set "multi-master" automatically with multiple primaries

By default, named logs a message at level info if a secondary zone receives an update indicating that the serial number has gone backwards. The "multi-master" option was provided to allow this message to be suppressed if a zone was configured with multiple primary servers. That option has now been marked obsolete. The message is now logged at debug level 1 when there are multiple primary server addresses configured for the zone. It is still logged at level info if there is only address.
2024-12-11 11:15:04 -08:00
721 changed files with 9634 additions and 16767 deletions
@@ -96,7 +96,6 @@ doc/man/pkcs11-tokens.8in
 /GPATH
 /GRTAGS
 /GTAGS
-TAGS
 # Emacs specific files
 \.dir-locals-2.el
 /emacs.desktop
@@ -51,10 +51,11 @@ variables:
  # cross-testrun files as there is no need to use that feature in CI.
  PYTEST_ADDOPTS: "-p no:cacheprovider"

-  HYPOTHESIS_PROFILE: "ci"
+  # Default platforms to run "stress" tests on
+  BIND_STRESS_TEST_OS: linux
+  BIND_STRESS_TEST_ARCH: amd64

-  # Some jobs may clean up the build artifacts unless this is set to 0.
-  CLEAN_BUILD_ARTIFACTS_ON_SUCCESS: 1
+  HYPOTHESIS_PROFILE: "ci"

 default:
  # Allow all running CI jobs to be automatically canceled when a new
@@ -376,7 +377,6 @@ stages:
    - >
      "$PYTEST" --junit-xml="$CI_PROJECT_DIR"/junit.xml -n "$TEST_PARALLEL_JOBS" | tee pytest.out.txt
    - '( ! grep -F "grep: warning:" pytest.out.txt )'
-    - test "$CLEAN_BUILD_ARTIFACTS_ON_SUCCESS" -eq 0 || ( cd ../../.. && make clean >/dev/null 2>&1 )
  after_script:
    - test -n "${OUT_OF_TREE_WORKSPACE}" && cd "${OUT_OF_TREE_WORKSPACE}"
    - *display_pytest_failures
@@ -431,7 +431,6 @@ stages:
    - test -n "${OUT_OF_TREE_WORKSPACE}" && cd "${OUT_OF_TREE_WORKSPACE}"
  script:
    - make -j${TEST_PARALLEL_JOBS:-1} -k unit V=1
-    - test "$CLEAN_BUILD_ARTIFACTS_ON_SUCCESS" -eq 0 || make clean >/dev/null 2>&1
  after_script:
    - test -d bind-* && cd bind-*
    - REALSOURCEDIR="$PWD"
@@ -468,12 +467,10 @@ stages:
      junit: junit.xml

 .docs: &docs_job
-  variables:
-    DOC_MAKE_TARGET: doc
  stage: docs
  script:
    - *configure
-    - make -j${BUILD_PARALLEL_JOBS:-1} -k ${DOC_MAKE_TARGET} V=1
+    - make -j${BUILD_PARALLEL_JOBS:-1} -k doc V=1
    - find doc/man/ -maxdepth 1 -name "*.[0-9]" -exec mandoc -T lint "{}" \; | ( ! grep -v -e "skipping paragraph macro. sp after" -e "unknown font, skipping request. ft C" -e "input text line longer than 80 bytes" )

 .respdiff: &respdiff_job
@@ -567,29 +564,21 @@ clang-format:
    when: on_failure

 coccinelle:
-  ######################################################################
-  # Revert to using the "precheck_job" anchor after the "base" image is
-  # upgraded to Debian trixie, which has Coccinelle 1.2.
-  <<: *default_triggering_rules
-  <<: *debian_sid_amd64_image
-  stage: precheck
-  ######################################################################
+  <<: *precheck_job
  needs: []
  script:
    - util/check-cocci
    - if test "$(git status --porcelain | grep -Ev '\?\?' | wc -l)" -gt "0"; then git status --short; exit 1; fi

 pylint:
-  <<: *default_triggering_rules
-  <<: *debian_sid_amd64_image
-  stage: precheck
+  <<: *precheck_job
  needs: []
  variables:
    PYTHONPATH: "${CI_PROJECT_DIR}/bin/tests/system"
  script:
    - pylint --rcfile $CI_PROJECT_DIR/.pylintrc $(git ls-files '*.py' | grep -vE '(ans\.py|dangerfile\.py|^bin/tests/system/|^contrib/)')
      # Ignore Pylint wrong-import-position error in system test to enable use of pytest.importorskip
-    - pylint --rcfile $CI_PROJECT_DIR/.pylintrc --disable=wrong-import-position $(git ls-files 'bin/tests/system/*.py' | grep -vE '(ans\.py|vulture_ignore_list\.py)')
+    - pylint --rcfile $CI_PROJECT_DIR/.pylintrc --disable=wrong-import-position $(git ls-files 'bin/tests/system/*.py' | grep -vE 'ans\.py')

 reuse:
  <<: *precheck_job
@@ -615,6 +604,11 @@ shfmt:

 danger:
  <<: *precheck_job
+  # Keep the GIT_DEPTH environment variable set to a "high number" before
+  # https://github.com/libgit2/libgit2/pull/6662 is addressed and integrated
+  # into pygit2.
+  variables:
+    GIT_DEPTH: 1000
  needs: []
  script:
    - pip install git+https://gitlab.isc.org/isc-projects/hazard.git
@@ -630,9 +624,7 @@ checkbashisms:
    - checkbashisms $(find . -path './.git' -prune -o -type f -exec sh -c 'head -n 1 "{}" | grep -qsF "#!/bin/sh"' \; -print)

 mypy:
-  <<: *default_triggering_rules
-  <<: *debian_sid_amd64_image
-  stage: precheck
+  <<: *precheck_job
  script:
    - mypy "bin/tests/system/isctest/"

@@ -669,33 +661,18 @@ changelog:
    GIT_AUTHOR_EMAIL: $GITLAB_USER_EMAIL
    GIT_COMMITTER_NAME: $GITLAB_USER_NAME
    GIT_COMMITTER_EMAIL: $GITLAB_USER_EMAIL
-    DOC_MAKE_TARGET: html
  before_script:
    - echo -e "$CI_MERGE_REQUEST_TITLE\n" > commitmsg
    - sed -i 's/^Draft:\s*//' commitmsg
    - echo -e "$CI_MERGE_REQUEST_DESCRIPTION" >> commitmsg
    - git commit --allow-empty -F commitmsg
-    - ./contrib/gitchangelog/gitchangelog.py HEAD^..HEAD >> $(ls doc/changelog/changelog-9.* | sort --version-sort | tail -n 1)
-  after_script:
-    - git diff
+    - ./contrib/gitchangelog/gitchangelog.py HEAD^..HEAD
  needs:
    - job: autoreconf
      artifacts: true
  artifacts:
    untracked: true

-linkcheck:
-  <<: *base_image
-  stage: docs
-  script:
-    - pushd doc/arm/ > /dev/null && sphinx-build -b linkcheck . linkcheck_output/
-  artifacts:
-    paths:
-      - doc/arm/linkcheck_output/
-  rules:
-    - if: '$CI_PIPELINE_SOURCE == "schedule"'
-  needs: []
-
 docs:
  <<: *default_triggering_rules
  <<: *base_image
@@ -767,6 +744,18 @@ cross-version-config-tests:
    untracked: true
    expire_in: "1 day"
    when: always
+  # Changes in the January milestone necessitate allowing this job to fail. The
+  # "soft failure" should be reverted when January releases are published.
+  # - #4261 introduced extra artifacts check but missed a file visible only in
+  #   this job. This is fixed in !9815 but present in December releases.
+  #   System test affected: mkeys.
+  # - #4666 removed the "fixed" value for the "rrset-order" option, but the
+  #   value is still present in the December release system test.
+  #   System test affected: rrsetorder.
+  # - #4482 removed the "dnssec-must-be-secure" feature that is still present
+  #   in the December release.
+  #   System tests affected: autosign, dnssec, and dsdigest.
+  allow_failure: true

 # Jobs for regular GCC builds on Alpine Linux 3.21 (amd64)

@@ -913,8 +902,7 @@ gcc:bookworm:amd64:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} --coverage -O0"
-    # Tracing needs to be disabled otherwise gcovr fails
-    EXTRA_CONFIGURE: "--with-libidn2 ${WITH_READLINE_LIBEDIT} --disable-tracing"
+    EXTRA_CONFIGURE: "--with-libidn2 ${WITH_READLINE_LIBEDIT}"
    RUN_MAKE_INSTALL: 1
  <<: *debian_bookworm_amd64_image
  <<: *build_job
@@ -924,9 +912,8 @@ system:gcc:bookworm:amd64:
  <<: *system_test_gcov_job
  variables:
    CI_ENABLE_ALL_TESTS: 1
-    CLEAN_BUILD_ARTIFACTS_ON_SUCCESS: 0
    TZ: Australia/Sydney
-  needs:  # using artifacts from unit test job is required for gcov
+  needs:
    - job: unit:gcc:bookworm:amd64
      artifacts: true

@@ -935,7 +922,6 @@ unit:gcc:bookworm:amd64:
  <<: *unit_test_gcov_job
  variables:
    CI_ENABLE_ALL_TESTS: 1
-    CLEAN_BUILD_ARTIFACTS_ON_SUCCESS: 0
  needs:
    - job: gcc:bookworm:amd64
      artifacts: true
@@ -954,7 +940,7 @@ system:gcc:bookworm:rbt:amd64:
  <<: *debian_bookworm_amd64_image
  <<: *system_test_job
  needs:
-    - job: gcc:bookworm:rbt:amd64
+    - job: unit:gcc:bookworm:rbt:amd64
      artifacts: true

 unit:gcc:bookworm:rbt:amd64:
@@ -1036,12 +1022,13 @@ unit:gcc:ossl3:amd64:
      artifacts: true

 # Jobs for regular GCC builds on Debian "sid" (amd64)
+# Also tests configration option: --without-lmdb.

 gcc:sid:amd64:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -O3"
-    EXTRA_CONFIGURE: "--with-libidn2 ${WITH_READLINE}"
+    EXTRA_CONFIGURE: "--with-libidn2 --without-lmdb ${WITH_READLINE}"
    RUN_MAKE_INSTALL: 1
  <<: *debian_sid_amd64_image
  <<: *build_job
@@ -1062,13 +1049,14 @@ unit:gcc:sid:amd64:
      artifacts: true

 # Job for out-of-tree GCC build on Debian 12 "bookworm" (amd64)
+# Also tests configration option: --with-lmdb.

 gcc:out-of-tree:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -Og"
    CONFIGURE: "${CI_PROJECT_DIR}/configure"
-    EXTRA_CONFIGURE: "--with-libidn2"
+    EXTRA_CONFIGURE: "--with-libidn2 --with-lmdb"
    RUN_MAKE_INSTALL: 1
    OUT_OF_TREE_WORKSPACE: workspace
  <<: *base_image
@@ -1266,8 +1254,6 @@ clang:asan:
  <<: *build_job

 system:clang:asan:
-  variables:
-    LSAN_OPTIONS: "suppressions=$CI_PROJECT_DIR/suppr-lsan.txt"
  <<: *base_image
  <<: *system_test_job
  needs:
@@ -1603,10 +1589,9 @@ respdiff:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -Og -DISC_TRACK_PTHREADS_OBJECTS"
-    MAX_DISAGREEMENTS_PERCENTAGE: "0.15"
+    MAX_DISAGREEMENTS_PERCENTAGE: "0.5"
  script:
    - bash respdiff.sh -m /usr/lib/x86_64-linux-gnu/libjemalloc.so.2 -s named -q "${PWD}/100k_mixed.txt" -c 3 -w "${PWD}/rspworkdir" "${CI_PROJECT_DIR}" "/usr/local/respdiff-reference-bind/sbin/named"
-    - cd ../.. && make clean >/dev/null 2>&1

 respdiff:asan:
  <<: *respdiff_job
@@ -1617,10 +1602,9 @@ respdiff:asan:
    CFLAGS: "${CFLAGS_COMMON} -Og -fsanitize=address,undefined"
    LDFLAGS: "-fsanitize=address,undefined"
    EXTRA_CONFIGURE: "--without-jemalloc"
-    MAX_DISAGREEMENTS_PERCENTAGE: "0.15"
+    MAX_DISAGREEMENTS_PERCENTAGE: "0.5"
  script:
    - bash respdiff.sh -s named -q "${PWD}/100k_mixed.txt" -c 3 -w "${PWD}/rspworkdir" "${CI_PROJECT_DIR}" "/usr/local/respdiff-reference-bind/sbin/named"
-    - cd ../.. && make clean >/dev/null 2>&1

 respdiff:tsan:
  <<: *respdiff_job
@@ -1631,11 +1615,10 @@ respdiff:tsan:
    CFLAGS: "${CFLAGS_COMMON} -Og -fsanitize=thread"
    LDFLAGS: "-fsanitize=thread"
    EXTRA_CONFIGURE: "--enable-pthread-rwlock --without-jemalloc PKG_CONFIG_PATH=/opt/tsan/lib/pkgconfig"
-    MAX_DISAGREEMENTS_PERCENTAGE: "0.15"
+    MAX_DISAGREEMENTS_PERCENTAGE: "0.5"
    TSAN_OPTIONS: "${TSAN_OPTIONS_DEBIAN}"
  script:
    - bash respdiff.sh -s named -q "${PWD}/100k_mixed.txt" -c 3 -w "${PWD}/rspworkdir" "${CI_PROJECT_DIR}" "/usr/local/respdiff-reference-bind/sbin/named"
-    - cd ../.. && make clean >/dev/null 2>&1
  after_script:
    - *find_python
    - *parse_tsan
@@ -1647,10 +1630,9 @@ respdiff-third-party:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -Og"
-    MAX_DISAGREEMENTS_PERCENTAGE: "0.2"
+    MAX_DISAGREEMENTS_PERCENTAGE: "0.5"
  script:
    - bash respdiff.sh -s third_party -q "${PWD}/100k_mixed.txt" -c 1 -w "${PWD}/rspworkdir" "${CI_PROJECT_DIR}"
-    - cd ../.. && make clean >/dev/null 2>&1

 # Performance tests

@@ -1679,39 +1661,281 @@ shotgun:dot:
  when: delayed
  start_in: 5 minutes

-shotgun:doh-get:
-  <<: *shotgun_job
-  variables:
-    SHOTGUN_SCENARIO: doh-get
-    SHOTGUN_TRAFFIC_MULTIPLIER: 3
-  when: delayed
-  start_in: 5 minutes
-
 .stress-test: &stress_test
  stage: performance
-
-generate-stress-test-configs:
-  <<: *base_image
-  <<: *default_triggering_rules
-  stage: precheck
  script:
-    - util/generate-stress-test-configs.py > stress-test-configs.yml
-  artifacts:
-    paths:
-      - stress-test-configs.yml
-  needs: []
-
-stress-test-child-pipeline:
-  <<: *default_triggering_rules
-  stage: performance
-  trigger:
-    include:
-      - artifact: stress-test-configs.yml
-        job: generate-stress-test-configs
+    - *configure
+    - *setup_interfaces
+    - make -j${BUILD_PARALLEL_JOBS:-1} -k all V=1
+    - make DESTDIR="${INSTALL_PATH}" install
+    - git clone --depth 1 https://gitlab.isc.org/isc-projects/bind9-qa.git
+    - cd bind9-qa/stress
+    - LD_LIBRARY_PATH="${INSTALL_PATH}/usr/local/lib" BIND_INSTALL_PATH="${INSTALL_PATH}/usr/local" WORKSPACE="${CI_PROJECT_DIR}" bash stress.sh
  needs:
-    - job: generate-stress-test-configs
+    - job: autoreconf
      artifacts: true

+.stress-test-long: &stress_test_long_job
+  <<: *stress_test
+  artifacts:
+    untracked: true
+    exclude:
+      - "output/ns4/*.dtq*"
+      - "output/ns4/large-delta-rpz*.local"
+      - "output/rpz_*"
+    expire_in: "1 week"
+    when: always
+  timeout: 2h
+
+.stress-test-short: &stress_test_short_job
+  <<: *stress_test
+  only:
+    - merge_requests
+  artifacts:
+    untracked: true
+    exclude:
+      - "output/ns4/*.dtq*"
+      - "output/ns4/large-delta-rpz*.local"
+      - "output/rpz_*"
+    when: always
+
+stress:short:authoritative:fedora:41:amd64:
+  <<: *fedora_41_amd64_image
+  <<: *linux_amd64
+  <<: *stress_test_short_job
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    FLAME: /usr/bin/flame
+    MODE: authoritative
+    RATE: 10000
+    RUN_TIME: 15
+
+stress:short:recursive:fedora:41:amd64:
+  <<: *fedora_41_amd64_image
+  <<: *linux_amd64
+  <<: *stress_test_short_job
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    FLAME: /usr/bin/flame
+    MODE: recursive
+    RATE: 10000
+    RUN_TIME: 15
+
+stress:short:rpz:fedora:41:amd64:
+  <<: *fedora_41_amd64_image
+  <<: *linux_amd64
+  <<: *stress_test_short_job
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    FLAME: /usr/bin/flame
+    MODE: rpz
+    RATE: 1500
+    RUN_TIME: 15
+
+stress:short:authoritative:fedora:41:arm64:
+  <<: *fedora_41_arm64_image
+  <<: *linux_arm64
+  <<: *stress_test_short_job
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    FLAME: /usr/bin/flame
+    MODE: authoritative
+    RATE: 10000
+    RUN_TIME: 15
+
+stress:short:recursive:fedora:41:arm64:
+  <<: *fedora_41_arm64_image
+  <<: *linux_arm64
+  <<: *stress_test_short_job
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    FLAME: /usr/bin/flame
+    MODE: recursive
+    RATE: 10000
+    RUN_TIME: 15
+
+stress:short:rpz:fedora:41:arm64:
+  <<: *fedora_41_arm64_image
+  <<: *linux_arm64
+  <<: *stress_test_short_job
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    FLAME: /usr/bin/flame
+    MODE: rpz
+    RATE: 1500
+    RUN_TIME: 15
+
+stress:short:authoritative:freebsd13:amd64:
+  <<: *freebsd_stress_amd64
+  <<: *stress_test_short_job
+  variables:
+    CC: clang
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    FLAME: /usr/local/bin/flame
+    MODE: authoritative
+    RATE: 10000
+    RUN_TIME: 15
+
+stress:short:recursive:freebsd13:amd64:
+  <<: *freebsd_stress_amd64
+  <<: *stress_test_short_job
+  variables:
+    CC: clang
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    FLAME: /usr/local/bin/flame
+    MODE: recursive
+    RATE: 10000
+    RUN_TIME: 15
+
+stress:short:rpz:freebsd13:amd64:
+  <<: *freebsd_stress_amd64
+  <<: *stress_test_short_job
+  variables:
+    CC: clang
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    FLAME: /usr/local/bin/flame
+    MODE: rpz
+    RATE: 1500
+    RUN_TIME: 15
+
+stress:authoritative:fedora:41:amd64:
+  <<: *fedora_41_amd64_image
+  <<: *linux_amd64
+  <<: *stress_test_long_job
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    FLAME: /usr/bin/flame
+    MODE: authoritative
+    RATE: 10000
+    RUN_TIME: 60
+  only:
+    variables:
+      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /authoritative/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)
+
+stress:recursive:fedora:41:amd64:
+  <<: *fedora_41_amd64_image
+  <<: *linux_amd64
+  <<: *stress_test_long_job
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    FLAME: /usr/bin/flame
+    MODE: recursive
+    RATE: 10000
+    RUN_TIME: 60
+  only:
+    variables:
+      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /recursive/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)
+
+stress:rpz:fedora:41:amd64:
+  <<: *fedora_41_amd64_image
+  <<: *linux_amd64
+  <<: *stress_test_long_job
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    FLAME: /usr/bin/flame
+    MODE: rpz
+    RATE: 1500
+    RUN_TIME: 60
+  only:
+    variables:
+      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /rpz/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)
+
+stress:authoritative:fedora:41:arm64:
+  <<: *fedora_41_arm64_image
+  <<: *linux_arm64
+  <<: *stress_test_long_job
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    FLAME: /usr/bin/flame
+    MODE: authoritative
+    RATE: 10000
+    RUN_TIME: 60
+  only:
+    variables:
+      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /authoritative/i && $BIND_STRESS_TEST_ARCH =~ /arm64/i)
+
+stress:recursive:fedora:41:arm64:
+  <<: *fedora_41_arm64_image
+  <<: *linux_arm64
+  <<: *stress_test_long_job
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    FLAME: /usr/bin/flame
+    MODE: recursive
+    RATE: 10000
+    RUN_TIME: 60
+  only:
+    variables:
+      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /recursive/i && $BIND_STRESS_TEST_ARCH =~ /arm64/i)
+
+stress:rpz:fedora:41:arm64:
+  <<: *fedora_41_arm64_image
+  <<: *linux_arm64
+  <<: *stress_test_long_job
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    FLAME: /usr/bin/flame
+    MODE: rpz
+    RATE: 1500
+    RUN_TIME: 60
+  only:
+    variables:
+      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /rpz/i && $BIND_STRESS_TEST_ARCH =~ /arm64/i)
+
+stress:authoritative:freebsd13:amd64:
+  <<: *freebsd_stress_amd64
+  <<: *stress_test_long_job
+  variables:
+    CC: clang
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    FLAME: /usr/local/bin/flame
+    MODE: authoritative
+    RATE: 10000
+    RUN_TIME: 60
+  only:
+    variables:
+      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /freebsd/i && $BIND_STRESS_TEST_MODE =~ /authoritative/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)
+
+stress:recursive:freebsd13:amd64:
+  <<: *freebsd_stress_amd64
+  <<: *stress_test_long_job
+  variables:
+    CC: clang
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    FLAME: /usr/local/bin/flame
+    MODE: recursive
+    RATE: 10000
+    RUN_TIME: 60
+  only:
+    variables:
+      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /freebsd/i && $BIND_STRESS_TEST_MODE =~ /recursive/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)
+
+stress:rpz:freebsd13:amd64:
+  <<: *freebsd_stress_amd64
+  <<: *stress_test_long_job
+  variables:
+    CC: clang
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    FLAME: /usr/local/bin/flame
+    MODE: rpz
+    RATE: 1500
+    RUN_TIME: 60
+  only:
+    variables:
+      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /freebsd/i && $BIND_STRESS_TEST_MODE =~ /rpz/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)
+
 # git fsck operates over the whole repository and is sufficient to schedule it
 # only in one branch, preferably "main". GitLab's clone strategy prevents us
 # from using the "bind9" repo clone; we need to clone it ourselves.
@@ -1802,10 +2026,10 @@ pairwise:
    - set +o pipefail; git log --format='%H' | grep --silent "$CI_COMMIT_BEFORE_SHA" && PREVIOUS_TIP_REACHABLE=1
    - test "$PREVIOUS_TIP_REACHABLE" != "1" && echo "force-push detected, stop" && exit 1
    # non-fast-forward merges are disabled so we have to have merge commit on top
-    - MERGE_REQUEST_ID="$(git log -1 --format='%b' | sed --silent -e "s|^See merge request ${CI_PROJECT_PATH}\!||p")"
+    - MERGE_REQUEST_ID="$(git log -1 --format='%b' | sed --silent -e 's/^See merge request [^!]\+!//p')"
    - >
-      : stop if this is not a merge request in the current project\'s namespace
-    - test -n "$MERGE_REQUEST_ID"
+      : stop if this is not a merge request
+    - test "$MERGE_REQUEST_ID" -ge 0
    - git clone --depth 1 https://gitlab.isc.org/isc-projects/bind9-qa.git

 backports:
@@ -1821,6 +2045,6 @@ backports:
 merged-metadata:
  <<: *post_merge
  rules:
-    - if: '$CI_PIPELINE_SOURCE == "push" && ($CI_COMMIT_REF_NAME =~ /^bind-9.[0-9]+(-sub)?$/ || $CI_COMMIT_REF_NAME =~ /^v9.[0-9]+.[0-9]+-release$/ || $CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH)'
+    - if: '$CI_PIPELINE_SOURCE == "push" && ($CI_COMMIT_REF_NAME =~ /^bind-9.[0-9]+(-sub)?$/ || $CI_COMMIT_REF_NAME =~ /^bind-9.[0-9]+.[0-9]+-release$/ || $CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH)'
  script:
    - bind9-qa/releng/after_merge.py "$CI_PROJECT_ID" "$MERGE_REQUEST_ID"
@@ -31,11 +31,11 @@ confidential!
  - [ ] [:link:][step_deputy]            **(IM)** Pick a Deputy Incident Manager
  - [ ] [:link:][step_respond]           **(IM)** Respond to the bug reporter
  - [ ] [:link:][step_public_mrs]        **(SwEng)** Ensure there are no public merge requests which inadvertently disclose the issue
-  - [ ] [:link:][step_coordinate_cve_id] **(SwEng)** Check if we need to coordinate with other vendors (an industry-wide CVE identifier might be necessary)
  - [ ] [:link:][step_assign_cve_id]     **(IM)** Assign a CVE identifier
-  - [ ] [:link:][step_note_cve_info]     **(SwEng)** Update this issue with the assigned CVE identifier, the CVSS score, and the CWE category
+  - [ ] [:link:][step_note_cve_info]     **(SwEng)** Update this issue with the assigned CVE identifier, the CVSS score, and CWE category
  - [ ] [:link:][step_versions_affected] **(SwEng)** Determine the range of product versions affected (including the Subscription Edition)
  - [ ] [:link:][step_workarounds]       **(SwEng)** Determine whether workarounds for the problem exist
+  - [ ] [:link:][step_coordinate]        **(SwEng)** If necessary, coordinate with other parties
  - [ ] [:link:][step_earliest_prepare]  **(Support)** Prepare "earliest" notification text
  - [ ] [:link:][step_earliest_send]     **(Support)** Update "earliest" notification ticket in support portal Earliest queue which will notify earliest customers
  - [ ] [:link:][step_advisory_mr]       **(Support)** Create a merge request for the Security Advisory and include all readily available information in it
@@ -48,7 +48,6 @@ confidential!
  - [ ] [:link:][step_backports]         **(SwEng)** Prepare backports of the merge request addressing the problem for all affected (and still maintained) branches of a given product
  - [ ] [:link:][step_finish_advisory]   **(Support)** Finish preparing the Security Advisory
  - [ ] [:link:][step_meta_issue]        **(QA)** Create (or update) the private issue containing links to fixes & reproducers for all CVEs fixed in a given release cycle
-  - [ ] [:link:][step_coordinate_check]  **(SwEng)** Make sure other vendors are able to release on the date that was previously agreed upon
  - [ ] [:link:][step_merge_fixes]       **(QA)** Merge the CVE fixes in CVE identifier order
  - [ ] [:link:][step_patches]           **(QA)** Prepare a standalone patch for the last stable release of each affected (and still maintained) product branch
  - [ ] [:link:][step_asn_releases]      **(QA)** Prepare ASN releases (as outlined in the Release Checklist)
@@ -69,16 +68,15 @@ confidential!
 ### On the Day of Public Disclosure

  - [ ] [:link:][step_clearance]         **(IM)** Grant QA & Marketing clearance to proceed with public release
-  - [ ] [:link:][step_matrix]            **(Support)** (BIND 9 only) Add the new CVEs to the vulnerability matrix in the Knowledge Base
-  - [ ] [:link:][step_bump_advisory]     **(Support)** Bump Document Version for the Security Advisory in Printing Press
-  - [ ] [:link:][step_publish_advisory]  **(Support)** Publish the Security Advisory in the Knowledge Base
  - [ ] [:link:][step_publish]           **(QA/Marketing)** Publish the releases (as outlined in the release checklist)
+  - [ ] [:link:][step_matrix]            **(Support)** (BIND 9 only) Add the new CVEs to the vulnerability matrix in the Knowledge Base
+  - [ ] [:link:][step_publish_advisory]  **(Support)** Bump Document Version for the Security Advisory and publish it in the Knowledge Base
  - [ ] [:link:][step_notifications]     **(First IM)** Send notification emails to third parties
  - [ ] [:link:][step_mitre]             **(First IM)** Advise MITRE about the disclosed CVEs
  - [ ] [:link:][step_merge_advisory]    **(First IM)** Merge the Security Advisory merge request
  - [ ] [:link:][step_embargo_end]       **(IM)** Inform original reporter (if external) that the security disclosure process is complete
  - [ ] [:link:][step_asn_clear]         **(Support)** Update the tickets in the ASN queues in RT that the embargo is lifted
-  - [ ] [:link:][step_customers]         **(Marketing)** Open a ticket in the appropriate announce queue in RT that the release is published
+  - [ ] [:link:][step_customers]         **(Marketing)** Open a ticket in the <software name> Announce queue that the release is published

 ### After Public Disclosure

@@ -87,13 +85,13 @@ confidential!
 [step_deputy]:            https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#pick-a-deputy-incident-manager
 [step_respond]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#respond-to-the-bug-reporter
 [step_public_mrs]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#ensure-there-are-no-public-merge-requests-which-inadvertently-disclose-the-issue
-[step_coordinate_cve_id]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#check-if-we-need-to-coordinate-with-other-vendors-an-industry-wide-cve-identifier-might-be-necessary
 [step_assign_cve_id]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#assign-a-cve-identifier
 [step_note_cve_info]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-this-issue-with-the-assigned-cve-identifier-the-cvss-score-and-the-cwe-category
 [step_versions_affected]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#determine-the-range-of-product-versions-affected-including-the-subscription-edition
 [step_workarounds]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#determine-whether-workarounds-for-the-problem-exist
-[step_earliest_prepare]:  https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-earliest-notification-text
-[step_earliest_send]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-earliest-notification-ticket-in-support-portal-earliest-queue-which-will-notify-earliest-customers
+[step_coordinate]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#if-necessary-coordinate-with-other-parties
+[step_earliest_prepare]:  https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-earliest-notification-text-and-hand-it-off-to-marketing
+[step_earliest_send]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-earliest-notification-document-in-sf-portal-and-send-bulk-email-to-earliest-customers
 [step_advisory_mr]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#create-a-merge-request-for-the-security-advisory-and-include-all-readily-available-information-in-it
 [step_reproducer_mr]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-a-private-merge-request-containing-a-system-test-reproducing-the-problem
 [step_notify_support]:    https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#notify-support-when-a-reproducer-is-ready
@@ -104,26 +102,25 @@ confidential!
 [step_backports]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-backports-of-the-merge-request-addressing-the-problem-for-all-affected-and-still-maintained-branches-of-a-given-product
 [step_finish_advisory]:   https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#finish-preparing-the-security-advisory
 [step_meta_issue]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#create-or-update-the-private-issue-containing-links-to-fixes-reproducers-for-all-cves-fixed-in-a-given-release-cycle
-[step_coordinate_check]:  https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#make-sure-other-vendors-are-able-to-release-on-the-date-that-was-previously-agreed-upon
+[step_changes]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-reserve-a-block-of-changes-placeholders-once-the-complete-set-of-vulnerabilities-fixed-in-a-given-release-cycle-is-determined
 [step_merge_fixes]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#merge-the-cve-fixes-in-cve-identifier-order
 [step_patches]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-a-standalone-patch-for-the-last-stable-release-of-each-affected-and-still-maintained-product-branch
 [step_asn_releases]:      https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-asn-releases-as-outlined-in-the-release-checklist
-[step_asn_links]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-update-the-bind-s-information-document-in-the-support-portal-with-download-links-to-the-new-versions
-[step_asn_send]:          https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#notify-eligible-customers-by-adding-a-ticket-to-the-5-day-queue-in-rt-with-the-text-of-the-advisory-earliest-and-t-5
+[step_asn_documents]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-the-text-on-the-t-5-from-the-printing-press-project-and-earliest-asn-documents-in-the-sf-portal
+[step_asn_links]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-update-the-bind-s-information-document-in-sf-with-download-links-to-the-new-versions
+[step_asn_send]:          https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bulk-email-eligible-customers-to-check-the-sf-portal
 [step_preannouncement]:   https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-send-a-pre-announcement-email-to-the-bind-announce-mailing-list-to-alert-users-that-the-upcoming-release-will-include-security-fixes
-[step_asn_send]:          https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#notify-eligible-customers-by-adding-a-ticket-to-the-3-day-queue-in-rt-with-the-text-of-the-advisory-t-3
 [step_packager_emails]:   https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#send-notifications-to-os-packagers
 [step_clearance]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#grant-qa-marketing-clearance-to-proceed-with-public-release
-[step_matrix]:            https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-add-the-new-cves-to-the-vulnerability-matrix-in-the-knowledge-base
-[step_bump_advisory]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bump-document-version-for-the-security-advisory-in-printing-press
-[step_publish_advisory]:  https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#publish-the-security-advisory-in-the-knowledge-base
 [step_publish]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#publish-the-releases-as-outlined-in-the-release-checklist
+[step_matrix]:            https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-add-the-new-cves-to-the-vulnerability-matrix-in-the-knowledge-base
+[step_publish_advisory]:  https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bump-document-version-for-the-security-advisory-and-publish-it-in-the-knowledge-base
 [step_notifications]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#send-notification-emails-to-third-parties
 [step_mitre]:             https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#advise-mitre-about-the-disclosed-cves
 [step_merge_advisory]:    https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#merge-the-security-advisory-merge-request
 [step_embargo_end]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#inform-original-reporter-if-external-that-the-security-disclosure-process-is-complete
-[step_asn_clear]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-the-tickets-in-the-asn-queues-in-rt-that-the-embargo-is-lifted
-[step_customers]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#open-a-ticket-in-the-appropriate-announce-queue-in-rt-that-the-release-is-published
+[step_asn_clear]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-the-sf-portal-to-clear-the-asn
+[step_customers]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#email-asn-recipients-that-the-embargo-is-lifted
 [step_regression]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#merge-a-regression-test-reproducing-the-bug-into-all-affected-and-still-maintained-branches

 /confidential
@@ -11,7 +11,7 @@ See the COPYRIGHT file distributed with this work for additional
 information regarding copyright ownership.
 -->
 ## BIND 9 Source Access and Contributor Guidelines
-*Nov 26, 2024*
+*May 28, 2020*

 ### Contents

@@ -72,13 +72,13 @@ To clone the repository, use:
 >       $ git clone https://gitlab.isc.org/isc-projects/bind9.git

 Release branch names are of the form `bind-9.X`, where X represents the second
-number in the BIND 9 version number.  So, to check out the BIND 9.20
+number in the BIND 9 version number.  So, to check out the BIND 9.18
 branch, use:

->       $ git checkout bind-9.20
+>       $ git checkout bind-9.18

 Whenever a branch is ready for publication, a tag is placed of the
-form `v9.X.Y`.  The 9.20.0 release, for instance, is tagged as `v9.20.0`.
+form `v9.X.Y`.  The 9.18.0 release, for instance, is tagged as `v9.18.0`.

 The branch in which the next major release is being developed is called
 `main`.
@@ -121,9 +121,8 @@ patch will be applied.
 #### <a name="bind"></a>BIND code

 Patches for BIND may be submitted directly via merge requests in
-[ISC's GitLab](https://gitlab.isc.org/isc-projects/bind9/) source repository for
-BIND. Please contact ISC and provide your GitLab username in order to be allowed
-to fork the project and submit merge requests.
+[ISC's GitLab](https://gitlab.isc.org/isc-projects/bind9/) source
+repository for BIND.

 Patches can also be submitted as diffs against a specific version of
 BIND -- preferably the current top of the `main` branch.  Diffs may
@@ -145,8 +144,8 @@ we're busy with other work, it may take us a long time to get to it.
 To ensure your patch is acted on as promptly as possible, please:

 * Try to adhere to the [BIND 9 coding style](doc/dev/style.md).
-* Run unit and system tests to ensure your change hasn't caused any
-  functional regressions (these can be checked in the CI pipeline).
+* Run `make check` to ensure your change hasn't caused any
+  functional regressions.
 * Document your work, both in the patch itself and in the
  accompanying email.
 * In patches that make non-trivial functional changes, include system
@@ -157,12 +156,12 @@ To ensure your patch is acted on as promptly as possible, please:
 ##### Changes to `configure`

 If you need to make changes to `configure`, you should not edit it
-directly; instead, edit `configure.ac`, then run `autoconf`.  Similarly,
-instead of editing `config.h.in` directly, edit `configure.ac` and run
+directly; instead, edit `configure.in`, then run `autoconf`.  Similarly,
+instead of editing `config.h.in` directly, edit `configure.in` and run
 `autoheader`.

 When submitting a patch as a diff, it's fine to omit the `configure`
-diffs to save space.  Just send the `configure.ac` diffs and we'll
+diffs to save space.  Just send the `configure.in` diffs and we'll
 generate the new `configure` during the review process.

 ##### Documentation
@@ -112,7 +112,11 @@ add(char *key, int value) {
 	}

 	if (symtab == NULL) {
-		isc_symtab_create(sym_mctx, freekey, sym_mctx, false, &symtab);
+		result = isc_symtab_create(sym_mctx, 100, freekey, sym_mctx,
+					   false, &symtab);
+		if (result != ISC_R_SUCCESS) {
+			return;
+		}
 	}

 	key = isc_mem_strdup(sym_mctx, key);
@@ -140,97 +144,12 @@ logged(char *key, int value) {
 	return false;
 }

-static bool
-checkisservedby(dns_zone_t *zone, dns_rdatatype_t type,
-		const dns_name_t *name) {
-	char namebuf[DNS_NAME_FORMATSIZE + 1];
-	char ownerbuf[DNS_NAME_FORMATSIZE + 1];
-	/*
-	 * Not all getaddrinfo implementations distinguish NODATA
-	 * from NXDOMAIN with PF_INET6 so use PF_UNSPEC and look at
-	 * the returned ai_family values.
-	 */
-	struct addrinfo hints = {
-		.ai_flags = AI_CANONNAME,
-		.ai_family = PF_UNSPEC,
-		.ai_socktype = SOCK_STREAM,
-		.ai_protocol = IPPROTO_TCP,
-	};
-	struct addrinfo *ai = NULL, *cur;
-	bool has_type = false;
-	int eai;
-
-	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
-	/*
-	 * Turn off search.
-	 */
-	if (dns_name_countlabels(name) > 1U) {
-		strlcat(namebuf, ".", sizeof(namebuf));
-	}
-	eai = getaddrinfo(namebuf, NULL, &hints, &ai);
-
-	switch (eai) {
-	case 0:
-		cur = ai;
-		while (cur != NULL) {
-			if (cur->ai_family == AF_INET &&
-			    type == dns_rdatatype_a)
-			{
-				has_type = true;
-				break;
-			}
-			if (cur->ai_family == AF_INET6 &&
-			    type == dns_rdatatype_aaaa)
-			{
-				has_type = true;
-				break;
-			}
-			cur = cur->ai_next;
-		}
-		freeaddrinfo(ai);
-		return has_type;
-#if defined(EAI_NODATA) && (EAI_NODATA != EAI_NONAME)
-	case EAI_NODATA:
-#endif /* if defined(EAI_NODATA) && (EAI_NODATA != EAI_NONAME) */
-	case EAI_NONAME:
-		if (!logged(namebuf, ERR_NO_ADDRESSES)) {
-			dns_name_format(dns_zone_getorigin(zone), ownerbuf,
-					sizeof(ownerbuf));
-			dns_name_format(name, namebuf, sizeof(namebuf) - 1);
-			dns_zone_log(zone, ISC_LOG_ERROR,
-				     "%s/NS '%s' (out of zone) "
-				     "has no addresses records (A or AAAA)",
-				     ownerbuf, namebuf);
-			add(namebuf, ERR_NO_ADDRESSES);
-		}
-		return false;
-	default:
-		if (!logged(namebuf, ERR_LOOKUP_FAILURE)) {
-			dns_name_format(dns_zone_getorigin(zone), ownerbuf,
-					sizeof(ownerbuf));
-			dns_name_format(name, namebuf, sizeof(namebuf) - 1);
-			dns_zone_log(zone, ISC_LOG_WARNING,
-				     "getaddrinfo(%s) failed: %s", namebuf,
-				     gai_strerror(eai));
-			add(namebuf, ERR_LOOKUP_FAILURE);
-		}
-		return true;
-	}
-}
-
 static bool
 checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 	dns_rdataset_t *a, dns_rdataset_t *aaaa) {
 	dns_rdataset_t *rdataset;
 	dns_rdata_t rdata = DNS_RDATA_INIT;
-	isc_result_t result;
-	struct addrinfo hints = {
-		.ai_flags = AI_CANONNAME,
-		.ai_family = PF_UNSPEC,
-		.ai_socktype = SOCK_STREAM,
-		.ai_protocol = IPPROTO_TCP,
-	};
-	struct addrinfo *ai = NULL, *cur;
+	struct addrinfo hints, *ai, *cur;
 	char namebuf[DNS_NAME_FORMATSIZE + 1];
 	char ownerbuf[DNS_NAME_FORMATSIZE];
 	char addrbuf[sizeof("xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:123.123.123.123")];
@@ -238,7 +157,7 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 	bool match;
 	const char *type;
 	void *ptr = NULL;
-	int eai;
+	int result;

 	REQUIRE(a == NULL || !dns_rdataset_isassociated(a) ||
 		a->type == dns_rdatatype_a);
@@ -249,6 +168,12 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 		return answer;
 	}

+	memset(&hints, 0, sizeof(hints));
+	hints.ai_flags = AI_CANONNAME;
+	hints.ai_family = PF_UNSPEC;
+	hints.ai_socktype = SOCK_STREAM;
+	hints.ai_protocol = IPPROTO_TCP;
+
 	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
 	/*
 	 * Turn off search.
@@ -258,9 +183,9 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 	}
 	dns_name_format(owner, ownerbuf, sizeof(ownerbuf));

-	eai = getaddrinfo(namebuf, NULL, &hints, &ai);
+	result = getaddrinfo(namebuf, NULL, &hints, &ai);
 	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
-	switch (eai) {
+	switch (result) {
 	case 0:
 		/*
 		 * Work around broken getaddrinfo() implementations that
@@ -303,7 +228,7 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 		if (!logged(namebuf, ERR_LOOKUP_FAILURE)) {
 			dns_zone_log(zone, ISC_LOG_WARNING,
 				     "getaddrinfo(%s) failed: %s", namebuf,
-				     gai_strerror(eai));
+				     gai_strerror(result));
 			add(namebuf, ERR_LOOKUP_FAILURE);
 		}
 		return true;
@@ -433,27 +358,25 @@ checkmissing:
 			add(namebuf, ERR_MISSING_GLUE);
 		}
 	}
-	if (ai != NULL) {
-		freeaddrinfo(ai);
-	}
+	freeaddrinfo(ai);
 	return answer;
 }

 static bool
 checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
-	struct addrinfo hints = {
-		.ai_flags = AI_CANONNAME,
-		.ai_family = PF_UNSPEC,
-		.ai_socktype = SOCK_STREAM,
-		.ai_protocol = IPPROTO_TCP,
-	};
-	struct addrinfo *ai = NULL, *cur;
+	struct addrinfo hints, *ai, *cur;
 	char namebuf[DNS_NAME_FORMATSIZE + 1];
 	char ownerbuf[DNS_NAME_FORMATSIZE];
-	int eai;
+	int result;
 	int level = ISC_LOG_ERROR;
 	bool answer = true;

+	memset(&hints, 0, sizeof(hints));
+	hints.ai_flags = AI_CANONNAME;
+	hints.ai_family = PF_UNSPEC;
+	hints.ai_socktype = SOCK_STREAM;
+	hints.ai_protocol = IPPROTO_TCP;
+
 	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
 	/*
 	 * Turn off search.
@@ -463,9 +386,9 @@ checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 	}
 	dns_name_format(owner, ownerbuf, sizeof(ownerbuf));

-	eai = getaddrinfo(namebuf, NULL, &hints, &ai);
+	result = getaddrinfo(namebuf, NULL, &hints, &ai);
 	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
-	switch (eai) {
+	switch (result) {
 	case 0:
 		/*
 		 * Work around broken getaddrinfo() implementations that
@@ -498,9 +421,7 @@ checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 				}
 			}
 		}
-		if (ai != NULL) {
-			freeaddrinfo(ai);
-		}
+		freeaddrinfo(ai);
 		return answer;

 	case EAI_NONAME:
@@ -521,7 +442,7 @@ checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 		if (!logged(namebuf, ERR_LOOKUP_FAILURE)) {
 			dns_zone_log(zone, ISC_LOG_WARNING,
 				     "getaddrinfo(%s) failed: %s", namebuf,
-				     gai_strerror(eai));
+				     gai_strerror(result));
 			add(namebuf, ERR_LOOKUP_FAILURE);
 		}
 		return true;
@@ -530,19 +451,19 @@ checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {

 static bool
 checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
-	struct addrinfo hints = {
-		.ai_flags = AI_CANONNAME,
-		.ai_family = PF_UNSPEC,
-		.ai_socktype = SOCK_STREAM,
-		.ai_protocol = IPPROTO_TCP,
-	};
-	struct addrinfo *ai = NULL, *cur;
+	struct addrinfo hints, *ai, *cur;
 	char namebuf[DNS_NAME_FORMATSIZE + 1];
 	char ownerbuf[DNS_NAME_FORMATSIZE];
-	int eai;
+	int result;
 	int level = ISC_LOG_ERROR;
 	bool answer = true;

+	memset(&hints, 0, sizeof(hints));
+	hints.ai_flags = AI_CANONNAME;
+	hints.ai_family = PF_UNSPEC;
+	hints.ai_socktype = SOCK_STREAM;
+	hints.ai_protocol = IPPROTO_TCP;
+
 	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
 	/*
 	 * Turn off search.
@@ -552,9 +473,9 @@ checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 	}
 	dns_name_format(owner, ownerbuf, sizeof(ownerbuf));

-	eai = getaddrinfo(namebuf, NULL, &hints, &ai);
+	result = getaddrinfo(namebuf, NULL, &hints, &ai);
 	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
-	switch (eai) {
+	switch (result) {
 	case 0:
 		/*
 		 * Work around broken getaddrinfo() implementations that
@@ -587,9 +508,7 @@ checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 				}
 			}
 		}
-		if (ai != NULL) {
-			freeaddrinfo(ai);
-		}
+		freeaddrinfo(ai);
 		return answer;

 	case EAI_NONAME:
@@ -610,7 +529,7 @@ checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 		if (!logged(namebuf, ERR_LOOKUP_FAILURE)) {
 			dns_zone_log(zone, ISC_LOG_WARNING,
 				     "getaddrinfo(%s) failed: %s", namebuf,
-				     gai_strerror(eai));
+				     gai_strerror(result));
 			add(namebuf, ERR_LOOKUP_FAILURE);
 		}
 		return true;
@@ -656,17 +575,17 @@ load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,
 	isc_buffer_add(&buffer, strlen(zonename));
 	origin = dns_fixedname_initname(&fixorigin);
 	CHECK(dns_name_fromtext(origin, &buffer, dns_rootname, 0, NULL));
-	dns_zone_setorigin(zone, origin);
+	CHECK(dns_zone_setorigin(zone, origin));
 	dns_zone_setdbtype(zone, 1, (const char *const *)dbtype);
 	if (strcmp(filename, "-") == 0) {
-		dns_zone_setstream(zone, stdin, fileformat,
-				   &dns_master_style_default);
+		CHECK(dns_zone_setstream(zone, stdin, fileformat,
+					 &dns_master_style_default));
 	} else {
-		dns_zone_setfile(zone, filename, fileformat,
-				 &dns_master_style_default);
+		CHECK(dns_zone_setfile(zone, filename, fileformat,
+				       &dns_master_style_default));
 	}
 	if (journal != NULL) {
-		dns_zone_setjournal(zone, journal);
+		CHECK(dns_zone_setjournal(zone, journal));
 	}

 	region.base = UNCONST(classname);
@@ -684,7 +603,6 @@ load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,
 	}
 	if (docheckns) {
 		dns_zone_setcheckns(zone, checkns);
-		dns_zone_setcheckisservedby(zone, checkisservedby);
 	}
 	if (dochecksrv) {
 		dns_zone_setchecksrv(zone, checksrv);
@@ -18,6 +18,7 @@
 #include <inttypes.h>
 #include <stdbool.h>

+#include <isc/lang.h>
 #include <isc/stdio.h>
 #include <isc/types.h>

@@ -25,6 +26,8 @@
 #include <dns/types.h>
 #include <dns/zone.h>

+ISC_LANG_BEGINDECLS
+
 isc_result_t
 setup_logging(FILE *errout);

@@ -45,3 +48,5 @@ extern bool docheckmx;
 extern bool docheckns;
 extern bool dochecksrv;
 extern dns_zoneopt_t zone_options;
+
+ISC_LANG_ENDDECLS
@@ -22,7 +22,6 @@
 #include <isc/commandline.h>
 #include <isc/dir.h>
 #include <isc/hash.h>
-#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
@@ -31,7 +30,6 @@

 #include <dns/db.h>
 #include <dns/fixedname.h>
-#include <dns/lib.h>
 #include <dns/name.h>
 #include <dns/rdataclass.h>
 #include <dns/rootns.h>
@@ -22,7 +22,6 @@
 #include <isc/dir.h>
 #include <isc/file.h>
 #include <isc/hash.h>
-#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
@@ -32,7 +31,6 @@

 #include <dns/db.h>
 #include <dns/fixedname.h>
-#include <dns/lib.h>
 #include <dns/master.h>
 #include <dns/masterdump.h>
 #include <dns/name.h>
@@ -91,13 +91,9 @@ Options
   (both in-zone and out-of-zone hostnames). Mode ``local`` only
   checks SRV records which refer to in-zone hostnames.

-   Mode ``full`` checks that a zone that has A or AAAA records it is served
-   by a server with the same type of address records.
-
   Mode ``full`` checks that delegation NS records refer to A or AAAA
   records (both in-zone and out-of-zone hostnames). It also checks that
   glue address records in the zone match those advertised by the child.
-
   Mode ``local`` only checks NS records which refer to in-zone
   hostnames or verifies that some required glue exists, i.e., when the
   name server is in a child zone.
@@ -17,6 +17,10 @@

 #include <stdio.h>

+#include <isc/lang.h>
+
+ISC_LANG_BEGINDECLS
+
 int
 set_user(FILE *fd, const char *user);
 /*%<
@@ -25,3 +29,5 @@ set_user(FILE *fd, const char *user);
 *   0 		success
 *   -1 	insufficient permissions, or 'user' does not exist.
 */
+
+ISC_LANG_ENDDECLS
@@ -16,10 +16,13 @@
 /*! \file */

 #include <isc/buffer.h>
+#include <isc/lang.h>
 #include <isc/mem.h>

 #include <dns/secalg.h>

+ISC_LANG_BEGINDECLS
+
 void
 generate_key(isc_mem_t *mctx, dns_secalg_t alg, int keysize,
 	     isc_buffer_t *key_txtbuffer);
@@ -34,3 +37,5 @@ dns_secalg_t
 alg_fromtext(const char *name);
 int
 alg_bits(dns_secalg_t alg);
+
+ISC_LANG_ENDDECLS
@@ -32,7 +32,6 @@
 #include <isc/buffer.h>
 #include <isc/commandline.h>
 #include <isc/file.h>
-#include <isc/lib.h>
 #include <isc/mem.h>
 #include <isc/net.h>
 #include <isc/result.h>
@@ -41,7 +40,6 @@
 #include <isc/util.h>

 #include <dns/keyvalues.h>
-#include <dns/lib.h>
 #include <dns/name.h>

 #include <dst/dst.h>
@@ -28,7 +28,6 @@
 #include <isc/buffer.h>
 #include <isc/commandline.h>
 #include <isc/file.h>
-#include <isc/lib.h>
 #include <isc/mem.h>
 #include <isc/net.h>
 #include <isc/result.h>
@@ -37,7 +36,6 @@
 #include <isc/util.h>

 #include <dns/keyvalues.h>
-#include <dns/lib.h>
 #include <dns/name.h>

 #include <dst/dst.h>
@@ -17,6 +17,7 @@

 #include <isc/attributes.h>
 #include <isc/formatcheck.h>
+#include <isc/lang.h>

 #define NS_CONTROL_PORT 953

@@ -30,8 +31,12 @@
 			notify("%s", name);                               \
 	} while (0)

+ISC_LANG_BEGINDECLS
+
 void
 notify(const char *fmt, ...) ISC_FORMAT_PRINTF(1, 2);

 ISC_NORETURN void
 fatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
+
+ISC_LANG_ENDDECLS
@@ -37,7 +37,6 @@
 #include <isc/buffer.h>
 #include <isc/fips.h>
 #include <isc/hex.h>
-#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/managers.h>
 #include <isc/md.h>
@@ -60,7 +59,6 @@
 #include <dns/fixedname.h>
 #include <dns/keytable.h>
 #include <dns/keyvalues.h>
-#include <dns/lib.h>
 #include <dns/masterdump.h>
 #include <dns/message.h>
 #include <dns/name.h>
@@ -230,6 +228,7 @@ usage(void) {
 		"                 +[no]crypto         (Control display of "
 		"cryptographic\n"
 		"                                      fields in records)\n"
+		"                 +[no]dlv            (Obsolete)\n"
 		"                 +[no]dnssec         (Display DNSSEC "
 		"records)\n"
 		"                 +[no]mtrace         (Trace messages "
@@ -789,7 +788,9 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client, dns_view_t *toview) {
 	num_keys++;

 cleanup:
-	if (result == DST_R_UNSUPPORTEDALG) {
+	if (result == DST_R_NOCRYPTO) {
+		cfg_obj_log(key, ISC_LOG_ERROR, "no crypto support");
+	} else if (result == DST_R_UNSUPPORTEDALG) {
 		cfg_obj_log(key, ISC_LOG_WARNING,
 			    "skipping trusted key '%s': %s", keynamestr,
 			    isc_result_totext(result));
@@ -823,6 +824,9 @@ load_keys(const cfg_obj_t *keys, dns_client_t *client, dns_view_t *toview) {
 	}

 cleanup:
+	if (result == DST_R_NOCRYPTO) {
+		result = ISC_R_SUCCESS;
+	}
 	return result;
 }

@@ -1121,6 +1125,14 @@ plus_option(char *option) {
 		break;
 	case 'd':
 		switch (cmd[1]) {
+		case 'l': /* dlv */
+			FULLCHECK("dlv");
+			if (state) {
+				fprintf(stderr, "Invalid option: "
+						"+dlv is obsolete\n");
+				exit(EXIT_FAILURE);
+			}
+			break;
 		case 'n': /* dnssec */
 			FULLCHECK("dnssec");
 			showdnssec = state;
@@ -2139,15 +2151,9 @@ sendquery(void *arg) {
 				    &requestmgr));

 	dns_view_attach(view, &(dns_view_t *){ NULL });
-
-	uint32_t initial;
-	isc_nm_gettimeouts(netmgr, &initial, NULL, NULL, NULL);
-	const unsigned int connect_timeout = initial, timeout = initial;
-
 	CHECK(dns_request_create(requestmgr, message, NULL, &peer, NULL, NULL,
-				 DNS_REQUESTOPT_TCP, NULL, connect_timeout,
-				 timeout, 0, 0, isc_loop(), recvresponse,
-				 message, &request));
+				 DNS_REQUESTOPT_TCP, NULL, 1, 0, 0, isc_loop(),
+				 recvresponse, message, &request));
 	return;

 cleanup:
@@ -2199,8 +2205,8 @@ run_server(void *arg) {
 	CHECK(ns_interfacemgr_create(mctx, sctx, loopmgr, netmgr, dispatchmgr,
 				     NULL, &interfacemgr));

-	dns_view_create(mctx, loopmgr, dispatchmgr, dns_rdataclass_in,
-			"_default", &view);
+	CHECK(dns_view_create(mctx, loopmgr, dispatchmgr, dns_rdataclass_in,
+			      "_default", &view));
 	CHECK(dns_cache_create(loopmgr, dns_rdataclass_in, "", mctx, &cache));
 	dns_view_setcache(view, cache, false);
 	dns_cache_detach(&cache);
@@ -22,7 +22,6 @@
 #include <isc/attributes.h>
 #include <isc/dir.h>
 #include <isc/fips.h>
-#include <isc/lib.h>
 #include <isc/loop.h>
 #include <isc/netaddr.h>
 #include <isc/parseint.h>
@@ -34,7 +33,6 @@
 #include <dns/byaddr.h>
 #include <dns/dns64.h>
 #include <dns/fixedname.h>
-#include <dns/lib.h>
 #include <dns/masterdump.h>
 #include <dns/message.h>
 #include <dns/name.h>
@@ -305,8 +303,6 @@ help(void) {
 	       "statistics)\n"
 	       "                 +subnet=addr        (Set edns-client-subnet "
 	       "option)\n"
-	       "                 +[no]svcparamkeycompat (Display backward-"
-	       "compatible SvcParamKey names (keyN) for non-initial entries)\n"
 	       "                 +[no]tcflag         (Set TC flag in query "
 	       "(+[no]tcflag))\n"
 	       "                 +[no]tcp            (TCP mode (+[no]vc))\n"
@@ -506,9 +502,6 @@ say_message(dns_rdata_t *rdata, dig_query_t *query, isc_buffer_t *buf) {
 	if (query->lookup->expandaaaa) {
 		styleflags |= DNS_STYLEFLAG_EXPANDAAAA;
 	}
-	if (query->lookup->svcparamkeycompat) {
-		styleflags |= DNS_STYLEFLAG_SVCPARAMKEYCOMPAT;
-	}
 	result = dns_rdata_tofmttext(rdata, NULL, styleflags, 0, splitwidth,
 				     " ", buf);
 	if (result == ISC_R_NOSPACE) {
@@ -702,9 +695,6 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		if (query->lookup->expandaaaa) {
 			styleflags |= DNS_STYLEFLAG_EXPANDAAAA;
 		}
-		if (query->lookup->svcparamkeycompat) {
-			styleflags |= DNS_STYLEFLAG_SVCPARAMKEYCOMPAT;
-		}
 		if (query->lookup->multiline) {
 			styleflags |= DNS_STYLEFLAG_OMIT_OWNER;
 			styleflags |= DNS_STYLEFLAG_OMIT_CLASS;
@@ -2404,10 +2394,6 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 				goto exit_or_usage;
 			}
 			break;
-		case 'v': /* svcparamkeycompat */
-			FULLCHECK("svcparamkeycompat");
-			lookup->svcparamkeycompat = state;
-			break;
 		default:
 			goto invalid_option;
 		}
@@ -642,14 +642,6 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
   prefix-length of zero, which signals a resolver that the client's
   address information must *not* be used when resolving this query.

-.. option:: +svcparamkeycompat, +nosvcparamkeycompat
-
-   This option sets [or does not set] the backward-compatible representation of
-   the Service Parameter Keys (SvcParamKeys) for SVCB records, in which case
-   the keys, which were not defined initially in :rfc:`9460` are represented
-   in their opaque "keyN"-like format, where "N" is their numerical value. The
-   default is ``+nosvcparamkeycompat``.
-
 .. option:: +tcflag, +notcflag

   This option sets [or does not set] the TC (TrunCation) bit in the query. The default is
@@ -40,6 +40,7 @@
 #include <isc/file.h>
 #include <isc/getaddresses.h>
 #include <isc/hex.h>
+#include <isc/lang.h>
 #include <isc/log.h>
 #include <isc/loop.h>
 #include <isc/managers.h>
@@ -60,7 +61,6 @@
 #include <isc/xml.h>

 #include <dns/byaddr.h>
-#include <dns/ede.h>
 #include <dns/fixedname.h>
 #include <dns/message.h>
 #include <dns/name.h>
@@ -758,7 +758,6 @@ clone_lookup(dig_lookup_t *lookold, bool servers) {
 	looknew->nocrypto = lookold->nocrypto;
 	looknew->ttlunits = lookold->ttlunits;
 	looknew->expandaaaa = lookold->expandaaaa;
-	looknew->svcparamkeycompat = lookold->svcparamkeycompat;
 	looknew->qr = lookold->qr;
 	looknew->idnin = lookold->idnin;
 	looknew->idnout = lookold->idnout;
@@ -2780,12 +2779,6 @@ _cancel_lookup(dig_lookup_t *lookup, const char *file, unsigned int line) {
 	check_if_done();
 }

-static inline const char *
-get_tls_sni_hostname(dig_query_t *query) {
-	return query->lookup->tls_hostname_set ? query->lookup->tls_hostname
-					       : query->userarg;
-}
-
 static isc_tlsctx_t *
 get_create_tls_context(dig_query_t *query, const bool is_https,
 		       isc_tlsctx_client_session_cache_t **psess_cache) {
@@ -2832,7 +2825,10 @@ get_create_tls_context(dig_query_t *query, const bool is_https,
 		}

 		if (store != NULL) {
-			const char *hostname = get_tls_sni_hostname(query);
+			const char *hostname =
+				query->lookup->tls_hostname_set
+					? query->lookup->tls_hostname
+					: query->userarg;
 			/*
 			 * According to RFC 8310, Subject field MUST NOT be
 			 * inspected when verifying hostname for DoT. Only
@@ -3046,8 +3042,7 @@ start_tcp(dig_query_t *query) {
 		}
 		isc_nm_streamdnsconnect(netmgr, &localaddr, &query->sockaddr,
 					tcp_connected, connectquery,
-					local_timeout, tlsctx,
-					get_tls_sni_hostname(query), sess_cache,
+					local_timeout, tlsctx, sess_cache,
 					proxy_type, ppi);
 #if HAVE_LIBNGHTTP2
 	} else if (query->lookup->https_mode) {
@@ -3067,15 +3062,14 @@ start_tcp(dig_query_t *query) {

 		isc_nm_httpconnect(netmgr, &localaddr, &query->sockaddr, uri,
 				   !query->lookup->https_get, tcp_connected,
-				   connectquery, tlsctx,
-				   get_tls_sni_hostname(query), sess_cache,
+				   connectquery, tlsctx, sess_cache,
 				   local_timeout, proxy_type, ppi);
 #endif
 	} else {
 		isc_nm_streamdnsconnect(netmgr, &localaddr, &query->sockaddr,
 					tcp_connected, connectquery,
-					local_timeout, NULL, NULL, NULL,
-					proxy_type, ppi);
+					local_timeout, NULL, NULL, proxy_type,
+					ppi);
 	}

 	return;
@@ -21,6 +21,7 @@
 #include <isc/attributes.h>
 #include <isc/buffer.h>
 #include <isc/formatcheck.h>
+#include <isc/lang.h>
 #include <isc/list.h>
 #include <isc/loop.h>
 #include <isc/magic.h>
@@ -84,6 +85,8 @@
 * in a tight loop of constant lookups.  It's value is arbitrary.
 */

+ISC_LANG_BEGINDECLS
+
 typedef struct dig_lookup dig_lookup_t;
 typedef struct dig_query dig_query_t;
 typedef struct dig_server dig_server_t;
@@ -104,8 +107,9 @@ struct dig_lookup {
 	isc_refcount_t references;
 	bool aaonly, adflag, badcookie, besteffort, cdflag, cleared, comments,
 		dns64prefix, dnssec, doing_xfr, done_as_is, ednsneg, expandaaaa,
-		svcparamkeycompat, expire, fuzzing, header_only,
-		identify, /*%< Append an "on server <foo>" message */
+		expire, fuzzing, header_only, identify, /*%< Append an "on
+							   server <foo>" message
+							 */
 		identify_previous_line, /*% Prepend a "Nameserver <foo>:"
 					   message, with newline and tab */
 		idnin, idnout, ignore, multiline, need_search, new_search,
@@ -462,3 +466,5 @@ dig_shutdown(void);

 bool
 dig_lookup_is_tls(const dig_lookup_t *lookup);
+
+ISC_LANG_ENDDECLS
@@ -21,7 +21,6 @@

 #include <isc/attributes.h>
 #include <isc/commandline.h>
-#include <isc/lib.h>
 #include <isc/loop.h>
 #include <isc/netaddr.h>
 #include <isc/string.h>
@@ -29,7 +28,6 @@

 #include <dns/byaddr.h>
 #include <dns/fixedname.h>
-#include <dns/lib.h>
 #include <dns/message.h>
 #include <dns/name.h>
 #include <dns/rdata.h>
@@ -82,7 +80,6 @@ struct rtype rtypes[] = { { 1, "has address" },
 			  { 25, "has key" },
 			  { 28, "has IPv6 address" },
 			  { 29, "location" },
-			  { dns_rdatatype_https, "has HTTP service bindings" },
 			  { 0, NULL } };

 static char *
@@ -460,16 +457,6 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 			lookup->retries = tries;
 			ISC_LIST_APPEND(lookup_list, lookup, link);
 		}
-		lookup = clone_lookup(query->lookup, false);
-		if (lookup != NULL) {
-			strlcpy(lookup->textname, namestr,
-				sizeof(lookup->textname));
-			lookup->rdtype = dns_rdatatype_https;
-			lookup->rdtypeset = true;
-			lookup->origin = NULL;
-			lookup->retries = tries;
-			ISC_LIST_APPEND(lookup_list, lookup, link);
-		}
 	}

 	if (!short_form) {
@@ -122,7 +122,7 @@ Options
   CNAME, NS, SOA, TXT, DNSKEY, AXFR, etc.

   When no query type is specified, :program:`host` automatically selects an
-   appropriate query type. By default, it looks for A, AAAA, MX, and HTTPS
+   appropriate query type. By default, it looks for A, AAAA, and MX
   records. If the :option:`-C` option is given, queries are made for SOA
   records. If ``name`` is a dotted-decimal IPv4 address or
   colon-delimited IPv6 address, :program:`host` queries for PTR records.
@@ -21,7 +21,6 @@
 #include <isc/buffer.h>
 #include <isc/commandline.h>
 #include <isc/condition.h>
-#include <isc/lib.h>
 #include <isc/loop.h>
 #include <isc/netaddr.h>
 #include <isc/parseint.h>
@@ -31,7 +30,6 @@

 #include <dns/byaddr.h>
 #include <dns/fixedname.h>
-#include <dns/lib.h>
 #include <dns/message.h>
 #include <dns/name.h>
 #include <dns/rdata.h>
@@ -29,7 +29,6 @@
 #include <isc/dir.h>
 #include <isc/file.h>
 #include <isc/hash.h>
-#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
@@ -45,7 +44,6 @@
 #include <dns/ds.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
-#include <dns/lib.h>
 #include <dns/master.h>
 #include <dns/name.h>
 #include <dns/rdata.h>
@@ -22,7 +22,6 @@
 #include <isc/commandline.h>
 #include <isc/dir.h>
 #include <isc/hash.h>
-#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
@@ -35,7 +34,6 @@
 #include <dns/ds.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
-#include <dns/lib.h>
 #include <dns/master.h>
 #include <dns/name.h>
 #include <dns/rdata.h>
@@ -383,7 +381,7 @@ main(int argc, char **argv) {

 	isc_commandline_errprint = false;

-#define OPTIONS "12Aa:Cc:d:Ff:K:sT:v:whV"
+#define OPTIONS "12Aa:Cc:d:Ff:K:l:sT:v:whV"
 	while ((ch = isc_commandline_parse(argc, argv, OPTIONS)) != -1) {
 		switch (ch) {
 		case '1':
@@ -419,6 +417,9 @@ main(int argc, char **argv) {
 		case 'f':
 			filename = isc_commandline_argument;
 			break;
+		case 'l':
+			fatal("-l option (DLV lookaside) is obsolete");
+			break;
 		case 's':
 			usekeyset = true;
 			break;
@@ -20,7 +20,6 @@
 #include <isc/buffer.h>
 #include <isc/commandline.h>
 #include <isc/hash.h>
-#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
@@ -33,7 +32,6 @@
 #include <dns/ds.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
-#include <dns/lib.h>
 #include <dns/master.h>
 #include <dns/name.h>
 #include <dns/rdata.h>
@@ -21,7 +21,6 @@
 #include <isc/attributes.h>
 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/region.h>
@@ -32,7 +31,6 @@
 #include <dns/dnssec.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
-#include <dns/lib.h>
 #include <dns/name.h>
 #include <dns/rdataclass.h>
 #include <dns/secalg.h>
@@ -39,7 +39,6 @@
 #include <isc/buffer.h>
 #include <isc/commandline.h>
 #include <isc/fips.h>
-#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/region.h>
@@ -51,7 +50,6 @@
 #include <dns/fixedname.h>
 #include <dns/kasp.h>
 #include <dns/keyvalues.h>
-#include <dns/lib.h>
 #include <dns/name.h>
 #include <dns/rdataclass.h>
 #include <dns/secalg.h>
@@ -20,7 +20,6 @@
 #include <isc/commandline.h>
 #include <isc/fips.h>
 #include <isc/lex.h>
-#include <isc/lib.h>
 #include <isc/mem.h>

 #include <dns/callbacks.h>
@@ -28,7 +27,6 @@
 #include <dns/fixedname.h>
 #include <dns/keymgr.h>
 #include <dns/keyvalues.h>
-#include <dns/lib.h>
 #include <dns/rdataclass.h>
 #include <dns/rdatalist.h>
 #include <dns/rdataset.h>
@@ -23,14 +23,12 @@
 #include <isc/commandline.h>
 #include <isc/file.h>
 #include <isc/hash.h>
-#include <isc/lib.h>
 #include <isc/mem.h>
 #include <isc/result.h>
 #include <isc/string.h>
 #include <isc/util.h>

 #include <dns/keyvalues.h>
-#include <dns/lib.h>

 #include <dst/dst.h>

@@ -25,7 +25,6 @@
 #include <isc/commandline.h>
 #include <isc/file.h>
 #include <isc/hash.h>
-#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
@@ -34,7 +33,6 @@
 #include <isc/util.h>

 #include <dns/keyvalues.h>
-#include <dns/lib.h>

 #include <dst/dst.h>

@@ -45,7 +45,6 @@
 #include <isc/fips.h>
 #include <isc/hash.h>
 #include <isc/hex.h>
-#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/loop.h>
 #include <isc/managers.h>
@@ -72,7 +71,6 @@
 #include <dns/fixedname.h>
 #include <dns/kasp.h>
 #include <dns/keyvalues.h>
-#include <dns/lib.h>
 #include <dns/master.h>
 #include <dns/masterdump.h>
 #include <dns/nsec.h>
@@ -421,9 +419,10 @@ keythatsigned(dns_rdata_rrsig_t *rrsig) {
 		dns_dnsseckey_create(mctx, &privkey, &key);
 	} else {
 		dns_dnsseckey_create(mctx, &pubkey, &key);
-		key->pubkey = true;
 	}

+	key->force_publish = false;
+	key->force_sign = false;
 	key->index = keycount++;
 	ISC_LIST_APPEND(keylist, key, link);

@@ -541,7 +540,7 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 	}

 	while (result == ISC_R_SUCCESS) {
-		bool expired, refresh, future, offline;
+		bool expired, future;
 		bool keep = false, resign = false;

 		dns_rdataset_current(&sigset, &sigrdata);
@@ -552,10 +551,8 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 		future = isc_serial_lt(now, rrsig.timesigned);

 		key = keythatsigned(&rrsig);
-		offline = key->pubkey;
 		sig_format(&rrsig, sigstr, sizeof(sigstr));
-		expired = isc_serial_gt(now, rrsig.timeexpire);
-		refresh = isc_serial_gt(now + cycle, rrsig.timeexpire);
+		expired = isc_serial_gt(now + cycle, rrsig.timeexpire);

 		if (isc_serial_gt(rrsig.timesigned, rrsig.timeexpire)) {
 			/* rrsig is dropped and not replaced */
@@ -584,21 +581,15 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 		} else if (issigningkey(key)) {
 			wassignedby[key->index] = true;

-			if (!refresh && rrsig.originalttl == set->ttl &&
+			if (!expired && rrsig.originalttl == set->ttl &&
 			    setverifies(name, set, key->key, &sigrdata))
 			{
 				vbprintf(2, "\trrsig by %s retained\n", sigstr);
 				keep = true;
-			} else if (offline) {
-				vbprintf(2,
-					 "\trrsig by %s retained - private key "
-					 "missing\n",
-					 sigstr);
-				keep = true;
 			} else {
 				vbprintf(2, "\trrsig by %s dropped - %s\n",
 					 sigstr,
-					 refresh ? "refresh"
+					 expired ? "expired"
 					 : rrsig.originalttl != set->ttl
 						 ? "ttl change"
 						 : "failed to "
@@ -611,32 +602,25 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 		} else if (iszonekey(key)) {
 			wassignedby[key->index] = true;

-			if (!refresh && rrsig.originalttl == set->ttl &&
+			if (!expired && rrsig.originalttl == set->ttl &&
 			    setverifies(name, set, key->key, &sigrdata))
 			{
 				vbprintf(2, "\trrsig by %s retained\n", sigstr);
 				keep = true;
-			} else if (offline) {
-				vbprintf(2,
-					 "\trrsig by %s retained - private key "
-					 "missing\n",
-					 sigstr);
-				keep = true;
 			} else {
 				vbprintf(2, "\trrsig by %s dropped - %s\n",
 					 sigstr,
-					 refresh ? "refresh"
+					 expired ? "expired"
 					 : rrsig.originalttl != set->ttl
 						 ? "ttl change"
 						 : "failed to "
 						   "verify");
 			}
-		} else if (!refresh) {
+		} else if (!expired) {
 			vbprintf(2, "\trrsig by %s retained\n", sigstr);
 			keep = true;
 		} else {
-			vbprintf(2, "\trrsig by %s %s\n", sigstr,
-				 expired ? "expired" : "needs refresh");
+			vbprintf(2, "\trrsig by %s expired\n", sigstr);
 		}

 		if (keep) {
@@ -3388,12 +3372,9 @@ main(int argc, char *argv[]) {
 	atomic_init(&shuttingdown, false);
 	atomic_init(&finished, false);

-	/*
-	 * Unused letters: Bb G J l q Yy (and F is reserved).
-	 * l was previously used for DLV lookaside.
-	 */
-#define CMDLINE_FLAGS                                                        \
-	"3:AaCc:Dd:E:e:f:FgG:hH:i:I:j:J:K:k:L:m:M:n:N:o:O:PpQqRr:s:ST:tuUv:" \
+	/* Unused letters: Bb G J q Yy (and F is reserved). */
+#define CMDLINE_FLAGS                                                          \
+	"3:AaCc:Dd:E:e:f:FgG:hH:i:I:j:J:K:k:L:l:m:M:n:N:o:O:PpQqRr:s:ST:tuUv:" \
 	"VX:xzZ:"

 	/*
@@ -3567,6 +3548,10 @@ main(int argc, char *argv[]) {
 			}
 			break;

+		case 'l':
+			fatal("-l option (DLV lookaside) is obsolete");
+			break;
+
 		case 'M':
 			endp = NULL;
 			set_maxttl = true;
@@ -174,11 +174,6 @@ Options
   days. Therefore, if any existing RRSIG records are due to expire in
   less than 7.5 days, they are replaced.

-   Note that the calculation of cycle interval is based upon the validity
-   period of the replacement signatures that would be generated by
-   ``dnssec-signzone``, not on the valid lifetimes of the input RRSIGs being
-   considered for pre-expiry replacement.
-
 .. option:: -I input-format

   This option sets the format of the input zone file. Possible formats are
@@ -274,7 +269,7 @@ Options
   with cached copies of the old DNSKEY RRset. The :option:`-Q` option forces
   :program:`dnssec-signzone` to remove signatures from keys that are no longer
   active. This enables ZSK rollover using the procedure described in
-   :rfc:`6781#section-4.1.1.1` ("Pre-Publish Zone Signing Key Rollover").
+   :rfc:`6781#4.1.1.1` ("Pre-Publish Key Rollover").

 .. option:: -q

@@ -291,7 +286,7 @@ Options
   This option is similar to :option:`-Q`, except it forces
   :program:`dnssec-signzone` to remove signatures from keys that are no longer
   published. This enables ZSK rollover using the procedure described in
-   :rfc:`6781#section-4.1.1.2` ("Double Signature Zone Signing Key
+   :rfc:`6781#4.1.1.2` ("Double Signature Zone Signing Key
   Rollover").

 .. option:: -S
@@ -23,7 +23,6 @@
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/hex.h>
-#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/mutex.h>
@@ -44,7 +43,6 @@
 #include <dns/ds.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
-#include <dns/lib.h>
 #include <dns/master.h>
 #include <dns/masterdump.h>
 #include <dns/nsec.h>
@@ -460,7 +460,9 @@ key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
 	dns_secalg_t alg;
 	isc_stdtime_t now = isc_stdtime_now();

-	SET_IF_NOT_NULL(exact, false);
+	if (exact != NULL) {
+		*exact = false;
+	}

 	id = dst_key_id(dstkey);
 	rid = dst_key_rid(dstkey);
@@ -931,7 +931,6 @@
                  <th>Messages Received</th>
                  <th>Records Received</th>
                  <th>Bytes Received</th>
-                  <th>Transfer Rate (B/s)</th>
                </tr>
              </thead>
              <tbody>
@@ -960,7 +959,6 @@
                    <td><xsl:value-of select="nmsg"/></td>
                    <td><xsl:value-of select="nrecs"/></td>
                    <td><xsl:value-of select="nbytes"/></td>
-                    <td><xsl:value-of select="rate"/></td>
                  </tr>
                </xsl:for-each>
              </tbody>
@@ -111,8 +111,6 @@ options {\n\
 	session-keyname local-ddns;\n\
 	startup-notify-rate 20;\n\
 	sig0checks-quota 1;\n\
-	sig0key-checks-limit 16;\n\
-	sig0message-checks-limit 2;\n\
 	statistics-file \"named.stats\";\n\
 	tcp-advertised-timeout 300;\n\
 	tcp-clients 150;\n\
@@ -161,9 +159,11 @@ options {\n\
 	fetch-quota-params 100 0.1 0.3 0.7;\n\
 	fetches-per-server 0;\n\
 	fetches-per-zone 0;\n\
-	lame-ttl 0;\n\
-	lmdb-mapsize 32M;\n\
-	max-cache-size 90%;\n\
+	lame-ttl 0;\n"
+#ifdef HAVE_LMDB
+			    "	lmdb-mapsize 32M;\n"
+#endif /* ifdef HAVE_LMDB */
+			    "	max-cache-size 90%;\n\
 	max-cache-ttl 604800; /* 1 week */\n\
 	max-clients-per-query 100;\n\
 	max-ncache-ttl 10800; /* 3 hours */\n\
@@ -193,6 +193,7 @@ options {\n\
 	require-server-cookie no;\n\
 	root-key-sentinel yes;\n\
 	servfail-ttl 1;\n\
+#	sortlist <none>\n\
 	stale-answer-client-timeout off;\n\
 	stale-answer-enable false;\n\
 	stale-answer-ttl 30; /* 30 seconds */\n\
@@ -232,7 +233,6 @@ options {\n\
 	max-transfer-time-out 120;\n\
 	min-refresh-time 300;\n\
 	min-retry-time 500;\n\
-	min-transfer-rate-in 10240 5;\n\
 	multi-master no;\n\
 	notify yes;\n\
 	notify-delay 5;\n\
@@ -332,7 +332,7 @@ dnssec-policy \"insecure\" {\n\

 			    "# END TRUST ANCHORS\n\
 \n\
-remote-servers " DEFAULT_IANA_ROOT_ZONE_PRIMARIES " {\n\
+primaries " DEFAULT_IANA_ROOT_ZONE_PRIMARIES " {\n\
 	2801:1b8:10::b;		# b.root-servers.net\n\
 	2001:500:2::c;		# c.root-servers.net\n\
 	2001:500:2f::f;		# f.root-servers.net\n\
@@ -504,9 +504,9 @@ named_config_getzonetype(const cfg_obj_t *zonetypeobj) {
 	return ztype;
 }

-isc_result_t
-named_config_getremotesdef(const cfg_obj_t *cctx, const char *list,
-			   const char *name, const cfg_obj_t **ret) {
+static isc_result_t
+getremotesdef(const cfg_obj_t *cctx, const char *list, const char *name,
+	      const cfg_obj_t **ret) {
 	isc_result_t result;
 	const cfg_obj_t *obj = NULL;
 	const cfg_listelt_t *elt;
@@ -533,6 +533,23 @@ named_config_getremotesdef(const cfg_obj_t *cctx, const char *list,
 	return ISC_R_NOTFOUND;
 }

+isc_result_t
+named_config_getremotesdef(const cfg_obj_t *cctx, const char *list,
+			   const char *name, const cfg_obj_t **ret) {
+	isc_result_t result;
+
+	if (strcmp(list, "parental-agents") == 0) {
+		return getremotesdef(cctx, list, name, ret);
+	} else if (strcmp(list, "primaries") == 0) {
+		result = getremotesdef(cctx, list, name, ret);
+		if (result != ISC_R_SUCCESS) {
+			result = getremotesdef(cctx, "masters", name, ret);
+		}
+		return result;
+	}
+	return ISC_R_NOTFOUND;
+}
+
 static isc_result_t
 named_config_getname(isc_mem_t *mctx, const cfg_obj_t *obj,
 		     dns_name_t **namep) {
@@ -581,12 +598,10 @@ named_config_getname(isc_mem_t *mctx, const cfg_obj_t *obj,
 		oldlen = newlen;                                    \
 	}

-static const char *remotesnames[4] = { "remote-servers", "parental-agents",
-				       "primaries", "masters" };
-
 isc_result_t
-named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
-			     isc_mem_t *mctx, dns_ipkeylist_t *ipkl) {
+named_config_getipandkeylist(const cfg_obj_t *config, const char *listtype,
+			     const cfg_obj_t *list, isc_mem_t *mctx,
+			     dns_ipkeylist_t *ipkl) {
 	uint32_t addrcount = 0, srccount = 0;
 	uint32_t keycount = 0, tlscount = 0;
 	uint32_t listcount = 0, l = 0, i = 0;
@@ -669,6 +684,8 @@ newlist:
 		isc_sockaddr_any6(&src6);
 	}

+	result = ISC_R_NOMEMORY;
+
 	element = cfg_list_first(addrlist);
 resume:
 	for (; element != NULL; element = cfg_list_next(element)) {
@@ -699,22 +716,17 @@ resume:
 				continue;
 			}
 			list = NULL;
-			tresult = ISC_R_NOTFOUND;
-			for (size_t n = 0; n < ARRAY_SIZE(remotesnames); n++) {
-				tresult = named_config_getremotesdef(
-					config, remotesnames[n], listname,
-					&list);
-				if (tresult == ISC_R_SUCCESS) {
-					break;
-				}
-			}
+			tresult = named_config_getremotesdef(config, listtype,
+							     listname, &list);
 			if (tresult == ISC_R_NOTFOUND) {
 				cfg_obj_log(addr, ISC_LOG_ERROR,
-					    "remote-servers \"%s\" not found",
+					    "%s \"%s\" not found", listtype,
 					    listname);
+
+				result = tresult;
+				goto cleanup;
 			}
 			if (tresult != ISC_R_SUCCESS) {
-				result = tresult;
 				goto cleanup;
 			}
 			lists[l++].name = listname;
@@ -233,8 +233,6 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		   command_compare(command, NAMED_COMMAND_SIGN))
 	{
 		result = named_server_rekey(named_g_server, lex, text);
-	} else if (command_compare(command, NAMED_COMMAND_MEMPROF)) {
-		result = named_server_togglememprof(lex);
 	} else if (command_compare(command, NAMED_COMMAND_MKEYS)) {
 		result = named_server_mkeys(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_NOTIFY)) {
@@ -31,13 +31,13 @@
 #include <isc/result.h>
 #include <isc/stdtime.h>
 #include <isc/string.h>
-#include <isc/symtab.h>
 #include <isc/util.h>

 #include <isccc/alist.h>
 #include <isccc/cc.h>
 #include <isccc/ccmsg.h>
 #include <isccc/sexpr.h>
+#include <isccc/symtab.h>
 #include <isccc/util.h>

 #include <isccfg/check.h>
@@ -108,7 +108,7 @@ struct named_controls {
 	controllistenerlist_t listeners;
 	bool shuttingdown;
 	isc_mutex_t symtab_lock;
-	isc_symtab_t *symtab;
+	isccc_symtab_t *symtab;
 };

 static isc_result_t
@@ -489,7 +489,7 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
 		if ((sent + CLOCKSKEW) < conn->now ||
 		    (sent - CLOCKSKEW) > conn->now)
 		{
-			result = DNS_R_CLOCKSKEW;
+			result = ISCCC_R_CLOCKSKEW;
 			goto cleanup;
 		}
 	} else {
@@ -503,7 +503,7 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
 	if (isccc_cc_lookupuint32(conn->ctrl, "_exp", &exp) == ISC_R_SUCCESS &&
 	    conn->now > exp)
 	{
-		result = DNS_R_EXPIRED;
+		result = ISCCC_R_EXPIRED;
 		goto cleanup;
 	}

@@ -842,12 +842,15 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
 	CHECK(cfg_map_get(config, "key", &key));

 	keyid = isc_mem_get(mctx, sizeof(*keyid));
-	*keyid = (controlkey_t){
-		.algorithm = DST_ALG_UNKNOWN,
-		.link = ISC_LINK_INITIALIZER,
-	};
 	keyid->keyname = isc_mem_strdup(mctx,
 					cfg_obj_asstring(cfg_map_getname(key)));
+	keyid->secret.base = NULL;
+	keyid->secret.length = 0;
+	keyid->algorithm = DST_ALG_UNKNOWN;
+	ISC_LINK_INIT(keyid, link);
+	if (keyid->keyname == NULL) {
+		CHECK(ISC_R_NOMEMORY);
+	}

 	CHECK(isccfg_check_key(key));

@@ -1336,6 +1339,7 @@ named_controls_configure(named_controls_t *cp, const cfg_obj_t *config,
 isc_result_t
 named_controls_create(named_server_t *server, named_controls_t **ctrlsp) {
 	isc_mem_t *mctx = server->mctx;
+	isc_result_t result;
 	named_controls_t *controls = isc_mem_get(mctx, sizeof(*controls));

 	*controls = (named_controls_t){
@@ -1346,9 +1350,14 @@ named_controls_create(named_server_t *server, named_controls_t **ctrlsp) {

 	isc_mutex_init(&controls->symtab_lock);
 	LOCK(&controls->symtab_lock);
-	isccc_cc_createsymtab(mctx, &controls->symtab);
+	result = isccc_cc_createsymtab(&controls->symtab);
 	UNLOCK(&controls->symtab_lock);

+	if (result != ISC_R_SUCCESS) {
+		isc_mutex_destroy(&controls->symtab_lock);
+		isc_mem_put(server->mctx, controls, sizeof(*controls));
+		return result;
+	}
 	*ctrlsp = controls;
 	return ISC_R_SUCCESS;
 }
@@ -1362,7 +1371,7 @@ named_controls_destroy(named_controls_t **ctrlsp) {
 	REQUIRE(ISC_LIST_EMPTY(controls->listeners));

 	LOCK(&controls->symtab_lock);
-	isc_symtab_destroy(&controls->symtab);
+	isccc_symtab_destroy(&controls->symtab);
 	UNLOCK(&controls->symtab_lock);
 	isc_mutex_destroy(&controls->symtab_lock);
 	isc_mem_put(controls->server->mctx, controls, sizeof(*controls));
@@ -17,6 +17,7 @@

 #include <inttypes.h>

+#include <isc/lang.h>
 #include <isc/types.h>

 #include <dns/clientinfo.h>
@@ -57,8 +57,9 @@ named_config_getremotesdef(const cfg_obj_t *cctx, const char *list,
 			   const char *name, const cfg_obj_t **ret);

 isc_result_t
-named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
-			     isc_mem_t *mctx, dns_ipkeylist_t *ipkl);
+named_config_getipandkeylist(const cfg_obj_t *config, const char *listtype,
+			     const cfg_obj_t *list, isc_mem_t *mctx,
+			     dns_ipkeylist_t *ipkl);

 isc_result_t
 named_config_getport(const cfg_obj_t *config, const char *type,
@@ -43,7 +43,6 @@
 #define NAMED_COMMAND_FREEZE	   "freeze"
 #define NAMED_COMMAND_HALT	   "halt"
 #define NAMED_COMMAND_LOADKEYS	   "loadkeys"
-#define NAMED_COMMAND_MEMPROF	   "memprof"
 #define NAMED_COMMAND_MKEYS	   "managed-keys"
 #define NAMED_COMMAND_MODZONE	   "modzone"
 #define NAMED_COMMAND_NOTIFY	   "notify"
@@ -388,15 +388,3 @@ named_server_fetchlimit(named_server_t *server, isc_lex_t *lex,
 */
 isc_result_t
 named_server_skr(named_server_t *server, isc_lex_t *lex, isc_buffer_t **text);
-
-/*%
- * Toggle memory profiling if supported.
- */
-isc_result_t
-named_server_togglememprof(isc_lex_t *lex);
-
-/*%
- * Get status of memory profiling.
- */
-const char *
-named_server_getmemprof(void);
@@ -15,10 +15,13 @@

 /*! \file */

+#include <isc/lang.h>
 #include <isc/types.h>

 #include <isccfg/cfg.h>

+ISC_LANG_BEGINDECLS
+
 isc_result_t
 named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 			 dns_tkeyctx_t **tctxp);
@@ -34,5 +37,7 @@ named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 *
 *	Returns:
 *\li		ISC_R_SUCCESS
- *\li		return codes from dns_name_fromtext()
+ *\li		ISC_R_NOMEMORY
 */
+
+ISC_LANG_ENDDECLS
@@ -15,12 +15,15 @@

 /*! \file */

+#include <isc/lang.h>
 #include <isc/types.h>

 #include <dns/transport.h>

 #include <isccfg/cfg.h>

+ISC_LANG_BEGINDECLS
+
 isc_result_t
 named_transports_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			    isc_mem_t *mctx, dns_transport_list_t **listp);
@@ -36,3 +39,5 @@ named_transports_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 *	\li	'listp' is not NULL, and '*listp' is NULL
 *
 */
+
+ISC_LANG_ENDDECLS
@@ -15,8 +15,11 @@

 /*! \file */

+#include <isc/lang.h>
 #include <isc/types.h>

+ISC_LANG_BEGINDECLS
+
 isc_result_t
 named_tsigkeyring_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			     isc_mem_t *mctx, dns_tsigkeyring_t **ringp);
@@ -32,6 +35,7 @@ named_tsigkeyring_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 *
 *	Returns:
 *	\li	ISC_R_SUCCESS
- *	\li	DNS_R_BADALG
- *	\li	return codes from dns_name_fromtext()
+ *	\li	ISC_R_NOMEMORY
 */
+
+ISC_LANG_ENDDECLS
@@ -17,11 +17,14 @@

 #include <stdbool.h>

+#include <isc/lang.h>
 #include <isc/types.h>

 #include <isccfg/aclconf.h>
 #include <isccfg/cfg.h>

+ISC_LANG_BEGINDECLS
+
 isc_result_t
 named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		     const cfg_obj_t *zconfig, cfg_aclconfctx_t *ac,
@@ -73,3 +76,5 @@ named_zone_configure_writeable_dlz(dns_dlzdb_t *dlzdatabase, dns_zone_t *zone,
 * \li	'rdclass' to be a valid rdataclass
 * \li	'name' to be a valid zone origin name
 */
+
+ISC_LANG_ENDDECLS
@@ -26,7 +26,6 @@

 #include <isc/attributes.h>
 #include <isc/backtrace.h>
-#include <isc/cfgmgr.h>
 #include <isc/commandline.h>
 #include <isc/crypto.h>
 #include <isc/dir.h>
@@ -34,7 +33,6 @@
 #include <isc/fips.h>
 #include <isc/hash.h>
 #include <isc/httpd.h>
-#include <isc/lib.h>
 #include <isc/managers.h>
 #include <isc/netmgr.h>
 #include <isc/os.h>
@@ -49,7 +47,6 @@

 #include <dns/dispatch.h>
 #include <dns/dyndb.h>
-#include <dns/lib.h>
 #include <dns/name.h>
 #include <dns/resolver.h>
 #include <dns/view.h>
@@ -1276,8 +1273,6 @@ setup(void) {
 				      isc_result_totext(result));
 	}

-	REQUIRE(isc_cfgmgr_init(named_g_mctx, "/tmp/cfgmgr") == ISC_R_SUCCESS);
-
 	named_server_create(named_g_mctx, &named_g_server);
 	ENSURE(named_g_server != NULL);
 	sctx = named_g_server->sctx;
@@ -1345,8 +1340,6 @@ cleanup(void) {

 	named_server_destroy(&named_g_server);

-	isc_cfgmgr_deinit();
-
 	named_builtin_deinit();

 	/*
@@ -1421,7 +1414,14 @@ named_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {
 		return ISC_R_FAILURE;
 	}

-	instance = isc_mem_allocate(mctx, namelen + 1);
+	if ((instance = isc_mem_allocate(mctx, namelen + 1)) == NULL) {
+		UNEXPECTED_ERROR("named_smf_get_instance memory "
+				 "allocation failed: %s",
+				 isc_result_totext(ISC_R_NOMEMORY));
+		scf_handle_destroy(h);
+		return ISC_R_FAILURE;
+	}
+
 	if (scf_myname(h, instance, namelen + 1) == -1) {
 		if (debug) {
 			UNEXPECTED_ERROR("scf_myname() failed: %s",
@@ -17,7 +17,6 @@
 #include <stdbool.h>

 #include <isc/buffer.h>
-#include <isc/cfgmgr.h>
 #include <isc/httpd.h>
 #include <isc/mem.h>
 #include <isc/once.h>
@@ -98,7 +97,7 @@ typedef struct stats_dumparg {
 	isc_result_t result;
 } stats_dumparg_t;

-static isc_once_t once = ISC_ONCE_INITIALIZER;
+static isc_once_t once = ISC_ONCE_INIT;

 #if defined(HAVE_LIBXML2) || defined(HAVE_JSON_C)
 #define EXTENDED_STATS
@@ -1489,7 +1488,6 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {
 	unsigned int nmsg = 0;
 	unsigned int nrecs = 0;
 	uint64_t nbytes = 0;
-	uint64_t rate = 0;

 	statlevel = dns_zone_getstatlevel(zone);
 	if (statlevel == dns_zonestat_none) {
@@ -1703,7 +1701,7 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {
 	TRY0(xmlTextWriterEndElement(writer));

 	if (is_running) {
-		dns_xfrin_getstats(xfr, &nmsg, &nrecs, &nbytes, &rate);
+		dns_xfrin_getstats(xfr, &nmsg, &nrecs, &nbytes);
 	}
 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "nmsg"));
 	TRY0(xmlTextWriterWriteFormatString(writer, "%u", nmsg));
@@ -1714,9 +1712,6 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {
 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "nbytes"));
 	TRY0(xmlTextWriterWriteFormatString(writer, "%" PRIu64, nbytes));
 	TRY0(xmlTextWriterEndElement(writer));
-	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "rate"));
-	TRY0(xmlTextWriterWriteFormatString(writer, "%" PRIu64, rate));
-	TRY0(xmlTextWriterEndElement(writer));

 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "ixfr"));
 	if (is_running && is_first_data_received) {
@@ -2564,7 +2559,6 @@ xfrin_jsonrender(dns_zone_t *zone, void *arg) {
 	unsigned int nmsg = 0;
 	unsigned int nrecs = 0;
 	uint64_t nbytes = 0;
-	uint64_t rate = 0;

 	statlevel = dns_zone_getstatlevel(zone);
 	if (statlevel == dns_zonestat_none) {
@@ -2762,7 +2756,7 @@ xfrin_jsonrender(dns_zone_t *zone, void *arg) {
 	}

 	if (is_running) {
-		dns_xfrin_getstats(xfr, &nmsg, &nrecs, &nbytes, &rate);
+		dns_xfrin_getstats(xfr, &nmsg, &nrecs, &nbytes);
 	}
 	json_object_object_add(xfrinobj, "nmsg",
 			       json_object_new_int64((int64_t)nmsg));
@@ -2772,10 +2766,6 @@ xfrin_jsonrender(dns_zone_t *zone, void *arg) {
 		xfrinobj, "nbytes",
 		json_object_new_int64(nbytes > INT64_MAX ? INT64_MAX
 							 : (int64_t)nbytes));
-	json_object_object_add(xfrinobj, "rate",
-			       json_object_new_int64(rate > INT64_MAX
-							     ? INT64_MAX
-							     : (int64_t)rate));

 	if (is_running && is_first_data_received) {
 		json_object_object_add(
@@ -3488,251 +3478,6 @@ render_json_traffic(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 			   b, freecb, freecb_args);
 }

-typedef struct cfgmgr_visitctx cfgmgr_visitctx_t;
-struct cfgmgr_visitctx {
-	size_t indent;
-	size_t lvl;
-	isc_buffer_t *buffer;
-};
-
-static void
-cfgmgr_visitprop(void *state, const char *name) {
-	cfgmgr_visitctx_t *ctx = state;
-	isc_cfgmgr_val_t val;
-
-	REQUIRE(isc_cfgmgr_read(name, &val) == ISC_R_SUCCESS);
-
-	for (size_t i = 0; i < ctx->lvl * ctx->indent; i++) {
-		isc_buffer_putstr(ctx->buffer, " ");
-	}
-
-	isc_buffer_printf(ctx->buffer, "%s ", name);
-	switch (val.type) {
-	case ISC_CFGMGR_UINT32:
-		isc_buffer_printf(ctx->buffer, "%u", val.uint32);
-		break;
-	case ISC_CFGMGR_STRING:
-		isc_buffer_printf(ctx->buffer, "%s", val.string);
-		break;
-	default:
-		UNREACHABLE();
-	}
-	isc_buffer_putstr(ctx->buffer, ";\n");
-}
-
-static void
-cfgmgr_nodeindent(cfgmgr_visitctx_t *ctx, const char *type, const char *name) {
-	for (size_t i = 0; i < ctx->lvl * ctx->indent; i++) {
-		isc_buffer_putstr(ctx->buffer, " ");
-	}
-
-	if (type != NULL) {
-		isc_buffer_printf(ctx->buffer, "%s ", type);
-	}
-	isc_buffer_printf(ctx->buffer, "%s {\n", name);
-	ctx->lvl++;
-}
-
-static void
-cfgmgr_nodedeindent(cfgmgr_visitctx_t *ctx) {
-	ctx->lvl--;
-	for (size_t i = 0; i < ctx->lvl * ctx->indent; i++) {
-		isc_buffer_putstr(ctx->buffer, " ");
-	}
-	isc_buffer_printf(ctx->buffer, "};\n");
-}
-
-static void
-cfgmgr_visitgenericnode(void *state, const char *name) {
-	cfgmgr_visitctx_t *ctx = state;
-
-	cfgmgr_nodeindent(ctx, NULL, name);
-	isc_cfgmgr_open(name);
-	isc_cfgmgr_foreachproperties(cfgmgr_visitprop, ctx);
-	isc_cfgmgr_foreachnodes(cfgmgr_visitgenericnode, ctx);
-	isc_cfgmgr_close();
-	cfgmgr_nodedeindent(ctx);
-}
-
-static void
-cfgmgr_visitaclnode(void *state, const char *aclname) {
-	cfgmgr_visitctx_t *ctx = state;
-
-	cfgmgr_nodeindent(ctx, "acl", aclname);
-	isc_cfgmgr_open(aclname);
-	isc_cfgmgr_foreachproperties(cfgmgr_visitprop, ctx);
-	/*
-	 * geoip-based ACL are implemented as a subnode
-	 */
-	isc_cfgmgr_foreachnodes(cfgmgr_visitgenericnode, ctx);
-	isc_cfgmgr_close();
-	cfgmgr_nodedeindent(ctx);
-}
-
-static void
-cfgmgr_visitaclsnode(cfgmgr_visitctx_t *ctx) {
-	isc_cfgmgr_open("acls");
-	isc_cfgmgr_foreachnodes(cfgmgr_visitaclnode, ctx);
-	isc_cfgmgr_close();
-}
-
-static void
-cfgmgr_visittoplevelnodes(void *state, const char *name) {
-	cfgmgr_visitctx_t *ctx = state;
-
-	REQUIRE(ctx->lvl == 0);
-
-	if (strcmp(name, "acls") == 0) {
-		cfgmgr_visitaclsnode(ctx);
-	} else { 
-		cfgmgr_visitgenericnode(ctx, name);
-	} 
-}
-
-static void
-cfgmgr_dump(isc_cfgmgr_mode_t mode, isc_buffer_t *buffer) {
-	cfgmgr_visitctx_t ctx = { .lvl = 0, .indent = 8, .buffer = buffer };
-
-	isc_cfgmgr_transaction();
-	isc_cfgmgr_setmode(mode);
-	isc_cfgmgr_foreachnodes(cfgmgr_visittoplevelnodes, &ctx);
-	isc_cfgmgr_commit();
-}
-
-static void
-cfgmgr_dumpfree(isc_buffer_t *buffer, void *arg) {
-	isc_mem_t *mctx = arg;
-	void *data = isc_buffer_base(buffer);
-
-	isc_buffer_initnull(buffer);
-	isc_mem_free(mctx, data);
-}
-
-static isc_result_t
-render_cfgmgr_dump(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
-		    void *arg, unsigned int *retcode, const char **retmsg,
-		    const char **mimetype, isc_buffer_t *b,
-		    isc_httpdfree_t **freecb, void **freecb_args) {
-	const size_t bufsz = 4092;
-	named_server_t *server = arg;
-	char *bufdata = isc_mem_allocate(server->mctx, bufsz);
-
-	UNUSED(httpd);
-	UNUSED(urlinfo);
-	UNUSED(retmsg);
-
-	*retcode = 200;
-	*retmsg = "OK";
-	*mimetype = "text/html";
-	*freecb = cfgmgr_dumpfree;
-	*freecb_args = server->mctx;
-	isc_buffer_reinit(b, bufdata, bufsz);
-
-	isc_buffer_putstr(b, "<pre>");
-
-	isc_buffer_putstr(b, "# Builtin config dump\n\n");
-	cfgmgr_dump(ISC_CFGMGR_MODEBUILTIN, b);
-
-	isc_buffer_putstr(b, "\n\n\n\n# User/named.conf config dump\n\n");
-	cfgmgr_dump(ISC_CFGMGR_MODEUSER, b);
-
-	isc_buffer_putstr(b, "\n\n\n\n# Running config dump\n\n");
-	cfgmgr_dump(ISC_CFGMGR_MODERUNNING, b);
-
-	isc_buffer_putstr(b, "</pre>");
-
-	return ISC_R_SUCCESS;
-}
-
-static void
-cfgmgr_deleteallowquery(void *state, const char *propname) {
-	UNUSED(state);
-	REQUIRE(isc_cfgmgr_write(propname, NULL) == ISC_R_SUCCESS);
-}
-
-static isc_result_t
-set_cfgmgr_optionprop(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
-		      void *arg, unsigned int *retcode, const char **retmsg,
-		      const char **mimetype, isc_buffer_t *b,
-		      isc_httpdfree_t **freecb, void **freecb_args) {
-	isc_cfgmgr_val_t val;
-	const char *base;
-	uint16_t len;
-
-	UNUSED(httpd);
-	UNUSED(urlinfo);
-	UNUSED(retmsg);
-	UNUSED(retcode);
-	UNUSED(b);
-	UNUSED(freecb);
-	UNUSED(freecb_args);
-	UNUSED(mimetype);
-	UNUSED(arg);
-
-	*retcode = 200;
-	*retmsg = "OK";
-
-	base = NULL;
-	if (isc_httpd_geturlfield(httpd, ISC_UF_QUERY, &base, &len) ==
-	    ISC_R_SUCCESS)
-	{
-		char query[512];
-		char *name;
-		char *value;
-
-		REQUIRE(len < 511);
-		strncpy(query, base, len);
-
-		/*
-		 * if there is several queries options, let's pick only the
-		 * first one and ignore the other
-		 */
-		name = strtok(query, "=");
-		value = strtok(NULL, "&"); 
-
-		REQUIRE(name != NULL && strcmp(name, "allow-query") == 0);
-		REQUIRE(value != NULL);
-
-		isc_cfgmgr_rwtransaction();
-
-		isc_cfgmgr_open("options");
-		isc_cfgmgr_open("allow-query");
-		isc_cfgmgr_foreachproperties(cfgmgr_deleteallowquery, NULL);
-		val.type = ISC_CFGMGR_STRING;
-		val.string = "";
-		isc_cfgmgr_write(value, &val);
-		isc_cfgmgr_commit();
-
-		if (strcmp(name, "allow-query") == 0) {
-			dns_view_t *view = NULL;
-			dns_acl_t *newacl = NULL;
-//			dns_acl_t *oldacl;
-
-			REQUIRE(dns_viewlist_find(&named_g_server->viewlist,
-						  "_default", dns_rdataclass_in,
-						  &view) == ISC_R_SUCCESS);
-
-			isc_cfgmgr_transaction();
-			isc_cfgmgr_open("options");
-			REQUIRE(dns_acl_configure(view->mctx, "allow-query",
-						  &newacl) == ISC_R_SUCCESS);
-			isc_cfgmgr_commit();
-
-			REQUIRE(newacl != NULL);
-			isc_refcount_increment(&newacl->references);
-
-			(void)rcu_xchg_pointer(&view->queryacl, newacl);
-			synchronize_rcu();
-
-
-//			dns_acl_detach(&oldacl);
-
-		}
-	}
-
-	return ISC_R_SUCCESS;
-}
-
 #endif /* HAVE_JSON_C */

 #if HAVE_LIBXML2
@@ -3969,10 +3714,6 @@ add_listener(named_server_t *server, named_statschannel_t **listenerp,
 			    false, render_json_traffic, server);
 #endif /* ifdef HAVE_JSON_C */

-	isc_httpdmgr_addurl(listener->httpdmgr, "/cfgmgrdump", false,
-			    render_cfgmgr_dump, server);
-	isc_httpdmgr_addurl(listener->httpdmgr, "/setcfgmgroptionprop", false,
-			    set_cfgmgr_optionprop, server);
 	*listenerp = listener;
 	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
 		      ISC_LOG_NOTICE, "statistics channel listening on %s",
@@ -53,7 +53,10 @@ named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 	isc_buffer_t b;
 	const cfg_obj_t *obj;

-	dns_tkeyctx_create(mctx, &tctx);
+	result = dns_tkeyctx_create(mctx, &tctx);
+	if (result != ISC_R_SUCCESS) {
+		return result;
+	}

 	obj = NULL;
 	result = cfg_map_get(options, "tkey-domain", &obj);
@@ -138,13 +138,6 @@ configure_zone_acl(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
 		}
 	}

-	/*
-	 * Failing that: bailing out: query code will automatically lookup into
-	 * the view if the zone doesn't have ACLs
-	 * (leaving the code below and before the label just in case for now)
-	 */
-	return ISC_R_SUCCESS;
-
 	/* Failing that, see if there's a default ACL already in the view */
 	if (aclp != NULL && *aclp != NULL) {
 		(*setzacl)(zone, *aclp);
@@ -904,7 +897,6 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	const char *dupcheck;
 	dns_checkdstype_t checkdstype = dns_checkdstype_yes;
 	dns_notifytype_t notifytype = dns_notifytype_yes;
-	uint32_t count;
 	unsigned int dbargc;
 	char **dbargv;
 	static char default_dbtype[] = ZONEDB_DEFAULT;
@@ -914,7 +906,6 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	dns_zonetype_t ztype;
 	int i;
 	int32_t journal_size;
-	bool multi;
 	dns_kasp_t *kasp = NULL;
 	bool check = false, fail = false;
 	bool warn = false, ignore = false;
@@ -985,6 +976,9 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	if (result == ISC_R_SUCCESS) {
 		cpval = isc_mem_strdup(mctx, cfg_obj_asstring(obj));
 	}
+	if (cpval == NULL) {
+		CHECK(ISC_R_NOMEMORY);
+	}

 	obj = NULL;
 	result = cfg_map_get(zoptions, "dlz", &obj);
@@ -1113,20 +1107,24 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		size_t signedlen = strlen(filename) + sizeof(SIGNED);
 		char *signedname;

-		dns_zone_setfile(raw, filename, masterformat, masterstyle);
+		CHECK(dns_zone_setfile(raw, filename, masterformat,
+				       masterstyle));
 		signedname = isc_mem_get(mctx, signedlen);

 		(void)snprintf(signedname, signedlen, "%s" SIGNED, filename);
-		dns_zone_setfile(zone, signedname, dns_masterformat_raw, NULL);
+		result = dns_zone_setfile(zone, signedname,
+					  dns_masterformat_raw, NULL);
 		isc_mem_put(mctx, signedname, signedlen);
+		CHECK(result);
 	} else {
-		dns_zone_setfile(zone, filename, masterformat, masterstyle);
+		CHECK(dns_zone_setfile(zone, filename, masterformat,
+				       masterstyle));
 	}

 	obj = NULL;
 	result = cfg_map_get(zoptions, "journal", &obj);
 	if (result == ISC_R_SUCCESS) {
-		dns_zone_setjournal(mayberaw, cfg_obj_asstring(obj));
+		CHECK(dns_zone_setjournal(mayberaw, cfg_obj_asstring(obj)));
 	}

 	/*
@@ -1273,8 +1271,8 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			dns_ipkeylist_t ipkl;
 			dns_ipkeylist_init(&ipkl);

-			CHECK(named_config_getipandkeylist(config, obj, mctx,
-							   &ipkl));
+			CHECK(named_config_getipandkeylist(config, "primaries",
+							   obj, mctx, &ipkl));
 			dns_zone_setalsonotify(zone, ipkl.addrs, ipkl.sources,
 					       ipkl.keys, ipkl.tlss,
 					       ipkl.count);
@@ -1627,7 +1625,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		result = named_config_get(maps, "key-directory", &obj);
 		if (result == ISC_R_SUCCESS) {
 			filename = cfg_obj_asstring(obj);
-			dns_zone_setkeydirectory(zone, filename);
+			CHECK(dns_zone_setkeydirectory(zone, filename));
 		}
 		/* Also save a reference to the keystore list. */
 		dns_zone_setkeystores(zone, keystorelist);
@@ -1679,8 +1677,9 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		if (parentals != NULL) {
 			dns_ipkeylist_t ipkl;
 			dns_ipkeylist_init(&ipkl);
-			CHECK(named_config_getipandkeylist(config, parentals,
-							   mctx, &ipkl));
+			CHECK(named_config_getipandkeylist(
+				config, "parental-agents", parentals, mctx,
+				&ipkl));
 			dns_zone_setparentals(zone, ipkl.addrs, ipkl.sources,
 					      ipkl.keys, ipkl.tlss, ipkl.count);
 			dns_ipkeylist_clear(mctx, &ipkl);
@@ -1837,7 +1836,6 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	case dns_zone_secondary:
 	case dns_zone_stub:
 	case dns_zone_redirect:
-		count = 0;
 		obj = NULL;
 		(void)cfg_map_get(zoptions, "primaries", &obj);
 		if (obj == NULL) {
@@ -1852,7 +1850,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		    dns_name_equal(dns_zone_getorigin(zone), dns_rootname))
 		{
 			result = named_config_getremotesdef(
-				named_g_config, "remote-servers",
+				named_g_config, "primaries",
 				DEFAULT_IANA_ROOT_ZONE_PRIMARIES, &obj);
 			CHECK(result);
 		}
@@ -1860,54 +1858,17 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			dns_ipkeylist_t ipkl;
 			dns_ipkeylist_init(&ipkl);

-			CHECK(named_config_getipandkeylist(config, obj, mctx,
-							   &ipkl));
+			CHECK(named_config_getipandkeylist(config, "primaries",
+							   obj, mctx, &ipkl));
 			dns_zone_setprimaries(mayberaw, ipkl.addrs,
 					      ipkl.sources, ipkl.keys,
 					      ipkl.tlss, ipkl.count);
-			count = ipkl.count;
 			dns_ipkeylist_clear(mctx, &ipkl);
 		} else {
 			dns_zone_setprimaries(mayberaw, NULL, NULL, NULL, NULL,
 					      0);
 		}

-		multi = false;
-		if (count > 1) {
-			obj = NULL;
-			result = named_config_get(maps, "multi-master", &obj);
-			INSIST(result == ISC_R_SUCCESS && obj != NULL);
-			multi = cfg_obj_asboolean(obj);
-		}
-		dns_zone_setoption(mayberaw, DNS_ZONEOPT_MULTIMASTER, multi);
-
-		obj = NULL;
-		result = named_config_get(maps, "min-transfer-rate-in", &obj);
-		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		uint32_t traffic_bytes =
-			cfg_obj_asuint32(cfg_tuple_get(obj, "traffic_bytes"));
-		uint32_t time_minutes =
-			cfg_obj_asuint32(cfg_tuple_get(obj, "time_minutes"));
-		if (traffic_bytes == 0) {
-			cfg_obj_log(obj, ISC_LOG_ERROR,
-				    "zone '%s': 'min-transfer-rate-in' bytes"
-				    "value can not be '0'",
-				    zname);
-			CHECK(ISC_R_FAILURE);
-		}
-		/* Max. 28 days (in minutes). */
-		const unsigned int time_minutes_max = 28 * 24 * 60;
-		if (time_minutes < 1 || time_minutes > time_minutes_max) {
-			cfg_obj_log(obj, ISC_LOG_ERROR,
-				    "zone '%s': 'min-transfer-rate-in' minutes"
-				    "value is out of range (1..%u)",
-				    zname, time_minutes_max);
-			CHECK(ISC_R_FAILURE);
-		}
-		dns_zone_setminxfrratein(mayberaw, traffic_bytes,
-					 transferinsecs ? time_minutes
-							: time_minutes * 60);
-
 		obj = NULL;
 		result = named_config_get(maps, "max-transfer-time-in", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
@@ -30,7 +30,6 @@
 #include <isc/getaddresses.h>
 #include <isc/hash.h>
 #include <isc/lex.h>
-#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/loop.h>
 #include <isc/managers.h>
@@ -53,7 +52,6 @@
 #include <dns/dispatch.h>
 #include <dns/dnssec.h>
 #include <dns/fixedname.h>
-#include <dns/lib.h>
 #include <dns/masterdump.h>
 #include <dns/message.h>
 #include <dns/name.h>
@@ -768,12 +766,14 @@ set_source_ports(dns_dispatchmgr_t *manager) {
 	in_port_t udpport_low, udpport_high;
 	isc_result_t result;

-	isc_portset_create(gmctx, &v4portset);
+	result = isc_portset_create(gmctx, &v4portset);
+	check_result(result, "isc_portset_create (v4)");
 	result = isc_net_getudpportrange(AF_INET, &udpport_low, &udpport_high);
 	check_result(result, "isc_net_getudpportrange (v4)");
 	isc_portset_addrange(v4portset, udpport_low, udpport_high);

-	isc_portset_create(gmctx, &v6portset);
+	result = isc_portset_create(gmctx, &v6portset);
+	check_result(result, "isc_portset_create (v6)");
 	result = isc_net_getudpportrange(AF_INET6, &udpport_low, &udpport_high);
 	check_result(result, "isc_net_getudpportrange (v6)");
 	isc_portset_addrange(v6portset, udpport_low, udpport_high);
@@ -2665,9 +2665,9 @@ send_update(dns_name_t *zone, isc_sockaddr_t *primary) {

 	result = dns_request_create(requestmgr, updatemsg, srcaddr, primary,
 				    req_transport, req_tls_ctx_cache, options,
-				    tsigkey, timeout, timeout, udp_timeout,
-				    udp_retries, isc_loop_main(loopmgr),
-				    update_completed, NULL, &request);
+				    tsigkey, timeout, udp_timeout, udp_retries,
+				    isc_loop_main(loopmgr), update_completed,
+				    NULL, &request);
 	check_result(result, "dns_request_create");

 	if (debugging) {
@@ -2770,11 +2770,11 @@ recvsoa(void *arg) {
 			srcaddr = localaddr4;
 		}

-		result = dns_request_create(
-			requestmgr, soaquery, srcaddr, addr, req_transport,
-			req_tls_ctx_cache, options, NULL, timeout, timeout,
-			udp_timeout, udp_retries, isc_loop_main(loopmgr),
-			recvsoa, reqinfo, &request);
+		result = dns_request_create(requestmgr, soaquery, srcaddr, addr,
+					    req_transport, req_tls_ctx_cache,
+					    options, NULL, timeout, udp_timeout,
+					    udp_retries, isc_loop_main(loopmgr),
+					    recvsoa, reqinfo, &request);
 		check_result(result, "dns_request_create");
 		requests++;
 		return;
@@ -3009,8 +3009,8 @@ sendrequest(isc_sockaddr_t *destaddr, dns_message_t *msg,
 	result = dns_request_create(
 		requestmgr, msg, srcaddr, destaddr, req_transport,
 		req_tls_ctx_cache, options, default_servers ? NULL : tsigkey,
-		timeout, timeout, udp_timeout, udp_retries,
-		isc_loop_main(loopmgr), recvsoa, reqinfo, request);
+		timeout, udp_timeout, udp_retries, isc_loop_main(loopmgr),
+		recvsoa, reqinfo, request);
 	check_result(result, "dns_request_create");
 	requests++;
 }
@@ -3210,11 +3210,10 @@ send_gssrequest(isc_sockaddr_t *destaddr, dns_message_t *msg,
 		srcaddr = localaddr4;
 	}

-	result = dns_request_create(requestmgr, msg, srcaddr, destaddr,
-				    req_transport, req_tls_ctx_cache, options,
-				    tsigkey, timeout, timeout, udp_timeout,
-				    udp_retries, isc_loop_main(loopmgr),
-				    recvgss, reqinfo, request);
+	result = dns_request_create(
+		requestmgr, msg, srcaddr, destaddr, req_transport,
+		req_tls_ctx_cache, options, tsigkey, timeout, udp_timeout,
+		udp_retries, isc_loop_main(loopmgr), recvgss, reqinfo, request);
 	check_result(result, "dns_request_create");
 	if (debugging) {
 		show_message(stdout, msg, "Outgoing update query:");
@@ -22,7 +22,6 @@
 #include <isc/commandline.h>
 #include <isc/file.h>
 #include <isc/getaddresses.h>
-#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/loop.h>
 #include <isc/managers.h>
@@ -37,7 +36,6 @@
 #include <isc/thread.h>
 #include <isc/util.h>

-#include <dns/lib.h>
 #include <dns/name.h>

 #include <isccc/alist.h>
@@ -145,10 +143,6 @@ command is one of the following:\n\
 		Display RFC 5011 managed keys information\n\
  managed-keys sync [class [view]]\n\
 		Write RFC 5011 managed keys to disk\n\
-  memprof [ on | off | dump ]\n\
-		Enable / disable memory profiling or dump the profile.\n\
-		Requires named to built with jemalloc and run with the relevant\n\
-		MALLOC_CONF environment variables.\n\
  modzone zone [class [view]] { zone-options }\n\
 		Modify a zone's configuration.\n\
 		Requires allow-new-zones option.\n\
@@ -133,13 +133,14 @@ Currently supported commands are:
   string specified on the command line is the zone configuration text
   that would ordinarily be placed in :iscman:`named.conf`.

-   The configuration is saved in an LMDB database called
-   ``viewname.nzd``. ``viewname`` is the name of the view, unless the
-   view name contains characters that are incompatible with use as a
-   file name, in which case a cryptographic hash of the view name is
-   used instead. When :iscman:`named` is restarted, the file is loaded
-   into the view configuration so that zones that were added can
-   persist after a restart.
+   The configuration is saved in a file called ``viewname.nzf`` (or, if
+   :iscman:`named` is compiled with liblmdb, an LMDB database file called
+   ``viewname.nzd``). ``viewname`` is the name of the view, unless the view
+   name contains characters that are incompatible with use as a file
+   name, in which case a cryptographic hash of the view name is used
+   instead. When :iscman:`named` is restarted, the file is loaded into
+   the view configuration so that zones that were added can persist
+   after a restart.

   This sample ``addzone`` command adds the zone ``example.com`` to
   the default view:
@@ -321,19 +322,6 @@ Currently supported commands are:
      keys in the event of a trust anchor rollover, or as a brute-force
      repair for key maintenance problems.

-.. option:: memprof [(on | off | dump)]
-
-   This command controls memory profiling. To have any effect, :iscman:`named` must be
-   built with jemalloc, the library have profiling support enabled and run with the
-   ``prof:true`` allocator configuration. (either via ``MALLOC_CONF`` or ``/etc/malloc.conf``)
-
-   The ``prof_active:false`` option is recommended to ensure the profiling overhead does
-   not affect :iscman:`named` when not needed.
-
-   The ``on`` and ``off`` options will start and stop the jemalloc memory profiling respectively.
-   When run with the `dump` option, :iscman:`named` will dump the profile to the working
-   directory. The name will be chosen automatically by jemalloc.
-
 .. option:: modzone zone [class [view]] configuration

   This command modifies the configuration of a zone while the server is running. This
@@ -17,6 +17,7 @@

 #include <isc/attributes.h>
 #include <isc/formatcheck.h>
+#include <isc/lang.h>

 #define NS_CONTROL_PORT 953

@@ -30,8 +31,12 @@
 			notify("%s", name);                               \
 	} while (0)

+ISC_LANG_BEGINDECLS
+
 void
 notify(const char *fmt, ...) ISC_FORMAT_PRINTF(1, 2);

 ISC_NORETURN void
 fatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
+
+ISC_LANG_ENDDECLS
@@ -150,6 +150,7 @@ TESTS =				\
 	sfcache			\
 	shutdown		\
 	smartsign		\
+	sortlist		\
 	spf			\
 	staticstub		\
 	statistics		\
@@ -34,6 +34,6 @@ zone "." {
 	file "redirect.db";
 };

-remote-servers "test" {
+primaries "test" {
 	10.53.0.99;
 };
@@ -36,8 +36,8 @@ n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

-# This tests that migration from NZF to NZD occurs during named
-# startup
+# When LMDB support is compiled in, this tests that migration from
+# NZF to NZD occurs during named startup
 echo_i "checking previously added zone ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.2 a.previous.example a >dig.out.ns2.$n || ret=1
@@ -47,11 +47,13 @@ n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

-echo_i "checking that existing NZF file was renamed after migration ($n)"
-[ -e ns2/3bf305731dd26307.nzf~ ] || ret=1
-n=$((n + 1))
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=$((status + ret))
+if $FEATURETEST --with-lmdb; then
+  echo_i "checking that existing NZF file was renamed after migration ($n)"
+  [ -e ns2/3bf305731dd26307.nzf~ ] || ret=1
+  n=$((n + 1))
+  if [ $ret != 0 ]; then echo_i "failed"; fi
+  status=$((status + ret))
+fi

 echo_i "adding new zone ($n)"
 ret=0
@@ -124,6 +126,16 @@ n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

+if ! $FEATURETEST --with-lmdb; then
+  echo_i "verifying no comments in NZF file ($n)"
+  ret=0
+  hcount=$(grep "^# New zone file for view: _default" ns2/3bf305731dd26307.nzf | wc -l)
+  [ $hcount -eq 0 ] || ret=1
+  n=$((n + 1))
+  if [ $ret != 0 ]; then echo_i "failed"; fi
+  status=$((status + ret))
+fi
+
 echo_i "checking rndc showzone with previously added zone ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 showzone previous.example >rndc.out.ns2.$n
@@ -133,11 +145,13 @@ n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

-echo_i "checking zone is present in NZD ($n)"
-ret=0
-$NZD2NZF ns2/_default.nzd | grep previous.example >/dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=$((status + ret))
+if $FEATURETEST --with-lmdb; then
+  echo_i "checking zone is present in NZD ($n)"
+  ret=0
+  $NZD2NZF ns2/_default.nzd | grep previous.example >/dev/null || ret=1
+  if [ $ret != 0 ]; then echo_i "failed"; fi
+  status=$((status + ret))
+fi

 echo_i "deleting previously added zone ($n)"
 ret=0
@@ -157,10 +171,22 @@ check_nzd2nzf() (
    && ! grep previous.example nzd2nzf.out.$n >/dev/null
 )

-echo_i "checking zone was deleted from NZD ($n)"
-retry_quiet 10 check_nzd2nzf || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=$((status + ret))
+if $FEATURETEST --with-lmdb; then
+  echo_i "checking zone was deleted from NZD ($n)"
+  retry_quiet 10 check_nzd2nzf || ret=1
+  if [ $ret != 0 ]; then echo_i "failed"; fi
+  status=$((status + ret))
+fi
+
+if ! $FEATURETEST --with-lmdb; then
+  echo_i "checking NZF file now has comment ($n)"
+  ret=0
+  hcount=$(grep "^# New zone file for view: _default" ns2/3bf305731dd26307.nzf | wc -l)
+  [ $hcount -eq 1 ] || ret=1
+  n=$((n + 1))
+  if [ $ret != 0 ]; then echo_i "failed"; fi
+  status=$((status + ret))
+fi

 echo_i "deleting newly added zone added.example ($n)"
 ret=0
@@ -482,12 +508,24 @@ n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

-echo_i "verifying added.example in external view created an external.nzd DB ($n)"
-ret=0
-[ -e ns2/external.nzd ] || ret=1
-n=$((n + 1))
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=$((status + ret))
+if ! $FEATURETEST --with-lmdb; then
+  echo_i "checking new NZF file has comment ($n)"
+  ret=0
+  hcount=$(grep "^# New zone file for view: external" ns2/external.nzf | wc -l)
+  [ $hcount -eq 1 ] || ret=1
+  n=$((n + 1))
+  if [ $ret != 0 ]; then echo_i "failed"; fi
+  status=$((status + ret))
+fi
+
+if $FEATURETEST --with-lmdb; then
+  echo_i "verifying added.example in external view created an external.nzd DB ($n)"
+  ret=0
+  [ -e ns2/external.nzd ] || ret=1
+  n=$((n + 1))
+  if [ $ret != 0 ]; then echo_i "failed"; fi
+  status=$((status + ret))
+fi

 echo_i "checking rndc reload causes named to reload the external view's new zone config ($n)"
 ret=0
@@ -506,7 +544,11 @@ status=$((status + ret))

 echo_i "checking rndc showzone with newly added zone ($n)"
 _check_rndc_showzone_newly_added() (
-  expected='zone "added.example" { type primary; file "added.db"; };'
+  if ! $FEATURETEST --with-lmdb; then
+    expected='zone "added.example" in external { type primary; file "added.db"; };'
+  else
+    expected='zone "added.example" { type primary; file "added.db"; };'
+  fi
  $RNDCCMD 10.53.0.2 showzone added.example in external >rndc.out.ns2.$n 2>/dev/null \
    && [ "$(cat rndc.out.ns2.$n)" = "$expected" ]
 )
@@ -609,8 +651,13 @@ n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

-echo_i "checking NZD file was created in new-zones-directory ($n)"
-expect=ns2/new-zones/directory.nzd
+if $FEATURETEST --with-lmdb; then
+  echo_i "checking NZD file was created in new-zones-directory ($n)"
+  expect=ns2/new-zones/directory.nzd
+else
+  echo_i "checking NZF file was created in new-zones-directory ($n)"
+  expect=ns2/new-zones/directory.nzf
+fi
 $RNDCCMD 10.53.0.2 sync 'added.example IN directory' 2>&1 | sed 's/^/I:ns2 /'
 sleep 2
 [ -e "$expect" ] || ret=1
@@ -646,6 +693,19 @@ n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

+if ! $FEATURETEST --with-lmdb; then
+  echo_i "check that addzone is fully reversed on failure (--with-lmdb=no) ($n)"
+  ret=0
+  $RNDCCMD 10.53.0.3 addzone "test1.baz" '{ type primary; file "e.db"; };' >/dev/null 2>&1 || ret=1
+  $RNDCCMD 10.53.0.3 addzone "test2.baz" '{ type primary; file "dne.db"; };' >/dev/null 2>&1 && ret=1
+  $RNDCCMD 10.53.0.3 addzone "test3.baz" '{ type primary; file "e.db"; };' >/dev/null 2>&1 || ret=1
+  $RNDCCMD 10.53.0.3 delzone "test3.baz" >/dev/null 2>&1 || ret=1
+  grep test2.baz ns3/_default.nzf >/dev/null && ret=1
+  n=$((n + 1))
+  if [ $ret != 0 ]; then echo_i "failed"; fi
+  status=$((status + ret))
+fi
+
 _check_version_bind() (
  $DIG $DIGOPTS @10.53.0.3 version.bind txt ch >dig.out.test$n \
    && grep "status: NOERROR" dig.out.test$n >/dev/null
@@ -11,5 +11,5 @@
 * information regarding copyright ownership.
 */

-remote-servers duplicate { 1.2.3.4; };
+primaries duplicate { 1.2.3.4; };
 primaries duplicate { 4.3.2.1; };
@@ -11,5 +11,5 @@
 * information regarding copyright ownership.
 */

-remote-servers duplicate { 1.2.3.4; };
-remote-servers duplicate { 4.3.2.1; };
+masters duplicate { 1.2.3.4; };
+primaries duplicate { 4.3.2.1; };
@@ -12,7 +12,7 @@
 */

 view "test" {
-	remote-servers "net" {
+	parental-agents "net" {
 		192.168.1.2;
 	 };
 	zone "example.net" {
@@ -11,11 +11,11 @@
 * information regarding copyright ownership.
 */

-remote-servers "net" {
+parental-agents "net" {
 	192.168.1.1;
 };

-remote-servers "net" {
+parental-agents "net" {
 	192.168.1.2;
 };

@@ -11,7 +11,7 @@
 * information regarding copyright ownership.
 */

-remote-servers "net" { };
+parental-agents "net" { };

 zone "example.net" {
 	type primary;
@@ -11,7 +11,7 @@
 * information regarding copyright ownership.
 */

-remote-servers "com" {
+parental-agents "com" {
 	192.168.1.2;
 };

@@ -11,7 +11,7 @@
 * information regarding copyright ownership.
 */

-remote-servers "net" {
+primaries "net" {
 	 192.168.1.2;
 };

@@ -14,6 +14,8 @@
 options {
 	dnssec-validation yes;
 	max-zone-ttl 600;
+
+	sortlist { };
 };

 trust-anchors {
@@ -11,5 +11,5 @@
 * information regarding copyright ownership.
 */

-remote-servers a { 1.2.3.4; };
-remote-servers b { 1.2.3.4; };
+masters a { 1.2.3.4; };
+primaries b { 1.2.3.4; };
@@ -86,7 +86,7 @@ options {
 	transfer-source 0.0.0.0;
 	zone-statistics none;
 };
-remote-servers "parents" port 5353 source 10.10.10.10 source-v6 2001:db8::10 {
+parental-agents "parents" port 5353 source 10.10.10.10 source-v6 2001:db8::10 {
 	10.10.10.11;
 	2001:db8::11;
 };
@@ -12,8 +12,8 @@
 */

 acl "transferees" {};
-remote-servers "stealthPrimaries" {127.0.0.1;};
-remote-servers "publicSecondaries" {127.0.0.1;};
+primaries "stealthPrimaries" {127.0.0.1;};
+primaries "publicSecondaries" {127.0.0.1;};
 zone "example.net" {
 	type secondary;
 	key-directory "/var/lib/bind/example.net";
@@ -12,8 +12,8 @@
 */

 acl "transferees" {};
-remote-servers "stealthPrimaries" {127.0.0.1;};
-remote-servers "publicSecondaries" {127.0.0.1;};
+primaries "stealthPrimaries" {127.0.0.1;};
+primaries "publicSecondaries" {127.0.0.1;};
 zone "example.net" {
 	type secondary;
 	file "/var/cache/bind/example.net.db";
@@ -12,8 +12,8 @@
 */

 acl "transferees" {};
-remote-servers "stealthPrimaries" {127.0.0.1;};
-remote-servers "publicSecondaries" {127.0.0.1;};
+primaries "stealthPrimaries" {127.0.0.1;};
+primaries "publicSecondaries" {127.0.0.1;};
 zone "example.net" {
 	type secondary;
 	key-directory "/var/lib/bind/example.net";
@@ -109,14 +109,26 @@ for lmdb in lmdb-*.conf; do
  n=$((n + 1))
  ret=0

-  echo_i "checking that named-checkconf detects no error in $lmdb ($n)"
-  {
-    $CHECKCONF $lmdb >checkconf.out$n 2>&1
-    rc=$?
-  } || true
-  if [ $rc -ne 0 ]; then
-    echo_i "failed"
-    ret=1
+  if $FEATURETEST --with-lmdb; then
+    echo_i "checking that named-checkconf detects no error in $lmdb ($n)"
+    {
+      $CHECKCONF $lmdb >checkconf.out$n 2>&1
+      rc=$?
+    } || true
+    if [ $rc -ne 0 ]; then
+      echo_i "failed"
+      ret=1
+    fi
+  else
+    echo_i "checking that named-checkconf detects error in $lmdb ($n)"
+    {
+      $CHECKCONF $lmdb >checkconf.out$n 2>&1
+      rc=$?
+    } || true
+    if [ $rc -eq 0 ]; then
+      echo_i "failed"
+      ret=1
+    fi
  fi
  status=$((status + ret))
 done
@@ -172,6 +184,7 @@ echo_i "checking named-checkconf deprecate warnings ($n)"
 ret=0
 $CHECKCONF deprecated.conf >checkconf.out$n.1 2>&1 || ret=1
 grep "option 'max-zone-ttl' is deprecated" <checkconf.out$n.1 >/dev/null || ret=1
+grep "option 'sortlist' is deprecated" <checkconf.out$n.1 >/dev/null || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
 # set -i to ignore deprecate warnings
@@ -723,5 +736,16 @@ if [ $ret != 0 ]; then
 fi
 status=$((status + ret))

+n=$((n + 1))
+echo_i "check for obsolete option warnings ($n)"
+ret=0
+$CHECKCONF warn-obsolete.conf >checkconf.out$n 2>&1 || ret=1
+grep -F "option 'multi-master' is obsolete and should be removed" checkconf.out$n >/dev/null || ret=1
+if [ $ret != 0 ]; then
+  echo_i "failed"
+  ret=1
+fi
+status=$((status + ret))
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -11,18 +11,8 @@
 * information regarding copyright ownership.
 */

-remote-servers "one" {
-	1.2.3.4;
-};
-
-parental-agents "two" {
-	1.2.3.5;
-};
-
-primaries "three" {
-	1.2.3.6;
-};
-
-masters "four" {
-	1.2.3.7;
+zone . {
+	type secondary;
+	primaries { 10.53.0.1; 10.53.0.2; };
+	multi-master yes;
 };
@@ -37,7 +37,7 @@ controls {
 	inet 10.53.0.9 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
 };

-remote-servers "ns8" port @PORT@ {
+parental-agents "ns8" port @PORT@ {
 	10.53.0.8;
 };

@@ -44,10 +44,6 @@ for db in zones/bad*.db; do
    zones/bad-dns-sd-reverse.db | zones/bad-svcb-servername.db)
      $CHECKZONE -k fail -i local 0.0.0.0.in-addr.arpa $db >test.out.$n 2>&1 || v=$?
      ;;
-    bad-cname-and*.db)
-      $CHECKZONE -i local example $db >test.out.$n 2>&1 || v=$?
-      grep "CNAME and other data" test.out.$n >/dev/null || ret=1
-      ;;
    *)
      $CHECKZONE -i local example $db >test.out.$n 2>&1 || v=$?
      ;;
@@ -222,41 +218,5 @@ echo $lines
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

-echo_i "Checking for 'zone has A records but is not served by IPv4 servers' warning ($n)"
-ret=0
-$CHECKZONE example zones/warn.no-a.server.db >test.out1.$n 2>&1 || ret=1
-grep "zone has A records but is not served by IPv4 servers" test.out1.$n >/dev/null || ret=1
-grep "zone has AAAA records but is not served by IPv6 servers" test.out1.$n >/dev/null && ret=1
-n=$((n + 1))
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=$((status + ret))
-
-echo_i "Checking for 'zone has AAAA records but is not served by IPv6 servers' warning ($n)"
-ret=0
-$CHECKZONE example zones/warn.no-aaaa.server.db >test.out1.$n 2>&1 || ret=1
-grep "zone has AAAA records but is not served by IPv6 servers" test.out1.$n >/dev/null || ret=1
-grep "zone has A records but is not served by IPv4 servers" test.out1.$n >/dev/null && ret=1
-n=$((n + 1))
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=$((status + ret))
-
-echo_i "Checking for 'zone has A records but is not served by IPv4 servers' warning for glue ($n)"
-ret=0
-$CHECKZONE example zones/warn.no-a.server.glue.db >test.out1.$n 2>&1 || ret=1
-grep "zone has A records but is not served by IPv4 servers" test.out1.$n >/dev/null || ret=1
-grep "zone has AAAA records but is not served by IPv6 servers" test.out1.$n >/dev/null && ret=1
-n=$((n + 1))
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=$((status + ret))
-
-echo_i "Checking for 'zone has AAAA records but is not served by IPv6 servers' warning for glue ($n)"
-ret=0
-$CHECKZONE example zones/warn.no-aaaa.server.glue.db >test.out1.$n 2>&1 || ret=1
-grep "zone has AAAA records but is not served by IPv6 servers" test.out1.$n >/dev/null || ret=1
-grep "zone has A records but is not served by IPv4 servers" test.out1.$n >/dev/null && ret=1
-n=$((n + 1))
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=$((status + ret))
-
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		A	192.0.2.1
-bad		CNAME	@
@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A6	0 ::1
-bad		WKS	10.0.0.1 tcp telnet ftp 0 1 2
-bad		CNAME	@
@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		AAAA	::1
-bad		CNAME	@
@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		BAD	65535 .
-bad		CNAME	@
@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		APL
-bad		CNAME	@
@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		ATMA	+61200000000
-bad		CNAME	@
@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		ATMRELAY	0 0 0
-bad		CNAME	@
@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		AVC	foo:bar
-bad		CNAME	@
@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		CAA	128 tbs "Unknown"
-bad		CNAME	@
@@ -1,20 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		CDNSKEY	512 ( 255 1 AQMFD5raczCJHViKtLYhWGz8hMY
-			9UGRuniJDBzC7w0aRyzWZriO6i2odGWWQVucZqKV
-			sENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esg
-			a60zyGW6LFe9r8n6paHrlG5ojqf0BaqHT+8= )
-bad		CNAME	@
@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		CDS	30795 1 1 310D27F4D82C1FC2400704EA9939FE6E1CEA A3B9
-bad		CNAME	@
@@ -1,20 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		CERT	65534 65535 254 (
-			MxFcby9k/yvedMfQgKzhH5er0Mu/vILz45I
-			kskceFGgiWCn/GxHhai6VAuHAoNUz4YoU1t
-			VfSCSqQYn6//11U6Nld80jEeC8aTrO+KKmCaY= )
-bad		CNAME	@
@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		CSYNC	0 0 A NS AAAA
-bad		CNAME	@
@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		DHCID	AAIBY2/AuCccgoJbsaxcQc9TUapptP69l OjxfNuVAA2kjEA=
-bad		CNAME	@
@@ -1,19 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		DLV	30795 1 1 (
-			310D27F4D82C1FC2400704EA9939FE6E1CEA
-			A3B9 )
-bad		CNAME	@
@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		DNAME	@
-bad		CNAME	@
@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		DOA	0 1 2 "" aHR0cHM6Ly93d3cuaXNjLm9yZy8=
-bad		CNAME	@
@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		EID	12 89 AB
-bad		CNAME	@
@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		EUI48	01-23-45-67-89-ab
-bad		CNAME	@
@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		EUI64	01-23-45-67-89-ab-cd-ef
-bad		CNAME	@
@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		GPOS	-22.6882 116.8652 250.0
-bad		CNAME	@
@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		HINFO	. .
-bad		CNAME	@
@@ -1,19 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		HIP	( 2 200100107B1A74DF365639CC39F1D578
-			AwEAAbdxyhNuSutc5EMzxTs9LBPCIkOFH8cIvM4p9+LrV4e19WzK00+CI6zBCQTdtWsuxKbWIy87UOoJTwkUs7lBu+Upr1gsNrut79ryra+bSRGQb1slImA8YVJyuIDsj7kwzG7jnERNqnWxZ48AWkskmdHaVDP4BcelrTI3rMXdXF5D
-			rvs.example.com. )
-bad		CNAME	@
@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		HTTPS	0 example.net.
-bad		CNAME	@
@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-bad		IPSECKEY	10 1 2 192.0.2.38 AQNRU3mG7TVTO2BkR47usntb102uFJtugbo6BSGvgqt4AQ==
-bad		CNAME	@
--- a/Show More
+++ b/Show More