist(allow)) {
-		result = cfg_acl_fromconfig(allow, config, named_g_lctx,
-					    aclconfctx, listener->mctx, 0,
-					    &new_acl);
+		result = cfg_acl_fromconfig(allow, config, aclconfctx,
+					    listener->mctx, 0, &new_acl);
 	} else {
 		result = dns_acl_any(listener->mctx, &new_acl);
 	}
@@ -3749,7 +3760,7 @@ update_listener(named_server_t *server, named_statschannel_t **listenerp,

 		UNLOCK(&listener->lock);
 	} else {
-		cfg_obj_log(listen_params, named_g_lctx, ISC_LOG_WARNING,
+		cfg_obj_log(listen_params, ISC_LOG_WARNING,
 			    "couldn't install new acl for "
 			    "statistics channel %s: %s",
 			    socktext, isc_result_totext(result));
@@ -3786,20 +3797,20 @@ named_statschannels_configure(named_server_t *server, const cfg_obj_t *config,
 	 */
 	if (statschannellist != NULL) {
 #ifndef EXTENDED_STATS
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+			      ISC_LOG_WARNING,
 			      "statistics-channels specified but not effective "
 			      "due to missing XML and/or JSON library");
 #else /* EXTENDED_STATS */
 #ifndef HAVE_LIBXML2
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+			      ISC_LOG_WARNING,
 			      "statistics-channels: XML library missing, "
 			      "only JSON stats will be available");
 #endif /* !HAVE_LIBXML2 */
 #ifndef HAVE_JSON_C
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+			      ISC_LOG_WARNING,
 			      "statistics-channels: JSON library missing, "
 			      "only XML stats will be available");
 #endif /* !HAVE_JSON_C */
@@ -3838,8 +3849,7 @@ named_statschannels_configure(named_server_t *server, const cfg_obj_t *config,
 				isc_sockaddr_format(&addr, socktext,
 						    sizeof(socktext));

-				isc_log_write(named_g_lctx,
-					      NAMED_LOGCATEGORY_GENERAL,
+				isc_log_write(NAMED_LOGCATEGORY_GENERAL,
 					      NAMED_LOGMODULE_SERVER,
 					      ISC_LOG_DEBUG(9),
 					      "processing statistics "
@@ -3870,7 +3880,6 @@ named_statschannels_configure(named_server_t *server, const cfg_obj_t *config,
 					if (r != ISC_R_SUCCESS) {
 						cfg_obj_log(
 							listen_params,
-							named_g_lctx,
 							ISC_LOG_WARNING,
 							"couldn't allocate "
 							"statistics channel"
@@ -38,9 +38,9 @@
 	} while (0)

 #include <named/log.h>
-#define LOG(msg)                                               \
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL, \
-		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR, "%s", msg)
+#define LOG(msg)                                                         \
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER, \
+		      ISC_LOG_ERROR, "%s", msg)

 isc_result_t
 named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
@@ -133,8 +133,7 @@ add_doh_transports(const cfg_obj_t *transportlist, dns_transport_list_t *list) {

 	return (ISC_R_SUCCESS);
 failure:
-	cfg_obj_log(doh, named_g_lctx, ISC_LOG_ERROR,
-		    "configuring DoH '%s': %s", dohid,
+	cfg_obj_log(doh, ISC_LOG_ERROR, "configuring DoH '%s': %s", dohid,
 		    isc_result_totext(result));

 	return (result);
@@ -187,8 +186,7 @@ add_tls_transports(const cfg_obj_t *transportlist, dns_transport_list_t *list) {

 	return (ISC_R_SUCCESS);
 failure:
-	cfg_obj_log(tls, named_g_lctx, ISC_LOG_ERROR,
-		    "configuring tls '%s': %s", tlsid,
+	cfg_obj_log(tls, ISC_LOG_ERROR, "configuring tls '%s': %s", tlsid,
 		    isc_result_totext(result));

 	return (result);
@@ -85,7 +85,7 @@ add_initial_keys(const cfg_obj_t *list, dns_tsigkeyring_t *ring,
 		if (named_config_getkeyalgorithm(algstr, &alg, &bits) !=
 		    ISC_R_SUCCESS)
 		{
-			cfg_obj_log(algobj, named_g_lctx, ISC_LOG_ERROR,
+			cfg_obj_log(algobj, ISC_LOG_ERROR,
 				    "key '%s': has a "
 				    "unsupported algorithm '%s'",
 				    keyid, algstr);
@@ -129,8 +129,8 @@ failure:
 	if (secret != NULL) {
 		isc_mem_put(mctx, secret, secretalloc);
 	}
-	cfg_obj_log(key, named_g_lctx, ISC_LOG_ERROR,
-		    "configuring key '%s': %s", keyid, isc_result_totext(ret));
+	cfg_obj_log(key, ISC_LOG_ERROR, "configuring key '%s': %s", keyid,
+		    isc_result_totext(ret));
 	return (ret);
 }

@@ -16,6 +16,7 @@

 #include <isc/buffer.h>
 #include <isc/file.h>
+#include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
 #include <isc/stats.h>
@@ -28,7 +29,6 @@
 #include <dns/ipkeylist.h>
 #include <dns/journal.h>
 #include <dns/kasp.h>
-#include <dns/log.h>
 #include <dns/masterdump.h>
 #include <dns/name.h>
 #include <dns/nsec3.h>
@@ -175,8 +175,8 @@ configure_zone_acl(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
 	}

 parse_acl:
-	result = cfg_acl_fromconfig(aclobj, config, named_g_lctx, actx,
-				    named_g_mctx, 0, &acl);
+	result = cfg_acl_fromconfig(aclobj, config, actx, named_g_mctx, 0,
+				    &acl);
 	if (result != ISC_R_SUCCESS) {
 		return (result);
 	}
@@ -262,7 +262,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		result = dns_name_fromtext(dns_fixedname_name(&fident), &b,
 					   dns_rootname, 0, NULL);
 		if (result != ISC_R_SUCCESS) {
-			cfg_obj_log(identity, named_g_lctx, ISC_LOG_ERROR,
+			cfg_obj_log(identity, ISC_LOG_ERROR,
 				    "'%s' is not a valid name", str);
 			goto cleanup;
 		}
@@ -278,8 +278,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 			result = dns_name_fromtext(dns_fixedname_name(&fname),
 						   &b, dns_rootname, 0, NULL);
 			if (result != ISC_R_SUCCESS) {
-				cfg_obj_log(identity, named_g_lctx,
-					    ISC_LOG_ERROR,
+				cfg_obj_log(identity, ISC_LOG_ERROR,
 					    "'%s' is not a valid name", str);
 				goto cleanup;
 			}
@@ -315,8 +314,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 				if (max > 0xffff || end[0] != /*(*/ ')' ||
 				    end[1] != 0)
 				{
-					cfg_obj_log(identity, named_g_lctx,
-						    ISC_LOG_ERROR,
+					cfg_obj_log(identity, ISC_LOG_ERROR,
 						    "'%s' is not a valid count",
 						    bracket);
 					isc_mem_cput(mctx, types, n,
@@ -330,8 +328,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,

 			result = dns_rdatatype_fromtext(&types[i++].type, &r);
 			if (result != ISC_R_SUCCESS) {
-				cfg_obj_log(identity, named_g_lctx,
-					    ISC_LOG_ERROR,
+				cfg_obj_log(identity, ISC_LOG_ERROR,
 					    "'%.*s' is not a valid type",
 					    (int)r.length, str);
 				isc_mem_cput(mctx, types, n, sizeof(*types));
@@ -357,7 +354,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		dns_ssuruletype_t any = { dns_rdatatype_any, 0 };

 		if (named_g_server->session_keyname == NULL) {
-			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			isc_log_write(NAMED_LOGCATEGORY_GENERAL,
 				      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 				      "failed to enable auto DDNS policy "
 				      "for zone %s: session key not found",
@@ -415,14 +412,14 @@ configure_staticstub_serveraddrs(const cfg_obj_t *zconfig, dns_zone_t *zone,

 		sa = cfg_obj_assockaddr(address);
 		if (isc_sockaddr_getport(sa) != 0) {
-			cfg_obj_log(zconfig, named_g_lctx, ISC_LOG_ERROR,
+			cfg_obj_log(zconfig, ISC_LOG_ERROR,
 				    "port is not configurable for "
 				    "static stub server-addresses");
 			return (ISC_R_FAILURE);
 		}
 		isc_netaddr_fromsockaddr(&na, sa);
 		if (isc_netaddr_getzone(&na) != 0) {
-			cfg_obj_log(zconfig, named_g_lctx, ISC_LOG_ERROR,
+			cfg_obj_log(zconfig, ISC_LOG_ERROR,
 				    "scoped address is not allowed "
 				    "for static stub "
 				    "server-addresses");
@@ -508,14 +505,14 @@ configure_staticstub_servernames(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		isc_buffer_add(&b, strlen(str));
 		result = dns_name_fromtext(nsname, &b, dns_rootname, 0, NULL);
 		if (result != ISC_R_SUCCESS) {
-			cfg_obj_log(zconfig, named_g_lctx, ISC_LOG_ERROR,
+			cfg_obj_log(zconfig, ISC_LOG_ERROR,
 				    "server-name '%s' is not a valid "
 				    "name",
 				    str);
 			return (result);
 		}
 		if (dns_name_issubdomain(nsname, dns_zone_getorigin(zone))) {
-			cfg_obj_log(zconfig, named_g_lctx, ISC_LOG_ERROR,
+			cfg_obj_log(zconfig, ISC_LOG_ERROR,
 				    "server-name '%s' must not be a "
 				    "subdomain of zone name '%s'",
 				    str, zname);
@@ -602,8 +599,8 @@ configure_staticstub(const cfg_obj_t *zconfig, dns_zone_t *zone,
 	 * to trigger delegation.
 	 */
 	if (ISC_LIST_EMPTY(rdatalist_ns.rdata)) {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+			      ISC_LOG_ERROR,
 			      "No NS record is configured for a "
 			      "static-stub zone '%s'",
 			      zname);
@@ -854,7 +851,7 @@ process_notifytype(dns_notifytype_t ntype, dns_zonetype_t ztype,
 	 * hierarchy supplied in 'maps'.
 	 */
 	if (named_config_get(maps, "notify", &obj) == ISC_R_SUCCESS) {
-		cfg_obj_log(obj, named_g_lctx, ISC_LOG_INFO,
+		cfg_obj_log(obj, ISC_LOG_INFO,
 			    "'notify explicit;' will be used for mirror zone "
 			    "'%s'",
 			    zname);
@@ -889,7 +886,6 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	static char dlz_dbtype[] = "dlz";
 	char *cpval = default_dbtype;
 	isc_mem_t *mctx = dns_zone_getmctx(zone);
-	dns_dialuptype_t dialup = dns_dialuptype_no;
 	dns_zonetype_t ztype;
 	int i;
 	int32_t journal_size;
@@ -975,7 +971,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		size_t len;

 		if (cpval != default_dbtype) {
-			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			isc_log_write(NAMED_LOGCATEGORY_GENERAL,
 				      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 				      "zone '%s': both 'database' and 'dlz' "
 				      "specified",
@@ -1018,9 +1014,9 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	if (ztype == dns_zone_primary && cpval == default_dbtype &&
 	    filename == NULL)
 	{
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
-			      "zone '%s': 'file' not specified", zname);
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+			      ISC_LOG_ERROR, "zone '%s': 'file' not specified",
+			      zname);
 		CHECK(ISC_R_FAILURE);
 	}

@@ -1049,7 +1045,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		const char *masterstylestr = cfg_obj_asstring(obj);

 		if (masterformat != dns_masterformat_text) {
-			cfg_obj_log(obj, named_g_lctx, ISC_LOG_ERROR,
+			cfg_obj_log(obj, ISC_LOG_ERROR,
 				    "zone '%s': 'masterfile-style' "
 				    "can only be used with "
 				    "'masterfile-format text'",
@@ -1135,34 +1131,6 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 				 zone, dns_zone_setqueryonacl,
 				 dns_zone_clearqueryonacl));

-	obj = NULL;
-	result = named_config_get(maps, "dialup", &obj);
-	INSIST(result == ISC_R_SUCCESS && obj != NULL);
-	if (cfg_obj_isboolean(obj)) {
-		if (cfg_obj_asboolean(obj)) {
-			dialup = dns_dialuptype_yes;
-		} else {
-			dialup = dns_dialuptype_no;
-		}
-	} else {
-		const char *dialupstr = cfg_obj_asstring(obj);
-		if (strcasecmp(dialupstr, "notify") == 0) {
-			dialup = dns_dialuptype_notify;
-		} else if (strcasecmp(dialupstr, "notify-passive") == 0) {
-			dialup = dns_dialuptype_notifypassive;
-		} else if (strcasecmp(dialupstr, "refresh") == 0) {
-			dialup = dns_dialuptype_refresh;
-		} else if (strcasecmp(dialupstr, "passive") == 0) {
-			dialup = dns_dialuptype_passive;
-		} else {
-			UNREACHABLE();
-		}
-	}
-	if (raw != NULL) {
-		dns_zone_setdialup(raw, dialup);
-	}
-	dns_zone_setdialup(zone, dialup);
-
 	obj = NULL;
 	result = named_config_get(maps, "zone-statistics", &obj);
 	INSIST(result == ISC_R_SUCCESS && obj != NULL);
@@ -1233,8 +1201,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 							   &kasp);
 				if (result != ISC_R_SUCCESS) {
 					cfg_obj_log(
-						obj, named_g_lctx,
-						ISC_LOG_ERROR,
+						obj, ISC_LOG_ERROR,
 						"dnssec-policy '%s' not found ",
 						kaspname);
 					CHECK(result);
@@ -1360,7 +1327,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		} else {
 			uint64_t value = cfg_obj_asuint64(obj);
 			if (value > DNS_JOURNAL_SIZE_MAX) {
-				cfg_obj_log(obj, named_g_lctx, ISC_LOG_ERROR,
+				cfg_obj_log(obj, ISC_LOG_ERROR,
 					    "'max-journal-size "
 					    "%" PRId64 "' "
 					    "is too large",
@@ -1422,6 +1389,11 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		INSIST(result == ISC_R_SUCCESS);
 		dns_zone_setrequestixfr(zone, cfg_obj_asboolean(obj));

+		obj = NULL;
+		result = named_config_get(maps, "request-ixfr-max-diffs", &obj);
+		INSIST(result == ISC_R_SUCCESS);
+		dns_zone_setrequestixfrmaxdiffs(zone, cfg_obj_asuint32(obj));
+
 		obj = NULL;
 		checknames(ztype, maps, &obj);
 		INSIST(obj != NULL);
@@ -1505,7 +1477,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		} else {
 			uint64_t value = cfg_obj_asuint64(obj);
 			if (value > DNS_JOURNAL_SIZE_MAX) {
-				cfg_obj_log(obj, named_g_lctx, ISC_LOG_ERROR,
+				cfg_obj_log(obj, ISC_LOG_ERROR,
 					    "'max-journal-size "
 					    "%" PRId64 "' "
 					    "is too large",
@@ -1546,7 +1518,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,

 		updateacl = dns_zone_getupdateacl(mayberaw);
 		if (updateacl != NULL && dns_acl_isinsecure(updateacl)) {
-			isc_log_write(named_g_lctx, DNS_LOGCATEGORY_SECURITY,
+			isc_log_write(DNS_LOGCATEGORY_SECURITY,
 				      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
 				      "zone '%s' allows unsigned updates "
 				      "from remote hosts, which is insecure",
@@ -52,7 +52,6 @@
 #include <dns/dispatch.h>
 #include <dns/dnssec.h>
 #include <dns/fixedname.h>
-#include <dns/log.h>
 #include <dns/masterdump.h>
 #include <dns/message.h>
 #include <dns/name.h>
@@ -117,14 +116,12 @@ static bool debugging = false, ddebugging = false;
 static bool memdebugging = false;
 static bool have_ipv4 = false;
 static bool have_ipv6 = false;
-static bool is_dst_up = false;
 static bool use_tls = false;
 static bool usevc = false;
 static bool usegsstsig = false;
 static bool local_only = false;
 static isc_nm_t *netmgr = NULL;
 static isc_loopmgr_t *loopmgr = NULL;
-static isc_log_t *glctx = NULL;
 static isc_mem_t *gmctx = NULL;
 static dns_dispatchmgr_t *dispatchmgr = NULL;
 static dns_requestmgr_t *requestmgr = NULL;
@@ -199,7 +196,7 @@ send_update(dns_name_t *zonename, isc_sockaddr_t *primary);
 static void
 getinput(void *arg);

-noreturn static void
+ISC_NORETURN static void
 fatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);

 static void
@@ -560,7 +557,7 @@ failure:
 * Get a key from a named.conf format keyfile
 */
 static isc_result_t
-read_sessionkey(isc_mem_t *mctx, isc_log_t *lctx) {
+read_sessionkey(isc_mem_t *mctx) {
 	cfg_parser_t *pctx = NULL;
 	cfg_obj_t *sessionkey = NULL;
 	const cfg_obj_t *key = NULL;
@@ -576,7 +573,7 @@ read_sessionkey(isc_mem_t *mctx, isc_log_t *lctx) {
 		return (ISC_R_FILENOTFOUND);
 	}

-	result = cfg_parser_create(mctx, lctx, &pctx);
+	result = cfg_parser_create(mctx, &pctx);
 	if (result != ISC_R_SUCCESS) {
 		goto cleanup;
 	}
@@ -623,7 +620,7 @@ cleanup:
 }

 static void
-setup_keyfile(isc_mem_t *mctx, isc_log_t *lctx) {
+setup_keyfile(isc_mem_t *mctx) {
 	dst_key_t *dstkey = NULL;
 	isc_result_t result;
 	dst_algorithm_t hmac_alg = DST_ALG_UNKNOWN;
@@ -640,7 +637,7 @@ setup_keyfile(isc_mem_t *mctx, isc_log_t *lctx) {

 	/* If that didn't work, try reading it as a session.key keyfile */
 	if (result != ISC_R_SUCCESS) {
-		result = read_sessionkey(mctx, lctx);
+		result = read_sessionkey(mctx);
 		if (result == ISC_R_SUCCESS) {
 			return;
 		}
@@ -813,15 +810,12 @@ setup_system(void *arg ISC_ATTR_UNUSED) {

 	ddebug("setup_system()");

-	isc_log_create(gmctx, &glctx, &logconfig);
-	isc_log_setcontext(glctx);
-	dns_log_init(glctx);
-	dns_log_setcontext(glctx);
-
-	result = isc_log_usechannel(logconfig, "default_debug", NULL, NULL);
-	check_result(result, "isc_log_usechannel");
-
-	isc_log_setdebuglevel(glctx, logdebuglevel);
+	logconfig = isc_logconfig_get();
+	isc_log_createandusechannel(logconfig, "debug", ISC_LOG_TOFILEDESC,
+				    ISC_LOG_DYNAMIC, ISC_LOGDESTINATION_STDERR,
+				    ISC_LOG_PRINTTIME, ISC_LOGCATEGORY_DEFAULT,
+				    ISC_LOGMODULE_DEFAULT);
+	isc_log_setdebuglevel(logdebuglevel);

 	result = irs_resconf_load(gmctx, resolvconf, &resconf);
 	if (result != ISC_R_SUCCESS && result != ISC_R_FILENOTFOUND) {
@@ -926,10 +920,6 @@ setup_system(void *arg ISC_ATTR_UNUSED) {
 	result = dns_dispatchmgr_create(gmctx, loopmgr, netmgr, &dispatchmgr);
 	check_result(result, "dns_dispatchmgr_create");

-	result = dst_lib_init(gmctx, NULL);
-	check_result(result, "dst_lib_init");
-	is_dst_up = true;
-
 	set_source_ports(dispatchmgr);

 	if (have_ipv6) {
@@ -978,13 +968,13 @@ setup_system(void *arg ISC_ATTR_UNUSED) {
 	if (keystr != NULL) {
 		setup_keystr();
 	} else if (local_only) {
-		result = read_sessionkey(gmctx, glctx);
+		result = read_sessionkey(gmctx);
 		if (result != ISC_R_SUCCESS) {
 			fatal("can't read key from %s: %s\n", keyfile,
 			      isc_result_totext(result));
 		}
 	} else if (keyfile != NULL) {
-		setup_keyfile(gmctx, glctx);
+		setup_keyfile(gmctx);
 	}

 	isc_mutex_init(&answer_lock);
@@ -3493,9 +3483,6 @@ cleanup(void) {
 	}
 #endif /* ifdef HAVE_GSSAPI */

-	ddebug("Removing log context");
-	isc_log_destroy(&glctx);
-
 	ddebug("Destroying memory context");
 	if (memdebugging) {
 		isc_mem_stats(gmctx, stderr);
@@ -3503,12 +3490,6 @@ cleanup(void) {

 	isc_mutex_destroy(&answer_lock);

-	if (is_dst_up) {
-		ddebug("Destroy DST lib");
-		dst_lib_destroy();
-		is_dst_up = false;
-	}
-
 	ddebug("Shutting down managers");
 	isc_managers_destroy(&gmctx, &loopmgr, &netmgr);
 }
@@ -32,7 +32,6 @@
 #include <dns/acl.h>
 #include <dns/db.h>
 #include <dns/enumtype.h>
-#include <dns/log.h>
 #include <dns/message.h>
 #include <dns/rdataset.h>
 #include <dns/types.h>
@@ -44,7 +43,6 @@

 #include <ns/client.h>
 #include <ns/hooks.h>
-#include <ns/log.h>
 #include <ns/query.h>
 #include <ns/types.h>

@@ -231,8 +229,7 @@ parse_filter_a_on(const cfg_obj_t *param_obj, const char *param_name,
 }

 static isc_result_t
-check_syntax(cfg_obj_t *fmap, const void *cfg, isc_mem_t *mctx, isc_log_t *lctx,
-	     void *actx) {
+check_syntax(cfg_obj_t *fmap, const void *cfg, isc_mem_t *mctx, void *actx) {
 	isc_result_t result = ISC_R_SUCCESS;
 	const cfg_obj_t *aclobj = NULL;
 	dns_acl_t *acl = NULL;
@@ -243,20 +240,20 @@ check_syntax(cfg_obj_t *fmap, const void *cfg, isc_mem_t *mctx, isc_log_t *lctx,
 		return (result);
 	}

-	CHECK(cfg_acl_fromconfig(aclobj, (const cfg_obj_t *)cfg, lctx,
+	CHECK(cfg_acl_fromconfig(aclobj, (const cfg_obj_t *)cfg,
 				 (cfg_aclconfctx_t *)actx, mctx, 0, &acl));

 	CHECK(parse_filter_a_on(fmap, "filter-a-on-v6", &f6));
 	CHECK(parse_filter_a_on(fmap, "filter-a-on-v4", &f4));

 	if ((f4 != NONE || f6 != NONE) && dns_acl_isnone(acl)) {
-		cfg_obj_log(aclobj, lctx, ISC_LOG_WARNING,
+		cfg_obj_log(aclobj, ISC_LOG_WARNING,
 			    "\"filter-a\" is 'none;' but "
 			    "either filter-a-on-v6 or filter-a-on-v4 "
 			    "is enabled");
 		result = ISC_R_FAILURE;
 	} else if (f4 == NONE && f6 == NONE && !dns_acl_isnone(acl)) {
-		cfg_obj_log(aclobj, lctx, ISC_LOG_WARNING,
+		cfg_obj_log(aclobj, ISC_LOG_WARNING,
 			    "\"filter-a\" is set but "
 			    "neither filter-a-on-v6 or filter-a-on-v4 "
 			    "is enabled");
@@ -274,28 +271,28 @@ cleanup:
 static isc_result_t
 parse_parameters(filter_instance_t *inst, const char *parameters,
 		 const void *cfg, const char *cfg_file, unsigned long cfg_line,
-		 isc_mem_t *mctx, isc_log_t *lctx, void *actx) {
+		 isc_mem_t *mctx, void *actx) {
 	isc_result_t result = ISC_R_SUCCESS;
 	cfg_parser_t *parser = NULL;
 	cfg_obj_t *param_obj = NULL;
 	const cfg_obj_t *obj = NULL;
 	isc_buffer_t b;

-	CHECK(cfg_parser_create(mctx, lctx, &parser));
+	CHECK(cfg_parser_create(mctx, &parser));

 	isc_buffer_constinit(&b, parameters, strlen(parameters));
 	isc_buffer_add(&b, strlen(parameters));
 	CHECK(cfg_parse_buffer(parser, &b, cfg_file, cfg_line,
 			       &cfg_type_parameters, 0, &param_obj));

-	CHECK(check_syntax(param_obj, cfg, mctx, lctx, actx));
+	CHECK(check_syntax(param_obj, cfg, mctx, actx));

 	CHECK(parse_filter_a_on(param_obj, "filter-a-on-v6", &inst->v6_a));
 	CHECK(parse_filter_a_on(param_obj, "filter-a-on-v4", &inst->v4_a));

 	result = cfg_map_get(param_obj, "filter-a", &obj);
 	if (result == ISC_R_SUCCESS) {
-		CHECK(cfg_acl_fromconfig(obj, (const cfg_obj_t *)cfg, lctx,
+		CHECK(cfg_acl_fromconfig(obj, (const cfg_obj_t *)cfg,
 					 (cfg_aclconfctx_t *)actx, mctx, 0,
 					 &inst->a_acl));
 	} else {
@@ -327,13 +324,12 @@ cleanup:
 */
 isc_result_t
 plugin_register(const char *parameters, const void *cfg, const char *cfg_file,
-		unsigned long cfg_line, isc_mem_t *mctx, isc_log_t *lctx,
-		void *actx, ns_hooktable_t *hooktable, void **instp) {
+		unsigned long cfg_line, isc_mem_t *mctx, void *actx,
+		ns_hooktable_t *hooktable, void **instp) {
 	filter_instance_t *inst = NULL;
 	isc_result_t result = ISC_R_SUCCESS;

-	isc_log_write(lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_HOOKS,
-		      ISC_LOG_INFO,
+	isc_log_write(NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_HOOKS, ISC_LOG_INFO,
 		      "registering 'filter-a' "
 		      "module from %s:%lu, %s parameters",
 		      cfg_file, cfg_line, parameters != NULL ? "with" : "no");
@@ -344,7 +340,7 @@ plugin_register(const char *parameters, const void *cfg, const char *cfg_file,

 	if (parameters != NULL) {
 		CHECK(parse_parameters(inst, parameters, cfg, cfg_file,
-				       cfg_line, mctx, lctx, actx));
+				       cfg_line, mctx, actx));
 	}

 	isc_ht_init(&inst->ht, mctx, 1, ISC_HT_CASE_SENSITIVE);
@@ -367,21 +363,20 @@ cleanup:

 isc_result_t
 plugin_check(const char *parameters, const void *cfg, const char *cfg_file,
-	     unsigned long cfg_line, isc_mem_t *mctx, isc_log_t *lctx,
-	     void *actx) {
+	     unsigned long cfg_line, isc_mem_t *mctx, void *actx) {
 	isc_result_t result = ISC_R_SUCCESS;
 	cfg_parser_t *parser = NULL;
 	cfg_obj_t *param_obj = NULL;
 	isc_buffer_t b;

-	CHECK(cfg_parser_create(mctx, lctx, &parser));
+	CHECK(cfg_parser_create(mctx, &parser));

 	isc_buffer_constinit(&b, parameters, strlen(parameters));
 	isc_buffer_add(&b, strlen(parameters));
 	CHECK(cfg_parse_buffer(parser, &b, cfg_file, cfg_line,
 			       &cfg_type_parameters, 0, &param_obj));

-	CHECK(check_syntax(param_obj, cfg, mctx, lctx, actx));
+	CHECK(check_syntax(param_obj, cfg, mctx, actx));

 cleanup:
 	if (param_obj != NULL) {
@@ -32,7 +32,6 @@
 #include <dns/acl.h>
 #include <dns/db.h>
 #include <dns/enumtype.h>
-#include <dns/log.h>
 #include <dns/message.h>
 #include <dns/rdataset.h>
 #include <dns/types.h>
@@ -44,7 +43,6 @@

 #include <ns/client.h>
 #include <ns/hooks.h>
-#include <ns/log.h>
 #include <ns/query.h>
 #include <ns/types.h>

@@ -232,8 +230,7 @@ parse_filter_aaaa_on(const cfg_obj_t *param_obj, const char *param_name,
 }

 static isc_result_t
-check_syntax(cfg_obj_t *fmap, const void *cfg, isc_mem_t *mctx, isc_log_t *lctx,
-	     void *actx) {
+check_syntax(cfg_obj_t *fmap, const void *cfg, isc_mem_t *mctx, void *actx) {
 	isc_result_t result = ISC_R_SUCCESS;
 	const cfg_obj_t *aclobj = NULL;
 	dns_acl_t *acl = NULL;
@@ -244,20 +241,20 @@ check_syntax(cfg_obj_t *fmap, const void *cfg, isc_mem_t *mctx, isc_log_t *lctx,
 		return (result);
 	}

-	CHECK(cfg_acl_fromconfig(aclobj, (const cfg_obj_t *)cfg, lctx,
+	CHECK(cfg_acl_fromconfig(aclobj, (const cfg_obj_t *)cfg,
 				 (cfg_aclconfctx_t *)actx, mctx, 0, &acl));

 	CHECK(parse_filter_aaaa_on(fmap, "filter-aaaa-on-v4", &f4));
 	CHECK(parse_filter_aaaa_on(fmap, "filter-aaaa-on-v6", &f6));

 	if ((f4 != NONE || f6 != NONE) && dns_acl_isnone(acl)) {
-		cfg_obj_log(aclobj, lctx, ISC_LOG_WARNING,
+		cfg_obj_log(aclobj, ISC_LOG_WARNING,
 			    "\"filter-aaaa\" is 'none;' but "
 			    "either filter-aaaa-on-v4 or filter-aaaa-on-v6 "
 			    "is enabled");
 		result = ISC_R_FAILURE;
 	} else if (f4 == NONE && f6 == NONE && !dns_acl_isnone(acl)) {
-		cfg_obj_log(aclobj, lctx, ISC_LOG_WARNING,
+		cfg_obj_log(aclobj, ISC_LOG_WARNING,
 			    "\"filter-aaaa\" is set but "
 			    "neither filter-aaaa-on-v4 or filter-aaaa-on-v6 "
 			    "is enabled");
@@ -275,21 +272,21 @@ cleanup:
 static isc_result_t
 parse_parameters(filter_instance_t *inst, const char *parameters,
 		 const void *cfg, const char *cfg_file, unsigned long cfg_line,
-		 isc_mem_t *mctx, isc_log_t *lctx, void *actx) {
+		 isc_mem_t *mctx, void *actx) {
 	isc_result_t result = ISC_R_SUCCESS;
 	cfg_parser_t *parser = NULL;
 	cfg_obj_t *param_obj = NULL;
 	const cfg_obj_t *obj = NULL;
 	isc_buffer_t b;

-	CHECK(cfg_parser_create(mctx, lctx, &parser));
+	CHECK(cfg_parser_create(mctx, &parser));

 	isc_buffer_constinit(&b, parameters, strlen(parameters));
 	isc_buffer_add(&b, strlen(parameters));
 	CHECK(cfg_parse_buffer(parser, &b, cfg_file, cfg_line,
 			       &cfg_type_parameters, 0, &param_obj));

-	CHECK(check_syntax(param_obj, cfg, mctx, lctx, actx));
+	CHECK(check_syntax(param_obj, cfg, mctx, actx));

 	CHECK(parse_filter_aaaa_on(param_obj, "filter-aaaa-on-v4",
 				   &inst->v4_aaaa));
@@ -298,7 +295,7 @@ parse_parameters(filter_instance_t *inst, const char *parameters,

 	result = cfg_map_get(param_obj, "filter-aaaa", &obj);
 	if (result == ISC_R_SUCCESS) {
-		CHECK(cfg_acl_fromconfig(obj, (const cfg_obj_t *)cfg, lctx,
+		CHECK(cfg_acl_fromconfig(obj, (const cfg_obj_t *)cfg,
 					 (cfg_aclconfctx_t *)actx, mctx, 0,
 					 &inst->aaaa_acl));
 	} else {
@@ -330,13 +327,12 @@ cleanup:
 */
 isc_result_t
 plugin_register(const char *parameters, const void *cfg, const char *cfg_file,
-		unsigned long cfg_line, isc_mem_t *mctx, isc_log_t *lctx,
-		void *actx, ns_hooktable_t *hooktable, void **instp) {
+		unsigned long cfg_line, isc_mem_t *mctx, void *actx,
+		ns_hooktable_t *hooktable, void **instp) {
 	filter_instance_t *inst = NULL;
 	isc_result_t result = ISC_R_SUCCESS;

-	isc_log_write(lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_HOOKS,
-		      ISC_LOG_INFO,
+	isc_log_write(NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_HOOKS, ISC_LOG_INFO,
 		      "registering 'filter-aaaa' "
 		      "module from %s:%lu, %s parameters",
 		      cfg_file, cfg_line, parameters != NULL ? "with" : "no");
@@ -348,7 +344,7 @@ plugin_register(const char *parameters, const void *cfg, const char *cfg_file,

 	if (parameters != NULL) {
 		CHECK(parse_parameters(inst, parameters, cfg, cfg_file,
-				       cfg_line, mctx, lctx, actx));
+				       cfg_line, mctx, actx));
 	}

 	isc_ht_init(&inst->ht, mctx, 1, ISC_HT_CASE_SENSITIVE);
@@ -371,21 +367,20 @@ cleanup:

 isc_result_t
 plugin_check(const char *parameters, const void *cfg, const char *cfg_file,
-	     unsigned long cfg_line, isc_mem_t *mctx, isc_log_t *lctx,
-	     void *actx) {
+	     unsigned long cfg_line, isc_mem_t *mctx, void *actx) {
 	isc_result_t result = ISC_R_SUCCESS;
 	cfg_parser_t *parser = NULL;
 	cfg_obj_t *param_obj = NULL;
 	isc_buffer_t b;

-	CHECK(cfg_parser_create(mctx, lctx, &parser));
+	CHECK(cfg_parser_create(mctx, &parser));

 	isc_buffer_constinit(&b, parameters, strlen(parameters));
 	isc_buffer_add(&b, strlen(parameters));
 	CHECK(cfg_parse_buffer(parser, &b, cfg_file, cfg_line,
 			       &cfg_type_parameters, 0, &param_obj));

-	CHECK(check_syntax(param_obj, cfg, mctx, lctx, actx));
+	CHECK(check_syntax(param_obj, cfg, mctx, actx));

 cleanup:
 	if (param_obj != NULL) {
@@ -87,7 +87,7 @@ static int32_t timeout = RNDC_TIMEOUT;
 static void
 rndc_startconnect(isc_sockaddr_t *addr);

-noreturn static void
+ISC_NORETURN static void
 usage(int status);

 static void
@@ -132,6 +132,9 @@ command is one of the following:\n\
  halt		Stop the server without saving pending updates.\n\
  halt -p	Stop the server without saving pending updates reporting\n\
 		process id.\n\
+  skr -import file zone [class [view]]\n\
+		Import a SKR file for the specified zone, for offline KSK\n\
+		signing.\n\
  loadkeys zone [class [view]]\n\
 		Update keys without signing immediately.\n\
  managed-keys refresh [class [view]]\n\
@@ -526,8 +529,8 @@ rndc_start(void *arg) {
 }

 static void
-parse_config(isc_mem_t *mctx, isc_log_t *log, const char *keyname,
-	     cfg_parser_t **pctxp, cfg_obj_t **configp) {
+parse_config(isc_mem_t *mctx, const char *keyname, cfg_parser_t **pctxp,
+	     cfg_obj_t **configp) {
 	isc_result_t result;
 	const char *conffile = admin_conffile;
 	const cfg_obj_t *addresses = NULL;
@@ -570,7 +573,7 @@ parse_config(isc_mem_t *mctx, isc_log_t *log, const char *keyname,
 			admin_keyfile, admin_conffile);
 	}

-	DO("create parser", cfg_parser_create(mctx, log, pctxp));
+	DO("create parser", cfg_parser_create(mctx, pctxp));

 	/*
 	 * The parser will output its own errors, so DO() is not used.
@@ -806,9 +809,7 @@ int
 main(int argc, char **argv) {
 	isc_result_t result = ISC_R_SUCCESS;
 	bool show_final_mem = false;
-	isc_log_t *log = NULL;
 	isc_logconfig_t *logconfig = NULL;
-	isc_logdestination_t logdest;
 	cfg_parser_t *pctx = NULL;
 	cfg_obj_t *config = NULL;
 	const char *keyname = NULL;
@@ -954,20 +955,15 @@ main(int argc, char **argv) {

 	isc_nm_settimeouts(netmgr, timeout, timeout, timeout, 0);

-	isc_log_create(rndc_mctx, &log, &logconfig);
-	isc_log_setcontext(log);
+	logconfig = isc_logconfig_get();
 	isc_log_settag(logconfig, progname);
-	logdest.file.stream = stderr;
-	logdest.file.name = NULL;
-	logdest.file.versions = ISC_LOG_ROLLNEVER;
-	logdest.file.maximum_size = 0;
-	isc_log_createchannel(logconfig, "stderr", ISC_LOG_TOFILEDESC,
-			      ISC_LOG_INFO, &logdest,
-			      ISC_LOG_PRINTTAG | ISC_LOG_PRINTLEVEL);
-	DO("enabling log channel",
-	   isc_log_usechannel(logconfig, "stderr", NULL, NULL));
+	isc_log_createandusechannel(
+		logconfig, "default_stderr", ISC_LOG_TOFILEDESC, ISC_LOG_INFO,
+		ISC_LOGDESTINATION_STDERR,
+		ISC_LOG_PRINTTAG | ISC_LOG_PRINTLEVEL, ISC_LOGCATEGORY_DEFAULT,
+		ISC_LOGMODULE_DEFAULT);

-	parse_config(rndc_mctx, log, keyname, &pctx, &config);
+	parse_config(rndc_mctx, keyname, &pctx, &config);

 	isc_buffer_allocate(rndc_mctx, &databuf, 2048);

@@ -1003,9 +999,6 @@ main(int argc, char **argv) {

 	isccc_ccmsg_invalidate(&rndc_ccmsg);

-	isc_log_destroy(&log);
-	isc_log_setcontext(NULL);
-
 	cfg_obj_destroy(pctx, &config);
 	cfg_parser_destroy(&pctx);

@@ -266,6 +266,11 @@ Currently supported commands are:

   See also :option:`rndc stop`.

+.. option:: skr -import file zone [class [view]]
+
+   This command allows you to import a SKR file for the specified zone, to
+   support offline KSK signing.
+
 .. option:: loadkeys [zone [class [view]]]

   This command fetches all DNSSEC keys for the given zone from the key directory. If
@@ -36,7 +36,7 @@ ISC_LANG_BEGINDECLS
 void
 notify(const char *fmt, ...) ISC_FORMAT_PRINTF(1, 2);

-noreturn void
+ISC_NORETURN void
 fatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);

 ISC_LANG_ENDDECLS
@@ -1,4 +1,4 @@
-#!/usr/bin/env python
+#!/usr/bin/env python3
 #
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
@@ -9,6 +9,7 @@ named.lock
 named.pid
 named.run
 /feature-test
+/legacy.run.sh
 /makejournal
 /random.data
 /*.log
@@ -95,8 +95,8 @@ TESTS =				\
 	checknames		\
 	checkzone		\
 	cookie			\
+	cpu			\
 	database		\
-	dialup			\
 	digdelv			\
 	dispatch		\
 	dlzexternal		\
@@ -29,6 +29,7 @@ options {
 	notify no;
 	notify-delay 0;
 	recursion no;
+#T5	allow-query { 10.53.0.99; };
 	serial-query-rate 100;
 	dnssec-validation no;
 };
@@ -702,6 +702,23 @@ wait_for_soa @10.53.0.2 dom3.example. dig.out.test$n || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

+# GL #4733
+n=$((n + 1))
+echo_i "reconfiguring secondary - checking if catz member zones are reconfigured ($n)"
+ret=0
+sed -e "s/^#T5//" <ns2/named1.conf.in >ns2/named.conf.tmp
+copy_setports ns2/named.conf.tmp ns2/named.conf
+rndccmd 10.53.0.2 reconfig || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "checking that dom3.example. is refused by secondary because of an activated allow-query ($n)"
+ret=0
+wait_for_no_soa @10.53.0.2 dom3.example. dig.out.test$n || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
 n=$((n + 1))
 echo_i "reconfiguring secondary - reverting the bad configuration ($n)"
 ret=0
@@ -37,11 +37,28 @@ key rndc_key {
 	algorithm @DEFAULT_HMAC@;
 };

+key restart16 {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
 controls {
 	inet 10.53.0.7 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
 };

-zone "." {
-	type hint;
-	file "root.hint";
+view restart16 {
+	match-clients { key restart16; none; };
+	max-query-restarts 16;
+
+	zone "." {
+		type hint;
+		file "root.hint";
+	};
+};
+
+view default {
+	zone "." {
+		type hint;
+		file "root.hint";
+	};
 };
@@ -442,11 +442,13 @@ n=$((n + 1))
 echo_i "checking CNAME loops are detected (resolver) ($n)"
 ret=0
 $RNDCCMD 10.53.0.7 null --- start test$n --- 2>&1 | sed 's/^/ns7 /' | cat_i
-$DIG $DIGOPTS @10.53.0.7 loop.example >dig.out.test$n
-grep "status: SERVFAIL" dig.out.test$n >/dev/null || ret=1
-grep "ANSWER: 0" dig.out.test$n >/dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=$((status + ret))
+$DIG $DIGOPTS @10.53.0.7 loop.example >dig.out.1.test$n
+grep "status: NOERROR" dig.out.1.test$n >/dev/null || ret=1
+grep "ANSWER: 12" dig.out.1.test$n >/dev/null || ret=1
+# also check with max-query-restarts 16:
+$DIG $DIGOPTS @10.53.0.7 -y "${DEFAULT_HMAC}:restart16:1234abcd8765" loop.example >dig.out.2.test$n
+grep "status: NOERROR" dig.out.2.test$n >/dev/null || ret=1
+grep "ANSWER: 17" dig.out.2.test$n >/dev/null || ret=1

 n=$((n + 1))
 echo_i "checking CNAME loops are detected (auth) ($n)"
@@ -454,7 +456,7 @@ ret=0
 $DIG $DIGOPTS @10.53.0.2 loop.example >dig.out.test$n
 grep "status: SERVFAIL" dig.out.test$n >/dev/null || ret=1
 grep "max. restarts reached" dig.out.test$n >/dev/null || ret=1
-grep "ANSWER: 17" dig.out.test$n >/dev/null || ret=1
+grep "ANSWER: 12" dig.out.test$n >/dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

@@ -11,12 +11,9 @@
 * information regarding copyright ownership.
 */

+/*
+ * Ancient options are fatal.
+ */
 options {
-	avoid-v4-udp-ports {
-		1935;
-		2605;
-		4321;
-		6514;
-		range 8610 8614;
-	};
+	avoid-v4-udp-ports { range 1 1023; };
 };
@@ -11,26 +11,9 @@
 * information regarding copyright ownership.
 */

-controls { /* empty */ };
+/*
+ * Ancient options are fatal.
+ */
 options {
-	query-source address 10.53.0.2;
-	notify-source 10.53.0.2;
-	transfer-source 10.53.0.2;
-	port 5300;
-	pid-file "named.pid";
-	listen-on { 10.53.0.2; };
-	listen-on-v6 { none; };
-	heartbeat-interval 2;
-	recursion no;
-};
-zone "." {
-	type hint;
-	file "hint";
-};
-zone "example." {
-	type stub;
-	dialup notify;
-	notify no;
-	file "example.bk";
-	// primaries { 10.53.0.1; };
+	avoid-v6-udp-ports { range 1 1023; };
 };
@@ -11,12 +11,8 @@
 * information regarding copyright ownership.
 */

-options {
-	port 5300;
-};
-
 zone example {
 	type secondary;
 	primaries { 1.2.3.4; };
-	notify-source 10.53.0.1 port 100;
+	notify-source 10.53.0.1 port 5300;
 };
@@ -0,0 +1,16 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+server 1.2.3.4 {
+	query-source 10.10.10.10 port 5353;
+};
@@ -11,30 +11,9 @@
 * information regarding copyright ownership.
 */

-controls { /* empty */ };
-
+/*
+ * Ancient options are fatal.
+ */
 options {
-	query-source address 10.53.0.3;
-	notify-source 10.53.0.3;
-	transfer-source 10.53.0.3;
-	port @PORT@;
-	pid-file "named.pid";
-	listen-on { 10.53.0.3; };
-	listen-on-v6 { none; };
-	heartbeat-interval 1;
-	recursion no;
-	dnssec-validation no;
-};
-
-zone "." {
-	type hint;
-	file "hint.db";
-};
-
-zone "example." {
-	type secondary;
-	dialup refresh;
-	notify no;
-	file "example.bk";
-	primaries { 10.53.0.2; };
+	use-v4-udp-ports { range 1024 65535; };
 };
@@ -0,0 +1,19 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*
+ * Ancient options are fatal.
+ */
+options {
+	use-v6-udp-ports { range 1024 65535; };
+};
@@ -16,4 +16,9 @@
 */
 options {
 	fake-iquery yes;
+
+	use-v4-udp-ports { range 1024 65535; };
+	use-v6-udp-ports { range 1024 65535; };
+	avoid-v4-udp-ports { range 1 1023; };
+	avoid-v6-udp-ports { range 1 1023; };
 };
@@ -0,0 +1,18 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+dnssec-policy reverse-order {
+	keys {
+		csk lifetime unlimited algorithm rsasha256 tag-range 32767 0 2048;
+	};
+};
@@ -0,0 +1,18 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+dnssec-policy too-big-start {
+	keys {
+		csk lifetime unlimited algorithm rsasha256 tag-range 65536 0 2048;
+	};
+};
@@ -0,0 +1,18 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+dnssec-policy too-big-end {
+	keys {
+		csk lifetime unlimited algorithm rsasha256 tag-range 0 65536 2048;
+	};
+};
@@ -0,0 +1,18 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+dnssec-policy start-equals-end {
+	keys {
+		csk lifetime unlimited algorithm rsasha256 tag-range 0 0 2048;
+	};
+};
@@ -0,0 +1,22 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*
+ * request-ixfr clause is not allowed in zone of type primary.
+ */
+
+zone dummy {
+	type primary;
+	request-ixfr-max-diffs 100;
+	file "xxxx";
+};
@@ -11,22 +11,10 @@
 * information regarding copyright ownership.
 */

-server 1.2.3.4 {
-	query-source 10.10.10.10 port 5353;
-};
-
 options {
 	dnssec-validation yes;
 	max-zone-ttl 600;

-        dialup yes;
-        heartbeat-interval 60;
-
-	use-v4-udp-ports { range 1024 65535; };
-	use-v6-udp-ports { range 1024 65535; };
-	avoid-v4-udp-ports { range 1 1023; };
-	avoid-v6-udp-ports { range 1 1023; };
-
 	dnssec-must-be-secure mustbesecure.example yes;

 	sortlist { };
@@ -0,0 +1,26 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+dnssec-policy restricted-range {
+	keys {
+		ksk lifetime unlimited algorithm rsasha256 tag-range 0 32767 2048;
+		zsk lifetime unlimited algorithm rsasha256 tag-range 0 32767;
+	};
+};
+
+dnssec-policy unrestricted-range {
+	keys {
+		ksk lifetime unlimited algorithm rsasha256 2048;
+		zsk lifetime unlimited algorithm rsasha256;
+	};
+};
@@ -30,6 +30,7 @@ dnssec-policy "test" {
 	};
 	max-zone-ttl 86400;
 	nsec3param iterations 0 optout no salt-length 8;
+	offline-ksk no;
 	parent-ds-ttl 7200;
 	parent-propagation-delay PT1H;
 	publish-safety PT3600S;
@@ -29,6 +29,7 @@ server 0.0.0.0 {
 	query-source 0.0.0.0;
 	request-expire no;
 	request-ixfr no;
+	request-ixfr-max-diffs 0;
 	request-nsid no;
 	require-cookie no;
 	send-cookie no;
@@ -52,6 +53,7 @@ server :: {
 	query-source-v6 ::;
 	request-expire no;
 	request-ixfr no;
+	request-ixfr-max-diffs 0;
 	request-nsid no;
 	require-cookie no;
 	send-cookie no;
@@ -23,7 +23,7 @@ dnssec-policy "test" {
 	};
 	dnskey-ttl 3600;
 	keys {
-		ksk key-directory lifetime P1Y algorithm 13;
+		ksk key-directory lifetime P1Y algorithm 13 tag-range 0 32767;
 		zsk lifetime P30D algorithm 13;
 		csk key-store "hsm" lifetime P30D algorithm 8 2048;
 	};
@@ -45,18 +45,11 @@ key-store "hsm" {
 	pkcs11-uri "pkcs11:token=bind9;pin-value=1234";
 };
 options {
-	avoid-v4-udp-ports {
-		100;
-	};
-	avoid-v6-udp-ports {
-		100;
-	};
 	blackhole {
 		10.0.0.0/8;
 	};
 	directory ".";
 	dump-file "named_dumpdb";
-	heartbeat-interval 30;
 	hostname none;
 	interface-interval 30;
 	listen-on port 90 {
@@ -81,6 +74,7 @@ options {
 	check-names primary warn;
 	check-names secondary ignore;
 	max-cache-size 20000000000000;
+	max-query-restarts 10;
 	nta-lifetime 604800;
 	nta-recheck 604800;
 	validate-except {
@@ -91,7 +85,7 @@ options {
 	transfer-source 0.0.0.0;
 	zone-statistics none;
 };
-parental-agents "parents" port 5353 source 10.10.10.10 port 5354 source-v6 2001:db8::10 port 5355 {
+parental-agents "parents" port 5353 source 10.10.10.10 source-v6 2001:db8::10 {
 	10.10.10.11;
 	2001:db8::11;
 };
@@ -104,7 +98,7 @@ view "first" {
 		file "xxx";
 		update-policy local;
 		max-ixfr-ratio 20%;
-		notify-source 10.10.10.10 port 53;
+		notify-source 10.10.10.10;
 	};
 	zone "clone" {
 		type primary;
@@ -112,6 +106,7 @@ view "first" {
 		max-ixfr-ratio unlimited;
 	};
 	dnssec-validation auto;
+	max-query-restarts 15;
 	zone-statistics terse;
 };
 view "second" {
@@ -192,7 +187,7 @@ view "fourth" {
 			1.2.3.5;
 		};
 		dnssec-policy "test";
-		parental-source 10.10.10.10 port 53;
+		parental-source 10.10.10.10;
 	};
 	zone "dnssec-default" {
 		type primary;
@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*
+ * Offline KSK is not possible with CSK
+ * (even if there are other key roles present).
+ */
+dnssec-policy "bad-offline-ksk" {
+	offline-ksk yes;
+	keys {
+		ksk lifetime P10Y algorithm rsasha256;
+		zsk lifetime P10Y algorithm rsasha256;
+		csk lifetime P10Y algorithm rsasha256;
+	};
+};
+
+zone "example.net" {
+	type primary;
+	file "example.db";
+	dnssec-policy "bad-offline-ksk";
+};
@@ -89,7 +89,7 @@ for good in good-*.conf; do
      good-proxy-*doh*.conf) continue ;;
      bad-proxy-*doh*.conf) continue ;;
    esac
-  elif ! $FEATURETEST --have-openssl-cipher-suites; then
+  else
    case $good in
      good-tls-cipher-suites-*.conf) continue ;;
    esac
@@ -141,6 +141,20 @@ grep "no longer exists" ancient.out >/dev/null || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

+for ancient_conf in ancient-*.conf; do
+  ancient_opt="${ancient_conf#ancient-}"
+  ancient_opt="${ancient_opt%.conf}"
+
+  n=$((n + 1))
+  echo_i "checking that ancient \"${ancient_opt}\" option report a fatal error ($n)"
+  ret=0
+
+  $CHECKCONF ${ancient_conf} >"${ancient_conf}.out" 2>&1 && ret=1
+  grep "no longer exists" "${ancient_conf}.out" >/dev/null || ret=1
+  if [ $ret -ne 0 ]; then echo_i "failed"; fi
+  status=$((status + ret))
+done
+
 n=$((n + 1))
 echo_i "checking that named-checkconf -z catches missing hint file ($n)"
 ret=0
@@ -174,19 +188,12 @@ fi
 n=$((n + 1))
 echo_i "checking named-checkconf deprecate warnings ($n)"
 ret=0
-$CHECKCONF deprecated.conf >checkconf.out$n.1 2>&1
+$CHECKCONF deprecated.conf >checkconf.out$n.1 2>&1 || ret=1
 grep "option 'managed-keys' is deprecated" <checkconf.out$n.1 >/dev/null || ret=1
 grep "option 'trusted-keys' is deprecated" <checkconf.out$n.1 >/dev/null || ret=1
 grep "option 'max-zone-ttl' is deprecated" <checkconf.out$n.1 >/dev/null || ret=1
-grep "option 'use-v4-udp-ports' is deprecated" <checkconf.out$n.1 >/dev/null || ret=1
-grep "option 'use-v6-udp-ports' is deprecated" <checkconf.out$n.1 >/dev/null || ret=1
-grep "option 'avoid-v4-udp-ports' is deprecated" <checkconf.out$n.1 >/dev/null || ret=1
-grep "option 'avoid-v6-udp-ports' is deprecated" <checkconf.out$n.1 >/dev/null || ret=1
-grep "option 'dialup' is deprecated" <checkconf.out$n.1 >/dev/null || ret=1
-grep "option 'heartbeat-interval' is deprecated" <checkconf.out$n.1 >/dev/null || ret=1
 grep "option 'dnssec-must-be-secure' is deprecated" <checkconf.out$n.1 >/dev/null || ret=1
 grep "option 'sortlist' is deprecated" <checkconf.out$n.1 >/dev/null || ret=1
-grep "token 'port' is deprecated" <checkconf.out$n.1 >/dev/null || ret=1
 if $test_fixed; then
  grep "rrset-order: order 'fixed' is deprecated" <checkconf.out$n.1 >/dev/null || ret=1
 else
@@ -494,17 +501,6 @@ if [ $ret -ne 0 ]; then
 fi
 status=$((status + ret))

-n=$((n + 1))
-echo_i "check that named-checkconf -p properly print a port range ($n)"
-ret=0
-$CHECKCONF -p portrange-good.conf >checkconf.out$n 2>&1 || ret=1
-grep "range 8610 8614;" <checkconf.out$n >/dev/null || ret=1
-if [ $ret -ne 0 ]; then
-  echo_i "failed"
-  ret=1
-fi
-status=$((status + ret))
-
 n=$((n + 1))
 echo_i "check that named-checkconf -z handles in-view ($n)"
 ret=0
@@ -676,6 +672,14 @@ grep "dnssec-policy: key with algorithm rsasha256 has invalid key length 511" <c
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

+n=$((n + 1))
+echo_i "checking named-checkconf kasp offline-ksk with csk errors ($n)"
+ret=0
+$CHECKCONF kasp-bad-offline-ksk.conf >checkconf.out$n 2>&1 && ret=1
+grep "dnssec-policy: csk keys are not allowed when offline-ksk is enabled" <checkconf.out$n >/dev/null || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
 n=$((n + 1))
 echo_i "checking named-checkconf kasp signatures refresh errors ($n)"
 ret=0
@@ -746,21 +750,6 @@ if [ $ret -ne 0 ]; then
 fi
 status=$((status + ret))

-n=$((n + 1))
-echo_i "check that *-source options with specified port generate warnings ($n)"
-ret=0
-$CHECKCONF warn-transfer-source.conf >checkconf.out$n 2>/dev/null || ret=1
-grep "not recommended" <checkconf.out$n >/dev/null || ret=1
-$CHECKCONF warn-notify-source.conf >checkconf.out$n 2>/dev/null || ret=1
-grep "not recommended" <checkconf.out$n >/dev/null || ret=1
-$CHECKCONF warn-parental-source.conf >checkconf.out$n 2>/dev/null || ret=1
-grep "not recommended" <checkconf.out$n >/dev/null || ret=1
-if [ $ret -ne 0 ]; then
-  echo_i "failed"
-  ret=1
-fi
-status=$((status + ret))
-
 n=$((n + 1))
 echo_i "check that 'check-wildcard no;' succeeds as configured ($n)"
 ret=0
@@ -11,7 +11,6 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-rm -f ns2/example.bk
-rm -f ns3/example.bk
-rm -f */named.memstats */named.run
-rm -f ns*/named.conf
+set -e
+
+rm -f ./named.run.*
@@ -11,31 +11,10 @@
 * information regarding copyright ownership.
 */

-controls { /* empty */ };
-
 options {
 	query-source address 10.53.0.1;
-	notify-source 10.53.0.1;
-	transfer-source 10.53.0.1;
 	port @PORT@;
 	pid-file "named.pid";
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
-	allow-transfer { any; };
-	heartbeat-interval 1;
-	recursion no;
-	dnssec-validation no;
-};
-
-zone "." {
-	type primary;
-	file "root.db";
-};
-
-zone "example." {
-	type primary;
-	notify explicit;
-	also-notify { 10.53.0.2; };
-	dialup yes;
-	file "example.db";
 };
--- a/Show More
+++ b/Show More