Return raw zone serial for inline zones

Disable ZONEVERSION for built-in chaos and empty zones
Check that 'provide-zoneversion no;' works
2025-03-24 17:32:52 +11:00 · 2025-03-24 17:32:52 +11:00 · 2025-03-24 17:32:52 +11:00 · 2025-03-24 17:32:52 +11:00 · 2025-03-24 17:32:52 +11:00 · 2025-03-24 14:22:07 +11:00
88 changed files with 1470 additions and 484 deletions
@@ -328,6 +328,7 @@ help(void) {
 	       "                 +[no]yaml           (Present the results as "
 	       "YAML)\n"
 	       "                 +[no]zflag          (Set Z flag in query)\n"
+	       "                 +[no]zoneversion    (Request zone version)\n"
 	       "        global d-opts and servers (before host name) affect "
 	       "all "
 	       "queries.\n"
@@ -2574,9 +2575,22 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 			lookup->rrcomments = -1;
 		}
 		break;
-	case 'z': /* zflag */
-		FULLCHECK("zflag");
-		lookup->zflag = state;
+	case 'z':
+		switch (cmd[1]) {
+		case 'f': /* zflag */
+			FULLCHECK("zflag");
+			lookup->zflag = state;
+			break;
+		case 'o': /* zoneversion */
+			FULLCHECK("zoneversion");
+			if (state && lookup->edns == -1) {
+				lookup->edns = DEFAULT_EDNS_VERSION;
+			}
+			lookup->zoneversion = state;
+			break;
+		default:
+			goto invalid_option;
+		}
 		break;
 	default:
 	invalid_option:
@@ -757,6 +757,10 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
   This option sets [or does not set] the last unassigned DNS header flag in a DNS query.
   This flag is off by default.

+.. option:: +zoneversion, +nozoneversion
+
+   When enabled, this option includes an EDNS Zone Version request when sending a query.
+
 Multiple Queries
 ~~~~~~~~~~~~~~~~

@@ -705,6 +705,7 @@ clone_lookup(dig_lookup_t *lookold, bool servers) {
 	looknew->opcode = lookold->opcode;
 	looknew->expire = lookold->expire;
 	looknew->nsid = lookold->nsid;
+	looknew->zoneversion = lookold->zoneversion;
 	looknew->tcp_keepalive = lookold->tcp_keepalive;
 	looknew->header_only = lookold->header_only;
 	looknew->https_mode = lookold->https_mode;
@@ -2591,6 +2592,14 @@ setup_lookup(dig_lookup_t *lookup) {
 			i++;
 		}

+		if (lookup->zoneversion) {
+			INSIST(i < MAXOPTS);
+			opts[i].code = DNS_OPT_ZONEVERSION;
+			opts[i].length = 0;
+			opts[i].value = NULL;
+			i++;
+		}
+
 		if (lookup->ednsoptscnt != 0) {
 			INSIST(i + lookup->ednsoptscnt <= MAXOPTS);
 			memmove(&opts[i], lookup->ednsopts,
@@ -121,7 +121,7 @@ struct dig_lookup {
 		tcp_mode, tcp_mode_set, tls_mode, /*% connect using TLS */
 		trace,				  /*% dig +trace */
 		trace_root, /*% initial query for either +trace or +nssearch */
-		ttlunits, use_usec, waiting_connect, zflag;
+		ttlunits, use_usec, waiting_connect, zflag, zoneversion;
 	char textname[MXNAME]; /*% Name we're going to be looking up */
 	char cmdline[MXNAME];
 	dns_rdatatype_t rdtype;
@@ -73,7 +73,13 @@ usage(void) {
 	fprintf(stderr, "    -k: generate a TYPE=KEY key\n");
 	fprintf(stderr, "    -L ttl: default key TTL\n");
 	fprintf(stderr, "    -M <min>:<max>: allowed Key ID range\n");
+	fprintf(stderr, "    -n nametype: ZONE | HOST | ENTITY | USER | "
+			"OTHER\n");
 	fprintf(stderr, "        (DNSKEY generation defaults to ZONE\n");
+	fprintf(stderr, "    -p protocol: default: 3 [dnssec]\n");
+	fprintf(stderr, "    -t type: "
+			"AUTHCONF | NOAUTHCONF | NOAUTH | NOCONF "
+			"(default: AUTHCONF)\n");
 	fprintf(stderr, "    -y: permit keys that might collide\n");
 	fprintf(stderr, "    -v verbose level\n");
 	fprintf(stderr, "    -V: print version information\n");
@@ -105,6 +111,7 @@ usage(void) {
 int
 main(int argc, char **argv) {
 	char *algname = NULL, *freeit = NULL;
+	char *nametype = NULL, *type = NULL;
 	const char *directory = NULL;
 	const char *predecessor = NULL;
 	dst_key_t *prevkey = NULL;
@@ -118,6 +125,7 @@ main(int argc, char **argv) {
 	bool oldstyle = false;
 	isc_mem_t *mctx = NULL;
 	int ch;
+	int protocol = -1, signatory = 0;
 	isc_result_t ret;
 	isc_textregion_t r;
 	char filename[255];
@@ -215,13 +223,17 @@ main(int argc, char **argv) {
 			break;
 		}
 		case 'n':
-			fatal("The -n option has been deprecated.");
+			nametype = isc_commandline_argument;
 			break;
 		case 'p':
-			fatal("The -p option has been deprecated.");
+			protocol = strtol(isc_commandline_argument, &endp, 10);
+			if (*endp != '\0' || protocol < 0 || protocol > 255) {
+				fatal("-p must be followed by a number "
+				      "[0..255]");
+			}
 			break;
 		case 't':
-			fatal("The -t option has been deprecated.");
+			type = isc_commandline_argument;
 			break;
 		case 'v':
 			verbose = strtol(isc_commandline_argument, &endp, 0);
@@ -404,6 +416,21 @@ main(int argc, char **argv) {
 			}
 		}

+		if (type != NULL && (options & DST_TYPE_KEY) != 0) {
+			if (strcasecmp(type, "NOAUTH") == 0) {
+				flags |= DNS_KEYTYPE_NOAUTH;
+			} else if (strcasecmp(type, "NOCONF") == 0) {
+				flags |= DNS_KEYTYPE_NOCONF;
+			} else if (strcasecmp(type, "NOAUTHCONF") == 0) {
+				flags |= (DNS_KEYTYPE_NOAUTH |
+					  DNS_KEYTYPE_NOCONF);
+			} else if (strcasecmp(type, "AUTHCONF") == 0) {
+				/* nothing */
+			} else {
+				fatal("invalid type %s", type);
+			}
+		}
+
 		if (!oldstyle && prepub > 0) {
 			if (setpub && setact && (activate - prepub) < publish) {
 				fatal("Activation and publication dates "
@@ -440,6 +467,12 @@ main(int argc, char **argv) {
 		if (algname != NULL) {
 			fatal("-S and -a cannot be used together");
 		}
+		if (nametype != NULL) {
+			fatal("-S and -n cannot be used together");
+		}
+		if (type != NULL) {
+			fatal("-S and -t cannot be used together");
+		}
 		if (setpub || unsetpub) {
 			fatal("-S and -P cannot be used together");
 		}
@@ -521,25 +554,59 @@ main(int argc, char **argv) {
 		setpub = setact = true;
 	}

+	if (nametype == NULL) {
+		if ((options & DST_TYPE_KEY) != 0) { /* KEY */
+			fatal("no nametype specified");
+		}
+		flags |= DNS_KEYOWNER_ZONE; /* DNSKEY */
+	} else if (strcasecmp(nametype, "zone") == 0) {
+		flags |= DNS_KEYOWNER_ZONE;
+	} else if ((options & DST_TYPE_KEY) != 0) { /* KEY */
+		if (strcasecmp(nametype, "host") == 0 ||
+		    strcasecmp(nametype, "entity") == 0)
+		{
+			flags |= DNS_KEYOWNER_ENTITY;
+		} else if (strcasecmp(nametype, "user") == 0) {
+			flags |= DNS_KEYOWNER_USER;
+		} else {
+			fatal("invalid KEY nametype %s", nametype);
+		}
+	} else if (strcasecmp(nametype, "other") != 0) { /* DNSKEY */
+		fatal("invalid DNSKEY nametype %s", nametype);
+	}
+
 	rdclass = strtoclass(classname);

 	if (directory == NULL) {
 		directory = ".";
 	}

-	if ((options & DST_TYPE_KEY) == 0) {
-		flags |= DNS_KEYOWNER_ZONE; /* DNSKEY: name type ZONE */
+	if ((options & DST_TYPE_KEY) != 0) { /* KEY */
+		flags |= signatory;
+	} else if ((flags & DNS_KEYOWNER_ZONE) != 0) { /* DNSKEY */
 		flags |= kskflag;
 		flags |= revflag;
-	} else {
-		flags |= DNS_KEYOWNER_ENTITY; /* KEY: name type HOST */
+	}
+
+	if (protocol == -1) {
+		protocol = DNS_KEYPROTO_DNSSEC;
+	} else if ((options & DST_TYPE_KEY) == 0 &&
+		   protocol != DNS_KEYPROTO_DNSSEC)
+	{
+		fatal("invalid DNSKEY protocol: %d", protocol);
+	}
+
+	if ((flags & DNS_KEYFLAG_TYPEMASK) == DNS_KEYTYPE_NOKEY) {
+		if ((flags & DNS_KEYFLAG_SIGNATORYMASK) != 0) {
+			fatal("specified null key with signing authority");
+		}
 	}

 	isc_buffer_init(&buf, filename, sizeof(filename) - 1);

 	/* associate the key */
-	ret = dst_key_fromlabel(name, alg, flags, DNS_KEYPROTO_DNSSEC, rdclass,
-				label, NULL, mctx, &key);
+	ret = dst_key_fromlabel(name, alg, flags, protocol, rdclass, label,
+				NULL, mctx, &key);

 	if (ret != ISC_R_SUCCESS) {
 		char namestr[DNS_NAME_FORMATSIZE];
@@ -21,7 +21,7 @@ dnssec-keyfromlabel - DNSSEC key generation tool
 Synopsis
 ~~~~~~~~

-:program:`dnssec-keyfromlabel` {**-l** label} [**-3**] [**-a** algorithm] [**-A** date/offset] [**-c** class] [**-D** date/offset] [**-D** sync date/offset] [**-f** flag] [**-G**] [**-I** date/offset] [**-i** interval] [**-k**] [**-K** directory] [**-L** ttl] [**-M** tag_min:tag_max] [**-P** date/offset] [**-P** sync date/offset] [**-p** protocol] [**-R** date/offset] [**-S** key] [**-v** level] [**-V**] [**-y**] {name}
+:program:`dnssec-keyfromlabel` {**-l** label} [**-3**] [**-a** algorithm] [**-A** date/offset] [**-c** class] [**-D** date/offset] [**-D** sync date/offset] [**-f** flag] [**-G**] [**-I** date/offset] [**-i** interval] [**-k**] [**-K** directory] [**-L** ttl] [**-M** tag_min:tag_max] [**-n** nametype] [**-P** date/offset] [**-P** sync date/offset] [**-p** protocol] [**-R** date/offset] [**-S** key] [**-t** type] [**-v** level] [**-V**] [**-y**] {name}

 Description
 ~~~~~~~~~~~
@@ -70,6 +70,14 @@ Options
   When BIND 9 is built with OpenSSL-based PKCS#11 support, the label is
   an arbitrary string that identifies a particular key.

+.. option:: -n nametype
+
+   This option specifies the owner type of the key. The value of ``nametype`` must
+   either be ZONE (for a DNSSEC zone key (KEY/DNSKEY)), HOST or ENTITY
+   (for a key associated with a host (KEY)), USER (for a key associated
+   with a user (KEY)), or OTHER (DNSKEY). These values are
+   case-insensitive.
+
 .. option:: -C

   This option enables compatibility mode, which generates an old-style key, without any metadata.
@@ -127,6 +135,12 @@ Options
   values for ``tag_min`` and ``tag_max`` are [0..65535].  The
   default allows all key tag values to be accepted.

+.. option:: -p protocol
+
+   This option sets the protocol value for the key. The protocol is a number between
+   0 and 255. The default is 3 (DNSSEC). Other possible values for this
+   argument are listed in :rfc:`2535` and its successors.
+
 .. option:: -S key

   This option generates a key as an explicit successor to an existing key. The name,
@@ -136,6 +150,13 @@ Options
   set to the activation date minus the prepublication interval, which
   defaults to 30 days.

+.. option:: -t type
+
+   This option indicates the type of the key. ``type`` must be one of AUTHCONF,
+   NOAUTHCONF, NOAUTH, or NOCONF. The default is AUTHCONF. AUTH refers
+   to the ability to authenticate data, and CONF to the ability to encrypt
+   data.
+
 .. option:: -v level

   This option sets the debugging level.
@@ -82,11 +82,16 @@ struct keygen_ctx {
 	const char *directory;
 	dns_keystore_t *keystore;
 	char *algname;
+	char *nametype;
+	char *type;
+	int protocol;
 	int size;
 	uint16_t tag_min;
 	uint16_t tag_max;
+	int signatory;
 	dns_rdataclass_t rdclass;
 	int options;
+	int dbits;
 	dns_ttl_t ttl;
 	bool wantzsk;
 	bool wantksk;
@@ -163,14 +168,23 @@ usage(void) {
 	fprintf(stderr, "        ED448:\tignored\n");
 	fprintf(stderr, "        (key size defaults are set according to\n"
 			"        algorithm and usage (ZSK or KSK)\n");
+	fprintf(stderr, "    -n <nametype>: ZONE | HOST | ENTITY | "
+			"USER | OTHER\n");
+	fprintf(stderr, "        (DNSKEY generation defaults to ZONE)\n");
 	fprintf(stderr, "    -c <class>: (default: IN)\n");
 	fprintf(stderr, "    -d <digest bits> (0 => max, default)\n");
 	fprintf(stderr, "    -f <keyflag>: ZSK | KSK | REVOKE\n");
 	fprintf(stderr, "    -F: FIPS mode\n");
 	fprintf(stderr, "    -L <ttl>: default key TTL\n");
 	fprintf(stderr, "    -M <min>:<max>: allowed Key ID range\n");
+	fprintf(stderr, "    -p <protocol>: (default: 3 [dnssec])\n");
+	fprintf(stderr, "    -s <strength>: strength value this key signs DNS "
+			"records with (default: 0)\n");
 	fprintf(stderr, "    -T <rrtype>: DNSKEY | KEY (default: DNSKEY; "
 			"use KEY for SIG(0))\n");
+	fprintf(stderr, "    -t <type>: "
+			"AUTHCONF | NOAUTHCONF | NOAUTH | NOCONF "
+			"(default: AUTHCONF)\n");
 	fprintf(stderr, "    -h: print usage and exit\n");
 	fprintf(stderr, "    -m <memory debugging mode>:\n");
 	fprintf(stderr, "       usage | trace | record\n");
@@ -300,6 +314,24 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 			}
 		}

+		if (ctx->type != NULL && (ctx->options & DST_TYPE_KEY) != 0) {
+			if (strcasecmp(ctx->type, "NOAUTH") == 0) {
+				flags |= DNS_KEYTYPE_NOAUTH;
+			} else if (strcasecmp(ctx->type, "NOCONF") == 0) {
+				flags |= DNS_KEYTYPE_NOCONF;
+			} else if (strcasecmp(ctx->type, "NOAUTHCONF") == 0) {
+				flags |= (DNS_KEYTYPE_NOAUTH |
+					  DNS_KEYTYPE_NOCONF);
+				if (ctx->size < 0) {
+					ctx->size = 0;
+				}
+			} else if (strcasecmp(ctx->type, "AUTHCONF") == 0) {
+				/* nothing */
+			} else {
+				fatal("invalid type %s", ctx->type);
+			}
+		}
+
 		if (ctx->size < 0) {
 			switch (ctx->alg) {
 			case DST_ALG_RSASHA1:
@@ -371,6 +403,12 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 		if (ctx->size >= 0) {
 			fatal("-S and -b cannot be used together");
 		}
+		if (ctx->nametype != NULL) {
+			fatal("-S and -n cannot be used together");
+		}
+		if (ctx->type != NULL) {
+			fatal("-S and -t cannot be used together");
+		}
 		if (ctx->setpub || ctx->unsetpub) {
 			fatal("-S and -P cannot be used together");
 		}
@@ -484,17 +522,34 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 		break;
 	}

-	if ((ctx->options & DST_TYPE_KEY) == 0) {
-		flags |= DNS_KEYOWNER_ZONE; /* DNSKEY: name type ZONE */
-	} else {
-		flags |= DNS_KEYOWNER_ENTITY; /* KEY: name type HOST */
+	if (ctx->nametype == NULL) {
+		if ((ctx->options & DST_TYPE_KEY) != 0) { /* KEY */
+			fatal("no nametype specified");
+		}
+		flags |= DNS_KEYOWNER_ZONE; /* DNSKEY */
+	} else if (strcasecmp(ctx->nametype, "zone") == 0) {
+		flags |= DNS_KEYOWNER_ZONE;
+	} else if ((ctx->options & DST_TYPE_KEY) != 0) { /* KEY */
+		if (strcasecmp(ctx->nametype, "host") == 0 ||
+		    strcasecmp(ctx->nametype, "entity") == 0)
+		{
+			flags |= DNS_KEYOWNER_ENTITY;
+		} else if (strcasecmp(ctx->nametype, "user") == 0) {
+			flags |= DNS_KEYOWNER_USER;
+		} else {
+			fatal("invalid KEY nametype %s", ctx->nametype);
+		}
+	} else if (strcasecmp(ctx->nametype, "other") != 0) { /* DNSKEY */
+		fatal("invalid DNSKEY nametype %s", ctx->nametype);
 	}

 	if (ctx->directory == NULL) {
 		ctx->directory = ".";
 	}

-	if ((flags & DNS_KEYOWNER_ZONE) != 0) { /* DNSKEY */
+	if ((ctx->options & DST_TYPE_KEY) != 0) { /* KEY */
+		flags |= ctx->signatory;
+	} else if ((flags & DNS_KEYOWNER_ZONE) != 0) { /* DNSKEY */
 		if (ctx->ksk || ctx->wantksk) {
 			flags |= DNS_KEYFLAG_KSK;
 		}
@@ -503,6 +558,23 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 		}
 	}

+	if (ctx->protocol == -1) {
+		ctx->protocol = DNS_KEYPROTO_DNSSEC;
+	} else if ((ctx->options & DST_TYPE_KEY) == 0 &&
+		   ctx->protocol != DNS_KEYPROTO_DNSSEC)
+	{
+		fatal("invalid DNSKEY protocol: %d", ctx->protocol);
+	}
+
+	if ((flags & DNS_KEYFLAG_TYPEMASK) == DNS_KEYTYPE_NOKEY) {
+		if (ctx->size > 0) {
+			fatal("specified null key with non-zero size");
+		}
+		if ((flags & DNS_KEYFLAG_SIGNATORYMASK) != 0) {
+			fatal("specified null key with signing authority");
+		}
+	}
+
 	switch (ctx->alg) {
 	case DNS_KEYALG_RSASHA1:
 	case DNS_KEYALG_NSEC3RSASHA1:
@@ -538,12 +610,12 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 				mctx, ctx->alg, ctx->size, flags, &key);
 		} else if (!ctx->quiet && show_progress) {
 			ret = dst_key_generate(name, ctx->alg, ctx->size, 0,
-					       flags, DNS_KEYPROTO_DNSSEC,
+					       flags, ctx->protocol,
 					       ctx->rdclass, NULL, mctx, &key,
 					       &progress);
 		} else {
 			ret = dst_key_generate(name, ctx->alg, ctx->size, 0,
-					       flags, DNS_KEYPROTO_DNSSEC,
+					       flags, ctx->protocol,
 					       ctx->rdclass, NULL, mctx, &key,
 					       NULL);
 		}
@@ -560,6 +632,8 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 			      algstr, isc_result_totext(ret));
 		}

+		dst_key_setbits(key, ctx->dbits);
+
 		/*
 		 * Set key timing metadata (unless using -C)
 		 *
@@ -772,6 +846,7 @@ main(int argc, char **argv) {
 	keygen_ctx_t ctx = {
 		.options = DST_TYPE_PRIVATE | DST_TYPE_PUBLIC,
 		.prepub = -1,
+		.protocol = -1,
 		.size = -1,
 		.now = isc_stdtime_now(),
 	};
@@ -833,7 +908,10 @@ main(int argc, char **argv) {
 			classname = isc_commandline_argument;
 			break;
 		case 'd':
-			fatal("The -d option has been deprecated.");
+			ctx.dbits = strtol(isc_commandline_argument, &endp, 10);
+			if (*endp != '\0' || ctx.dbits < 0) {
+				fatal("-d requires a non-negative number");
+			}
 			break;
 		case 'E':
 			fatal("%s", isc_result_totext(DST_R_NOENGINE));
@@ -870,7 +948,7 @@ main(int argc, char **argv) {
 			ctx.configfile = isc_commandline_argument;
 			break;
 		case 'n':
-			fatal("The -n option has been deprecated.");
+			ctx.nametype = isc_commandline_argument;
 			break;
 		case 'M': {
 			unsigned long ul;
@@ -890,7 +968,14 @@ main(int argc, char **argv) {
 		case 'm':
 			break;
 		case 'p':
-			fatal("The -p option has been deprecated.");
+			ctx.protocol = strtol(isc_commandline_argument, &endp,
+					      10);
+			if (*endp != '\0' || ctx.protocol < 0 ||
+			    ctx.protocol > 255)
+			{
+				fatal("-p must be followed by a number "
+				      "[0..255]");
+			}
 			break;
 		case 'q':
 			ctx.quiet = true;
@@ -900,13 +985,21 @@ main(int argc, char **argv) {
 			      "System random data is always used.\n");
 			break;
 		case 's':
-			fatal("The -s option has been deprecated.");
+			ctx.signatory = strtol(isc_commandline_argument, &endp,
+					       10);
+			if (*endp != '\0' || ctx.signatory < 0 ||
+			    ctx.signatory > 15)
+			{
+				fatal("-s must be followed by a number "
+				      "[0..15]");
+			}
 			break;
 		case 'T':
 			if (strcasecmp(isc_commandline_argument, "KEY") == 0) {
 				ctx.options |= DST_TYPE_KEY;
 			} else if (strcasecmp(isc_commandline_argument,
-					      "DNSKEY") == 0)
+					      "DNSKE"
+					      "Y") == 0)
 			{
 				/* default behavior */
 			} else {
@@ -915,7 +1008,7 @@ main(int argc, char **argv) {
 			}
 			break;
 		case 't':
-			fatal("The -t option has been deprecated.");
+			ctx.type = isc_commandline_argument;
 			break;
 		case 'v':
 			endp = NULL;
@@ -1077,6 +1170,9 @@ main(int argc, char **argv) {
 	}

 	if (ctx.policy != NULL) {
+		if (ctx.nametype != NULL) {
+			fatal("-k and -n cannot be used together");
+		}
 		if (ctx.predecessor != NULL) {
 			fatal("-k and -S cannot be used together");
 		}
@@ -1095,7 +1191,7 @@ main(int argc, char **argv) {
 		if (ctx.wantrev) {
 			fatal("-k and -fR cannot be used together");
 		}
-		if ((ctx.options & DST_TYPE_KEY) != 0) {
+		if (ctx.options & DST_TYPE_KEY) {
 			fatal("-k and -T KEY cannot be used together");
 		}
 		if (ctx.use_nsec3) {
@@ -21,7 +21,7 @@ dnssec-keygen: DNSSEC key generation tool
 Synopsis
 ~~~~~~~~

-:program:`dnssec-keygen` [**-3**] [**-A** date/offset] [**-a** algorithm] [**-b** keysize] [**-C**] [**-c** class] [**-D** date/offset] [**-D** sync date/offset] [**-f** flag] [**-F**] [**-G**] [**-h**] [**-I** date/offset] [**-i** interval] [**-K** directory] [**-k** policy] [**-L** ttl] [**-l** file] [**-M** tag_min:tag_max] [**-P** date/offset] [**-P** sync date/offset] [**-p** protocol] [**-q**] [**-R** date/offset] [**-S** key] [**-s** strength] [**-T** rrtype] [**-V**] [**-v** level] {name}
+:program:`dnssec-keygen` [**-3**] [**-A** date/offset] [**-a** algorithm] [**-b** keysize] [**-C**] [**-c** class] [**-D** date/offset] [**-d** bits] [**-D** sync date/offset] [**-f** flag] [**-F**] [**-G**] [**-h**] [**-I** date/offset] [**-i** interval] [**-K** directory] [**-k** policy] [**-L** ttl] [**-l** file] [**-M** tag_min:tag_max] [**-n** nametype] [**-P** date/offset] [**-P** sync date/offset] [**-p** protocol] [**-q**] [**-R** date/offset] [**-S** key] [**-s** strength] [**-T** rrtype] [**-t** type] [**-V**] [**-v** level] {name}

 Description
 ~~~~~~~~~~~
@@ -87,6 +87,13 @@ Options
   This option indicates that the DNS record containing the key should have the
   specified class. If not specified, class IN is used.

+.. option:: -d bits
+
+   This option specifies the key size in bits. For the algorithms RSASHA1, NSEC3RSASA1, RSASHA256, and
+   RSASHA512 the key size must be between 1024 and 4096 bits; DH size is between 128
+   and 4096 bits. This option is ignored for algorithms ECDSAP256SHA256,
+   ECDSAP384SHA384, ED25519, and ED448.
+
 .. option:: -f flag

   This option sets the specified flag in the flag field of the KEY/DNSKEY record.
@@ -156,6 +163,21 @@ Options
   key tag values to be produced.  This option is ignored when ``-k policy``
   is specified.

+.. option:: -n nametype
+
+   This option specifies the owner type of the key. The value of ``nametype`` must
+   either be ZONE (for a DNSSEC zone key (KEY/DNSKEY)), HOST or ENTITY
+   (for a key associated with a host (KEY)), USER (for a key associated
+   with a user (KEY)), or OTHER (DNSKEY). These values are
+   case-insensitive. The default is ZONE for DNSKEY generation.
+
+.. option:: -p protocol
+
+   This option sets the protocol value for the generated key, for use with
+   :option:`-T KEY <-T>`. The protocol is a number between 0 and 255. The default
+   is 3 (DNSSEC). Other possible values for this argument are listed in
+   :rfc:`2535` and its successors.
+
 .. option:: -q

   This option sets quiet mode, which suppresses unnecessary output, including progress
@@ -176,6 +198,11 @@ Options
   set to the activation date minus the prepublication interval,
   which defaults to 30 days.

+.. option:: -s strength
+
+   This option specifies the strength value of the key. The strength is a number
+   between 0 and 15, and currently has no defined purpose in DNSSEC.
+
 .. option:: -T rrtype

   This option specifies the resource record type to use for the key. ``rrtype``
@@ -183,6 +210,13 @@ Options
   DNSSEC algorithm, but it can be overridden to KEY for use with
   SIG(0).

+.. option:: -t type
+
+   This option indicates the type of the key for use with :option:`-T KEY <-T>`. ``type``
+   must be one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF. The default
+   is AUTHCONF. AUTH refers to the ability to authenticate data, and
+   CONF to the ability to encrypt data.
+
 .. option:: -V

   This option prints version information.
@@ -99,6 +99,7 @@ options {\n\
 	recursing-file \"named.recursing\";\n\
 	recursive-clients 1000;\n\
 	request-nsid false;\n\
+	request-zoneversion false;\n\
 	resolver-query-timeout 10;\n\
 #	responselog <boolean>;\n\
 	rrset-order { order random; };\n\
@@ -239,6 +240,7 @@ options {\n\
 	notify yes;\n\
 	notify-delay 5;\n\
 	notify-to-soa no;\n\
+	provide-zoneversion yes;\n\
 	send-report-channel .;\n\
 	serial-update-method increment;\n\
 	sig-signing-nodes 100;\n\
@@ -260,6 +262,7 @@ view \"_bind\" chaos {\n\
 	notify no;\n\
 	allow-new-zones no;\n\
 	max-cache-size 2M;\n\
+	provide-zoneversion no;\n\
 \n\
 	# Prevent use of this zone in DNS amplified reflection DoS attacks\n\
 	rate-limit {\n\
@@ -1391,6 +1391,13 @@ configure_peer(const cfg_obj_t *cpeer, isc_mem_t *mctx, dns_peer_t **peerp) {
 		CHECK(dns_peer_setrequestnsid(peer, cfg_obj_asboolean(obj)));
 	}

+	obj = NULL;
+	(void)cfg_map_get(cpeer, "request-zoneversion", &obj);
+	if (obj != NULL) {
+		CHECK(dns_peer_setrequestzoneversion(peer,
+						     cfg_obj_asboolean(obj)));
+	}
+
 	obj = NULL;
 	(void)cfg_map_get(cpeer, "send-cookie", &obj);
 	if (obj != NULL) {
@@ -3246,6 +3253,7 @@ create_empty_zone(dns_zone_t *pzone, dns_name_t *name, dns_view_t *view,

 	dns_zone_setoption(zone, ~DNS_ZONEOPT_NOCHECKNS, false);
 	dns_zone_setoption(zone, DNS_ZONEOPT_NOCHECKNS, true);
+	dns_zone_setoption(zone, DNS_ZONEOPT_ZONEVERSION, false);
 	dns_zone_setcheckdstype(zone, dns_checkdstype_no);
 	dns_zone_setnotifytype(zone, dns_notifytype_no);
 	dns_zone_setautomatic(zone, true);
@@ -5132,6 +5140,11 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	INSIST(result == ISC_R_SUCCESS);
 	view->requestnsid = cfg_obj_asboolean(obj);

+	obj = NULL;
+	result = named_config_get(maps, "request-zoneversion", &obj);
+	INSIST(result == ISC_R_SUCCESS);
+	view->requestzoneversion = cfg_obj_asboolean(obj);
+
 	obj = NULL;
 	result = named_config_get(maps, "send-cookie", &obj);
 	INSIST(result == ISC_R_SUCCESS);
@@ -358,6 +358,8 @@ init_desc(void) {
 	SET_NSSTATDESC(expireopt, "Expire option received", "ExpireOpt");
 	SET_NSSTATDESC(keepaliveopt, "EDNS TCP keepalive option received",
 		       "KeepAliveOpt");
+	SET_NSSTATDESC(zoneversionopt, "ZONEVERSION option received",
+		       "ZoneVersionOpt");
 	SET_NSSTATDESC(padopt, "EDNS padding option received", "PadOpt");
 	SET_NSSTATDESC(otheropt, "Other EDNS option received", "OtherOpt");
 	SET_NSSTATDESC(cookiein, "COOKIE option received", "CookieIn");
@@ -1227,6 +1227,12 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			dns_zone_setkasp(zone, NULL);
 		}

+		obj = NULL;
+		result = named_config_get(maps, "provide-zoneversion", &obj);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
+		dns_zone_setoption(zone, DNS_ZONEOPT_ZONEVERSION,
+				   cfg_obj_asboolean(obj));
+
 		obj = NULL;
 		result = named_config_get(maps, "notify", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
@@ -31,6 +31,7 @@ server 0.0.0.0 {
 	request-ixfr no;
 	request-ixfr-max-diffs 0;
 	request-nsid no;
+	request-zoneversion no;
 	require-cookie no;
 	send-cookie no;
 	tcp-keepalive no;
@@ -55,6 +56,7 @@ server :: {
 	request-ixfr no;
 	request-ixfr-max-diffs 0;
 	request-nsid no;
+	request-zoneversion no;
 	require-cookie no;
 	send-cookie no;
 	tcp-keepalive no;
@@ -22,8 +22,8 @@ zonefile=root.db

 echo_i "ns1/setup.sh"

-ksk=$("$KEYGEN" -q -fk -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
-zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+ksk=$("$KEYGEN" -q -fk -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
+zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")

 cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile"
 "$SIGNER" -g -o "$zone" "$zonefile" >/dev/null 2>&1
@@ -20,7 +20,7 @@ set -e

 cp "../ns2/dsset-example." .

-ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" .)
+ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone .)

 cp root.db.in root.db

@@ -36,4 +36,5 @@ zone "example" {
 zone "example.tld" {
 	type primary;
 	file "example.tld.db";
+	provide-zoneversion no;
 };
@@ -16,7 +16,7 @@

 set -e

-ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" example.)
+ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone example.)

 cp example.db.in example.db

@@ -28,5 +28,5 @@ grep -Ev '^;' <"$ksk.key" | cut -f 7- -d ' ' >keydata
 keyfile_to_initial_keys "$ksk" >../ns3/anchor.dnskey
 keyfile_to_initial_ds "$ksk" >../ns3/anchor.ds

-ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" example.tld.)
+ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone example.tld.)
 "$SIGNER" -Sz -f example.tld.db -o example.tld example.db.in >/dev/null 2>&1
@@ -801,6 +801,73 @@ if [ -x "$DIG" ]; then
  if [ $ret -ne 0 ]; then echo_i "failed"; fi
  status=$((status + ret))

+  n=$((n + 1))
+  echo_i "checking dig +zoneversion to a authoritative server ($n)"
+  ret=0
+  dig_with_opts @10.53.0.2 +zoneversion a.example >dig.out.test$n 2>&1 || ret=1
+  pat="; ZONEVERSION: ZONE: example, SOA-SERIAL: 2000042407"
+  grep "$pat" dig.out.test$n >/dev/null || ret=1
+  if [ $ret -ne 0 ]; then echo_i "failed"; fi
+  status=$((status + ret))
+
+  n=$((n + 1))
+  echo_i "checking dig +zoneversion to a authoritative server with zoneversion disabled ($n)"
+  ret=0
+  dig_with_opts @10.53.0.2 +zoneversion a.example.tld >dig.out.test$n 2>&1 || ret=1
+  grep "status: NOERROR" dig.out.test$n >/dev/null || ret=1
+  grep "; ZONEVERSION:" dig.out.test$n >/dev/null && ret=1
+  if [ $ret -ne 0 ]; then echo_i "failed"; fi
+  status=$((status + ret))
+
+  if [ $HAS_PYYAML -ne 0 ]; then
+    n=$((n + 1))
+    echo_i "checking dig +yaml +zoneversion to a authoritative server ($n)"
+    ret=0
+    dig_with_opts @10.53.0.2 +yaml +zoneversion a.example >dig.out.test$n 2>&1 || ret=1
+    $PYTHON yamlget.py dig.out.test$n 0 message response_message_data OPT_PSEUDOSECTION EDNS ZONEVERSION >yamlget.out.test$n 2>&1 || ret=1
+    read -r value <yamlget.out.test$n
+    expected="{'ZONE': 'example', 'SOA-SERIAL': 2000042407}"
+    [ "$value" = "$expected" ] || ret=1
+    if [ $ret -ne 0 ]; then echo_i "failed"; fi
+    status=$((status + ret))
+  fi
+
+  n=$((n + 1))
+  echo_i "checking dig +ednsopt=ZONEVERSION:<answer> to a authoritative server ($n)"
+  ret=0
+  dig_with_opts @10.53.0.2 +ednsopt=ZONEVERSION:0100000007DA a.example >dig.out.test$n 2>&1 || ret=1
+  grep "status: FORMERR" dig.out.test$n >/dev/null || ret=1
+  grep "; ZONEVERSION:" dig.out.test$n >/dev/null && ret=1
+  if [ $ret -ne 0 ]; then echo_i "failed"; fi
+  status=$((status + ret))
+
+  n=$((n + 1))
+  echo_i "checking dig +zoneversion to a recursive server ($n)"
+  ret=0
+  dig_with_opts @10.53.0.3 +zoneversion a.example >dig.out.test$n 2>&1 || ret=1
+  grep '; ZONEVERSION:' dig.out.test$n >/dev/null && ret=1
+  if [ $ret -ne 0 ]; then echo_i "failed"; fi
+  status=$((status + ret))
+
+  n=$((n + 1))
+  echo_i "checking display of non serial type zoneversion ($n)"
+  ret=0
+  dig_with_opts @10.53.0.2 +qr +ednsopt=ZONEVERSION:0100000007DA a.example >dig.out.test$n 2>&1 || ret=1
+  grep '; ZONEVERSION: LABELS: 1, TYPE: 0, VALUE: 000007da ("....")' dig.out.test$n >/dev/null && ret=1
+  if [ $ret -ne 0 ]; then echo_i "failed"; fi
+  status=$((status + ret))
+
+  if [ $HAS_PYYAML -ne 0 ]; then
+    n=$((n + 1))
+    echo_i "checking display of non serial type zoneversion +yaml ($n)"
+    ret=0
+    dig_with_opts @10.53.0.2 +qr +ednsopt=ZONEVERSION:0100000007DA a.example +yaml >dig.out.test$n 2>&1 || ret=1
+    $PYTHON yamlget.py dig.out.test$n 0 message query_message_data OPT_PSEUDOSECTION EDNS ZONEVERSION >yamlget.out.test$n 2>&1 || ret=1
+    expected="{'ZONE': 'example', 'TYPE': 1, 'VALUE': 000007da, PVALUE: '....'}"
+    if [ $ret -ne 0 ]; then echo_i "failed"; fi
+    status=$((status + ret))
+  fi
+
  n=$((n + 1))
  echo_i "check that dig gracefully handles bad escape in domain name ($n)"
  ret=0
@@ -38,8 +38,8 @@ cp "../ns2/dsset-inconsistent." .
 grep "$DEFAULT_ALGORITHM_NUMBER [12] " "../ns2/dsset-algroll." >"dsset-algroll."
 cp "../ns6/dsset-optout-tld." .

-ksk=$("$KEYGEN" -q -fk -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
-zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+ksk=$("$KEYGEN" -q -fk -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
+zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")

 cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile"

@@ -34,8 +34,8 @@ zone=managed.
 infile=key.db.in
 zonefile=managed.db

-keyname1=$("$KEYGEN" -q -a "$ALTERNATIVE_ALGORITHM" -b "$ALTERNATIVE_BITS" -f KSK "$zone")
-keyname2=$("$KEYGEN" -q -a "$ALTERNATIVE_ALGORITHM" -b "$ALTERNATIVE_BITS" "$zone")
+keyname1=$("$KEYGEN" -q -a "$ALTERNATIVE_ALGORITHM" -b "$ALTERNATIVE_BITS" -n zone -f KSK "$zone")
+keyname2=$("$KEYGEN" -q -a "$ALTERNATIVE_ALGORITHM" -b "$ALTERNATIVE_BITS" -n zone "$zone")

 cat "$infile" "$keyname1.key" "$keyname2.key" >"$zonefile"

@@ -45,8 +45,8 @@ zone=trusted.
 infile=key.db.in
 zonefile=trusted.db

-keyname1=$("$KEYGEN" -q -a "$ALTERNATIVE_ALGORITHM" -b "$ALTERNATIVE_BITS" -f KSK "$zone")
-keyname2=$("$KEYGEN" -q -a "$ALTERNATIVE_ALGORITHM" -b "$ALTERNATIVE_BITS" "$zone")
+keyname1=$("$KEYGEN" -q -a "$ALTERNATIVE_ALGORITHM" -b "$ALTERNATIVE_BITS" -n zone -f KSK "$zone")
+keyname2=$("$KEYGEN" -q -a "$ALTERNATIVE_ALGORITHM" -b "$ALTERNATIVE_BITS" -n zone "$zone")

 cat "$infile" "$keyname1.key" "$keyname2.key" >"$zonefile"

@@ -70,8 +70,8 @@ for subdomain in digest-alg-unsupported ds-unsupported secure badds \
 done

 # Sign the "example." zone.
-keyname1=$("$KEYGEN" -q -a "$ALTERNATIVE_ALGORITHM" -b "$ALTERNATIVE_BITS" -f KSK "$zone")
-keyname2=$("$KEYGEN" -q -a "$ALTERNATIVE_ALGORITHM" -b "$ALTERNATIVE_BITS" "$zone")
+keyname1=$("$KEYGEN" -q -a "$ALTERNATIVE_ALGORITHM" -b "$ALTERNATIVE_BITS" -n zone -f KSK "$zone")
+keyname2=$("$KEYGEN" -q -a "$ALTERNATIVE_ALGORITHM" -b "$ALTERNATIVE_BITS" -n zone "$zone")

 cat "$infile" "$keyname1.key" "$keyname2.key" >"$zonefile"

@@ -132,8 +132,8 @@ zone=in-addr.arpa.
 infile=in-addr.arpa.db.in
 zonefile=in-addr.arpa.db

-keyname1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
-keyname2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+keyname1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+keyname2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")

 cat "$infile" "$keyname1.key" "$keyname2.key" >"$zonefile"
 "$SIGNER" -g -o "$zone" -k "$keyname1" "$zonefile" "$keyname2" >/dev/null 2>&1
@@ -144,8 +144,8 @@ zone=badparam.
 infile=badparam.db.in
 zonefile=badparam.db

-keyname1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
-keyname2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+keyname1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+keyname2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")

 cat "$infile" "$keyname1.key" "$keyname2.key" >"$zonefile"

@@ -159,8 +159,8 @@ zone=single-nsec3.
 infile=single-nsec3.db.in
 zonefile=single-nsec3.db

-keyname1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
-keyname2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+keyname1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+keyname2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")

 cat "$infile" "$keyname1.key" "$keyname2.key" >"$zonefile"

@@ -175,10 +175,10 @@ zone=algroll.
 infile=algroll.db.in
 zonefile=algroll.db

-keyold1=$("$KEYGEN" -q -a "$ALTERNATIVE_ALGORITHM" -b "$ALTERNATIVE_BITS" -f KSK "$zone")
-keyold2=$("$KEYGEN" -q -a "$ALTERNATIVE_ALGORITHM" -b "$ALTERNATIVE_BITS" "$zone")
-keynew1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
-keynew2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+keyold1=$("$KEYGEN" -q -a "$ALTERNATIVE_ALGORITHM" -b "$ALTERNATIVE_BITS" -n zone -f KSK "$zone")
+keyold2=$("$KEYGEN" -q -a "$ALTERNATIVE_ALGORITHM" -b "$ALTERNATIVE_BITS" -n zone "$zone")
+keynew1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+keynew2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")

 cat "$infile" "$keynew1.key" "$keynew2.key" >"$zonefile"

@@ -203,16 +203,16 @@ while [ $i -le 300 ]; do
  echo "host$i 10 IN NS ns.elsewhere"
  i=$((i + 1))
 done >>"$zonefile"
-key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
-key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 cat "$key1.key" "$key2.key" >>"$zonefile"
 "$SIGNER" -3 - -A -H 1 -g -o "$zone" -k "$key1" "$zonefile" "$key2" >/dev/null 2>&1

 zone=cds.secure
 infile=cds.secure.db.in
 zonefile=cds.secure.db
-key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
-key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 "$DSFROMKEY" -C "$key1.key" >"$key1.cds"
 cat "$infile" "$key1.key" "$key2.key" "$key1.cds" >$zonefile
 "$SIGNER" -g -o "$zone" "$zonefile" >/dev/null 2>&1
@@ -220,9 +220,9 @@ cat "$infile" "$key1.key" "$key2.key" "$key1.cds" >$zonefile
 zone=cds-x.secure
 infile=cds.secure.db.in
 zonefile=cds-x.secure.db
-key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
-key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
-key3=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+key3=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 "$DSFROMKEY" -C "$key2.key" >"$key2.cds"
 cat "$infile" "$key1.key" "$key2.key" "$key3.key" "$key2.cds" >"$zonefile"
 "$SIGNER" -g -x -o "$zone" "$zonefile" >/dev/null 2>&1
@@ -230,8 +230,8 @@ cat "$infile" "$key1.key" "$key2.key" "$key3.key" "$key2.cds" >"$zonefile"
 zone=cds-update.secure
 infile=cds-update.secure.db.in
 zonefile=cds-update.secure.db
-key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
-key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 cat "$infile" "$key1.key" "$key2.key" >"$zonefile"
 "$SIGNER" -g -o "$zone" "$zonefile" >/dev/null 2>&1
 keyfile_to_key_id "$key1" >cds-update.secure.id
@@ -239,16 +239,16 @@ keyfile_to_key_id "$key1" >cds-update.secure.id
 zone=cds-auto.secure
 infile=cds-auto.secure.db.in
 zonefile=cds-auto.secure.db
-key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
-key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 $SETTIME -P sync now "$key1" >/dev/null
 cat "$infile" >"$zonefile.signed"

 zone=cdnskey.secure
 infile=cdnskey.secure.db.in
 zonefile=cdnskey.secure.db
-key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
-key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 sed 's/DNSKEY/CDNSKEY/' "$key1.key" >"$key1.cds"
 cat "$infile" "$key1.key" "$key2.key" "$key1.cds" >"$zonefile"
 "$SIGNER" -g -o "$zone" "$zonefile" >/dev/null 2>&1
@@ -256,9 +256,9 @@ cat "$infile" "$key1.key" "$key2.key" "$key1.cds" >"$zonefile"
 zone=cdnskey-x.secure
 infile=cdnskey.secure.db.in
 zonefile=cdnskey-x.secure.db
-key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
-key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
-key3=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+key3=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 sed 's/DNSKEY/CDNSKEY/' "$key1.key" >"$key1.cds"
 cat "$infile" "$key1.key" "$key2.key" "$key3.key" "$key1.cds" >"$zonefile"
 "$SIGNER" -g -x -o "$zone" "$zonefile" >/dev/null 2>&1
@@ -266,8 +266,8 @@ cat "$infile" "$key1.key" "$key2.key" "$key3.key" "$key1.cds" >"$zonefile"
 zone=cdnskey-update.secure
 infile=cdnskey-update.secure.db.in
 zonefile=cdnskey-update.secure.db
-key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
-key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 cat "$infile" "$key1.key" "$key2.key" >"$zonefile"
 "$SIGNER" -g -o "$zone" "$zonefile" >/dev/null 2>&1
 keyfile_to_key_id "$key1" >cdnskey-update.secure.id
@@ -275,16 +275,16 @@ keyfile_to_key_id "$key1" >cdnskey-update.secure.id
 zone=cdnskey-auto.secure
 infile=cdnskey-auto.secure.db.in
 zonefile=cdnskey-auto.secure.db
-key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
-key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 $SETTIME -P sync now "$key1" >/dev/null
 cat "$infile" >"$zonefile.signed"

 zone=updatecheck-kskonly.secure
 infile=template.secure.db.in
 zonefile=${zone}.db
-key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
-key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 # Save key id's for checking active key usage
 keyfile_to_key_id "$key1" >$zone.ksk.id
 keyfile_to_key_id "$key2" >$zone.zsk.id
@@ -300,8 +300,8 @@ mv $zonefile "$zonefile.signed"
 zone=hours-vs-days
 infile=hours-vs-days.db.in
 zonefile=hours-vs-days.db
-key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
-key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 $SETTIME -P sync now "$key1" >/dev/null
 cat "$infile" >"$zonefile.signed"

@@ -311,8 +311,8 @@ cat "$infile" >"$zonefile.signed"
 zone=too-many-iterations
 infile=too-many-iterations.db.in
 zonefile=too-many-iterations.db
-key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
-key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 cat "$infile" "$key1.key" "$key2.key" >"$zonefile"
 "$SIGNER" -P -3 - -H too-many -g -o "$zone" "$zonefile" >/dev/null 2>&1

@@ -322,10 +322,10 @@ cat "$infile" "$key1.key" "$key2.key" >"$zonefile"
 zone=lazy-ksk
 infile=lazy-ksk.db.in
 zonefile=lazy-ksk.db
-ksk1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
-ksk2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
-ksk3=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
-zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+ksk1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+ksk2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+ksk3=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 cat "$infile" "$ksk1.key" "$ksk2.key" "$ksk3.key" "$zsk.key" >"$zonefile"
 $DSFROMKEY "$ksk1.key" >"dsset-$zone."
 $DSFROMKEY "$ksk2.key" >>"dsset-$zone."
@@ -364,8 +364,8 @@ rm "$rm2.private"
 zone=peer.peer-ns-spoof
 infile=peer.peer-ns-spoof.db.in
 zonefile=peer.peer-ns-spoof.db
-ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
-zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile"
 "$SIGNER" -g -o "$zone" "$zonefile" >/dev/null 2>&1
 "$CHECKZONE" -D -q -i local "$zone" "$zonefile.signed" \
@@ -383,8 +383,8 @@ cp "$zonefile.stripped" "$zonefile.signed"
 zone=peer-ns-spoof
 infile=peer-ns-spoof.db.in
 zonefile=peer-ns-spoof.db
-ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
-zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile"
 "$SIGNER" -g -o "$zone" "$zonefile" >/dev/null 2>&1

@@ -394,8 +394,8 @@ cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile"
 zone=dnskey-rrsigs-stripped
 infile=dnskey-rrsigs-stripped.db.in
 zonefile=dnskey-rrsigs-stripped.db
-ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
-zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile"
 "$SIGNER" -g -o "$zone" "$zonefile" >/dev/null 2>&1
 "$CHECKZONE" -D -q -i local "$zone" "$zonefile.signed" \
@@ -411,8 +411,8 @@ cp "$zonefile.stripped" "$zonefile.signed"
 zone=child.ds-rrsigs-stripped
 infile=child.ds-rrsigs-stripped.db.in
 zonefile=child.ds-rrsigs-stripped.db
-ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
-zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile"
 "$SIGNER" -g -o "$zone" "$zonefile" >/dev/null 2>&1

@@ -422,8 +422,8 @@ cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile"
 zone=ds-rrsigs-stripped
 infile=ds-rrsigs-stripped.db.in
 zonefile=ds-rrsigs-stripped.db
-ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
-zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile"
 "$SIGNER" -g -o "$zone" "$zonefile" >/dev/null 2>&1
 "$CHECKZONE" -D -q -i local "$zone" "$zonefile.signed" \
@@ -439,7 +439,7 @@ cp "$zonefile.stripped" "$zonefile.signed"
 zone=inconsistent
 infile=inconsistent.db.in
 zonefile=inconsistent.db
-key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
-key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 cat "$infile" "$key1.key" "$key2.key" >"$zonefile"
 "$SIGNER" -3 - -g -o "$zone" "$zonefile" >/dev/null 2>&1
@@ -24,7 +24,7 @@ for tld in managed trusted; do
  zone=secure.${tld}
  zonefile=${zone}.db

-  keyname1=$("$KEYGEN" -f KSK -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+  keyname1=$("$KEYGEN" -f KSK -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
  cat "$infile" "$keyname1.key" >"$zonefile"
  "$SIGNER" -z -P -3 - -o "$zone" -O full -f ${zonefile}.signed "$zonefile" >/dev/null

@@ -32,7 +32,7 @@ for tld in managed trusted; do
  zone=disabled.${tld}
  zonefile=${zone}.db

-  keyname2=$("$KEYGEN" -f KSK -q -a "$DISABLED_ALGORITHM" -b "$DISABLED_BITS" "$zone")
+  keyname2=$("$KEYGEN" -f KSK -q -a "$DISABLED_ALGORITHM" -b "$DISABLED_BITS" -n zone "$zone")
  cat "$infile" "$keyname2.key" >"$zonefile"
  "$SIGNER" -z -P -3 - -o "$zone" -O full -f ${zonefile}.signed "$zonefile" >/dev/null

@@ -40,7 +40,7 @@ for tld in managed trusted; do
  zone=enabled.${tld}
  zonefile=${zone}.db

-  keyname3=$("$KEYGEN" -f KSK -q -a "$DISABLED_ALGORITHM" -b "$DISABLED_BITS" "$zone")
+  keyname3=$("$KEYGEN" -f KSK -q -a "$DISABLED_ALGORITHM" -b "$DISABLED_BITS" -n zone "$zone")
  cat "$infile" "$keyname3.key" >"$zonefile"
  "$SIGNER" -z -P -3 - -o "$zone" -O full -f ${zonefile}.signed "$zonefile" >/dev/null

@@ -48,7 +48,7 @@ for tld in managed trusted; do
  zone=unsupported.${tld}
  zonefile=${zone}.db

-  keyname4=$("$KEYGEN" -f KSK -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+  keyname4=$("$KEYGEN" -f KSK -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
  cat "$infile" "$keyname4.key" >"$zonefile"
  "$SIGNER" -z -3 - -o "$zone" -O full -f ${zonefile}.tmp "$zonefile" >/dev/null
  awk '$4 == "DNSKEY" { $7 = 255 } $4 == "RRSIG" { $6 = 255 } { print }' ${zonefile}.tmp >${zonefile}.signed
@@ -61,7 +61,7 @@ for tld in managed trusted; do
  zone=revoked.${tld}
  zonefile=${zone}.db

-  keyname5=$("$KEYGEN" -f KSK -f REVOKE -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+  keyname5=$("$KEYGEN" -f KSK -f REVOKE -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
  cat "$infile" "$keyname5.key" >"$zonefile"
  "$SIGNER" -z -P -3 - -o "$zone" -O full -f ${zonefile}.signed "$zonefile" >/dev/null

@@ -81,9 +81,9 @@ zone=secure.example.
 infile=secure.example.db.in
 zonefile=secure.example.db

-cnameandkey=$("$KEYGEN" -T KEY -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "cnameandkey.$zone")
-dnameandkey=$("$KEYGEN" -T KEY -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "dnameandkey.$zone")
-keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+cnameandkey=$("$KEYGEN" -T KEY -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n host "cnameandkey.$zone")
+dnameandkey=$("$KEYGEN" -T KEY -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n host "dnameandkey.$zone")
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")

 cat "$infile" "$cnameandkey.key" "$dnameandkey.key" "$keyname.key" >"$zonefile"

@@ -95,7 +95,7 @@ zone=bogus.example.
 infile=bogus.example.db.in
 zonefile=bogus.example.db

-keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")

 cat "$infile" "$keyname.key" >"$zonefile"

@@ -105,8 +105,8 @@ zone=dynamic.example.
 infile=dynamic.example.db.in
 zonefile=dynamic.example.db

-keyname1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
-keyname2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
+keyname1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
+keyname2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")

 cat "$infile" "$keyname1.key" "$keyname2.key" >"$zonefile"

@@ -116,7 +116,7 @@ zone=keyless.example.
 infile=generic.example.db.in
 zonefile=keyless.example.db

-keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")

 cat "$infile" "$keyname.key" >"$zonefile"

@@ -137,7 +137,7 @@ zone=secure.nsec3.example.
 infile=secure.nsec3.example.db.in
 zonefile=secure.nsec3.example.db

-keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")

 cat "$infile" "$keyname.key" >"$zonefile"

@@ -150,7 +150,7 @@ zone=nsec3.nsec3.example.
 infile=nsec3.nsec3.example.db.in
 zonefile=nsec3.nsec3.example.db

-keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")

 cat "$infile" "$keyname.key" >"$zonefile"

@@ -163,7 +163,7 @@ zone=optout.nsec3.example.
 infile=optout.nsec3.example.db.in
 zonefile=optout.nsec3.example.db

-keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")

 cat "$infile" "$keyname.key" >"$zonefile"

@@ -176,7 +176,7 @@ zone=nsec3.example.
 infile=nsec3.example.db.in
 zonefile=nsec3.example.db

-keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")

 cat "$infile" "$keyname.key" >"$zonefile"

@@ -189,7 +189,7 @@ zone=secure.optout.example.
 infile=secure.optout.example.db.in
 zonefile=secure.optout.example.db

-keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")

 cat "$infile" "$keyname.key" >"$zonefile"

@@ -202,7 +202,7 @@ zone=nsec3.optout.example.
 infile=nsec3.optout.example.db.in
 zonefile=nsec3.optout.example.db

-keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")

 cat "$infile" "$keyname.key" >"$zonefile"

@@ -215,7 +215,7 @@ zone=optout.optout.example.
 infile=optout.optout.example.db.in
 zonefile=optout.optout.example.db

-keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")

 cat "$infile" "$keyname.key" >"$zonefile"

@@ -228,7 +228,7 @@ zone=optout.example.
 infile=optout.example.db.in
 zonefile=optout.example.db

-keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")

 cat "$infile" "$keyname.key" >"$zonefile"

@@ -241,7 +241,7 @@ zone=nsec3-unknown.example.
 infile=nsec3-unknown.example.db.in
 zonefile=nsec3-unknown.example.db

-keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")

 cat "$infile" "$keyname.key" >"$zonefile"

@@ -254,7 +254,7 @@ zone=optout-unknown.example.
 infile=optout-unknown.example.db.in
 zonefile=optout-unknown.example.db

-keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")

 cat "$infile" "$keyname.key" >"$zonefile"

@@ -268,7 +268,7 @@ zone=dnskey-unknown.example
 infile=dnskey-unknown.example.db.in
 zonefile=dnskey-unknown.example.db

-keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")

 cat "$infile" "$keyname.key" >"$zonefile"

@@ -287,7 +287,7 @@ zone=dnskey-unsupported.example
 infile=dnskey-unsupported.example.db.in
 zonefile=dnskey-unsupported.example.db

-keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")

 cat "$infile" "$keyname.key" >"$zonefile"

@@ -306,10 +306,10 @@ zone=digest-alg-unsupported.example.
 infile=digest-alg-unsupported.example.db.in
 zonefile=digest-alg-unsupported.example.db

-cnameandkey=$("$KEYGEN" -T KEY -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "cnameandkey.$zone")
-dnameandkey=$("$KEYGEN" -T KEY -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "dnameandkey.$zone")
-keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
-keyname2=$("$KEYGEN" -q -a ECDSAP384SHA384 -b "$DEFAULT_BITS" "$zone")
+cnameandkey=$("$KEYGEN" -T KEY -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n host "cnameandkey.$zone")
+dnameandkey=$("$KEYGEN" -T KEY -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n host "dnameandkey.$zone")
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
+keyname2=$("$KEYGEN" -q -a ECDSAP384SHA384 -b "$DEFAULT_BITS" -n zone "$zone")

 cat "$infile" "$cnameandkey.key" "$dnameandkey.key" "$keyname.key" "$keyname2.key" >"$zonefile"

@@ -330,9 +330,9 @@ zone=ds-unsupported.example.
 infile=ds-unsupported.example.db.in
 zonefile=ds-unsupported.example.db

-cnameandkey=$("$KEYGEN" -T KEY -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "cnameandkey.$zone")
-dnameandkey=$("$KEYGEN" -T KEY -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "dnameandkey.$zone")
-keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+cnameandkey=$("$KEYGEN" -T KEY -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n host "cnameandkey.$zone")
+dnameandkey=$("$KEYGEN" -T KEY -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n host "dnameandkey.$zone")
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")

 cat "$infile" "$cnameandkey.key" "$dnameandkey.key" "$keyname.key" >"$zonefile"

@@ -348,8 +348,8 @@ zone=dnskey-unsupported-2.example
 infile=dnskey-unsupported-2.example.db.in
 zonefile=dnskey-unsupported-2.example.db

-ksk=$("$KEYGEN" -f KSK -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
-zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+ksk=$("$KEYGEN" -f KSK -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
+zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")

 cat "$infile" "$ksk.key" "$zsk.key" unsupported-algorithm.key >"$zonefile"

@@ -363,7 +363,7 @@ zone=dnskey-nsec3-unknown.example
 infile=dnskey-nsec3-unknown.example.db.in
 zonefile=dnskey-nsec3-unknown.example.db

-keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")

 cat "$infile" "$keyname.key" >"$zonefile"

@@ -381,7 +381,7 @@ zone=multiple.example.
 infile=multiple.example.db.in
 zonefile=multiple.example.db

-keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")

 cat "$infile" "$keyname.key" >"$zonefile"

@@ -405,7 +405,7 @@ zone=rsasha256.example.
 infile=rsasha256.example.db.in
 zonefile=rsasha256.example.db

-keyname=$("$KEYGEN" -q -a RSASHA256 "$zone")
+keyname=$("$KEYGEN" -q -a RSASHA256 -n zone "$zone")

 cat "$infile" "$keyname.key" >"$zonefile"

@@ -418,7 +418,7 @@ zone=rsasha512.example.
 infile=rsasha512.example.db.in
 zonefile=rsasha512.example.db

-keyname=$("$KEYGEN" -q -a RSASHA512 "$zone")
+keyname=$("$KEYGEN" -q -a RSASHA512 -n zone "$zone")

 cat "$infile" "$keyname.key" >"$zonefile"

@@ -497,7 +497,7 @@ cat "$infile" "$kskname.key" "$zskname.key" >"$zonefile"
 zone=secure.below-cname.example.
 infile=secure.below-cname.example.db.in
 zonefile=secure.below-cname.example.db
-keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 cat "$infile" "$keyname.key" >"$zonefile"
 "$SIGNER" -P -o "$zone" "$zonefile" >/dev/null

@@ -510,7 +510,7 @@ zonefile=ttlpatch.example.db
 signedfile=ttlpatch.example.db.signed
 patchedfile=ttlpatch.example.db.patched

-keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 cat "$infile" "$keyname.key" >"$zonefile"

 "$SIGNER" -P -f $signedfile -o "$zone" "$zonefile" >/dev/null
@@ -525,7 +525,7 @@ infile=split-dnssec.example.db.in
 zonefile=split-dnssec.example.db
 signedfile=split-dnssec.example.db.signed

-keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 cat "$infile" "$keyname.key" >"$zonefile"
 echo "\$INCLUDE \"$signedfile\"" >>"$zonefile"
 : >"$signedfile"
@@ -539,7 +539,7 @@ infile=split-smart.example.db.in
 zonefile=split-smart.example.db
 signedfile=split-smart.example.db.signed

-keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 cp "$infile" "$zonefile"
 # shellcheck disable=SC2016
 echo "\$INCLUDE \"$signedfile\"" >>"$zonefile"
@@ -613,7 +613,7 @@ zone=badds.example.
 infile=bogus.example.db.in
 zonefile=badds.example.db

-keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")

 cat "$infile" "$keyname.key" >"$zonefile"

@@ -679,7 +679,7 @@ zonefile=occluded.example.db
 kskname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -fk "$zone")
 zskname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" "$zone")
 dnskeyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -fk "delegation.$zone")
-keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -T KEY "delegation.$zone")
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -n HOST -T KEY "delegation.$zone")
 $DSFROMKEY "$dnskeyname.key" >"dsset-delegation.${zone}."
 cat "$infile" "${kskname}.key" "${zskname}.key" "${keyname}.key" \
  "${dnskeyname}.key" "dsset-delegation.${zone}." >"$zonefile"
@@ -708,7 +708,7 @@ awk '$4 == "DNSKEY" && $5 == 257 { print }' "$zonefile" \
 zone=target.peer-ns-spoof
 infile=target.peer-ns-spoof.db.in
 zonefile=target.peer-ns-spoof.db
-ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
-zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile"
 "$SIGNER" -g -o "$zone" "$zonefile" >/dev/null 2>&1
@@ -34,6 +34,6 @@ keyfile_to_initial_ds "$keyname" >revoked.conf
 "$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK $zone >/dev/null
 "$SIGNER" -S -o "$zone" -f "$zonefile" "$infile" >/dev/null 2>&1

-keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" ".")
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone ".")

 keyfile_to_static_ds "$keyname" >trusted.conf
@@ -22,7 +22,7 @@ zone=optout-tld
 infile=optout-tld.db.in
 zonefile=optout-tld.db

-keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")

 cat "$infile" "$keyname.key" >"$zonefile"

@@ -22,8 +22,8 @@ zone=split-rrsig
 infile=split-rrsig.db.in
 zonefile=split-rrsig.db

-k1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
-k2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+k1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
+k2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")

 cat "$infile" "$k1.key" "$k2.key" >"$zonefile"

@@ -1633,9 +1633,9 @@ echo_i "check dnssec-signzone doesn't sign with prepublished zsk ($n)"
 ret=0
 zone=prepub
 # Generate keys.
-ksk=$("$KEYGEN" -K signer -f KSK -q -a $DEFAULT_ALGORITHM "$zone")
-zsk1=$("$KEYGEN" -K signer -q -a $DEFAULT_ALGORITHM "$zone")
-zsk2=$("$KEYGEN" -K signer -q -a $DEFAULT_ALGORITHM "$zone")
+ksk=$("$KEYGEN" -K signer -f KSK -q -a $DEFAULT_ALGORITHM -n zone "$zone")
+zsk1=$("$KEYGEN" -K signer -q -a $DEFAULT_ALGORITHM -n zone "$zone")
+zsk2=$("$KEYGEN" -K signer -q -a $DEFAULT_ALGORITHM -n zone "$zone")
 zskid1=$(keyfile_to_key_id "$zsk1")
 zskid2=$(keyfile_to_key_id "$zsk2")
 (
@@ -1714,7 +1714,7 @@ echo_i "checking that a DS record cannot be generated for a key using an unsuppo
 ret=0
 zone=example
 # Fake an unsupported algorithm key
-unsupportedkey=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+unsupportedkey=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 awk '$3 == "DNSKEY" { $6 = 255 } { print }' ${unsupportedkey}.key >${unsupportedkey}.tmp
 mv ${unsupportedkey}.tmp ${unsupportedkey}.key
 # If dnssec-dsfromkey fails, the test script will exit immediately.  Prevent
@@ -1742,8 +1742,8 @@ status=$((status + ret))
 echo_i "checking that we can sign a zone with out-of-zone records ($n)"
 ret=0
 zone=example
-key1=$($KEYGEN -K signer -q -a $DEFAULT_ALGORITHM $zone)
-key2=$($KEYGEN -K signer -q -f KSK -a $DEFAULT_ALGORITHM $zone)
+key1=$($KEYGEN -K signer -q -a $DEFAULT_ALGORITHM -n zone $zone)
+key2=$($KEYGEN -K signer -q -f KSK -a $DEFAULT_ALGORITHM -n zone $zone)
 (
  cd signer || exit 1
  cat example.db.in "$key1.key" "$key2.key" >example.db
@@ -1756,8 +1756,8 @@ status=$((status + ret))
 echo_i "checking that we can sign a zone (NSEC3) with out-of-zone records ($n)"
 ret=0
 zone=example
-key1=$($KEYGEN -K signer -q -a $DEFAULT_ALGORITHM $zone)
-key2=$($KEYGEN -K signer -q -f KSK -a $DEFAULT_ALGORITHM $zone)
+key1=$($KEYGEN -K signer -q -a $DEFAULT_ALGORITHM -n zone $zone)
+key2=$($KEYGEN -K signer -q -f KSK -a $DEFAULT_ALGORITHM -n zone $zone)
 (
  cd signer || exit 1
  cat example.db.in "$key1.key" "$key2.key" >example.db
@@ -1781,8 +1781,8 @@ status=$((status + ret))
 echo_i "checking NSEC3 signing with empty nonterminals above a delegation ($n)"
 ret=0
 zone=example
-key1=$($KEYGEN -K signer -q -a $DEFAULT_ALGORITHM $zone)
-key2=$($KEYGEN -K signer -q -f KSK -a $DEFAULT_ALGORITHM $zone)
+key1=$($KEYGEN -K signer -q -a $DEFAULT_ALGORITHM -n zone $zone)
+key2=$($KEYGEN -K signer -q -f KSK -a $DEFAULT_ALGORITHM -n zone $zone)
 (
  cd signer || exit 1
  cat example.db.in "$key1.key" "$key2.key" >example3.db
@@ -1807,8 +1807,8 @@ status=$((status + ret))
 echo_i "checking that dnssec-signzone updates originalttl on ttl changes ($n)"
 ret=0
 zone=example
-key1=$($KEYGEN -K signer -q -a $DEFAULT_ALGORITHM $zone)
-key2=$($KEYGEN -K signer -q -f KSK -a $DEFAULT_ALGORITHM $zone)
+key1=$($KEYGEN -K signer -q -a $DEFAULT_ALGORITHM -n zone $zone)
+key2=$($KEYGEN -K signer -q -f KSK -a $DEFAULT_ALGORITHM -n zone $zone)
 (
  cd signer || exit 1
  cat example.db.in "$key1.key" "$key2.key" >example.db
@@ -1824,10 +1824,10 @@ status=$((status + ret))
 echo_i "checking dnssec-signzone keeps valid signatures from removed keys ($n)"
 ret=0
 zone=example
-key1=$($KEYGEN -K signer -q -f KSK -a $DEFAULT_ALGORITHM $zone)
-key2=$($KEYGEN -K signer -q -a $DEFAULT_ALGORITHM $zone)
+key1=$($KEYGEN -K signer -q -f KSK -a $DEFAULT_ALGORITHM -n zone $zone)
+key2=$($KEYGEN -K signer -q -a $DEFAULT_ALGORITHM -n zone $zone)
 keyid2=$(keyfile_to_key_id "$key2")
-key3=$($KEYGEN -K signer -q -a $DEFAULT_ALGORITHM $zone)
+key3=$($KEYGEN -K signer -q -a $DEFAULT_ALGORITHM -n zone $zone)
 keyid3=$(keyfile_to_key_id "$key3")
 (
  cd signer || exit 1
@@ -3491,13 +3491,13 @@ until test $alg -eq 256; do
      continue
      ;;
    1 | 5 | 7 | 8 | 10) # RSA algorithms
-      key1=$($KEYGEN -a "$alg" -b "2048" "$zone" 2>"keygen-$alg.err" || true)
+      key1=$($KEYGEN -a "$alg" -b "2048" -n zone "$zone" 2>"keygen-$alg.err" || true)
      ;;
    15 | 16)
-      key1=$($KEYGEN -a "$alg" "$zone" 2>"keygen-$alg.err" || true)
+      key1=$($KEYGEN -a "$alg" -n zone "$zone" 2>"keygen-$alg.err" || true)
      ;;
    *)
-      key1=$($KEYGEN -a "$alg" "$zone" 2>"keygen-$alg.err" || true)
+      key1=$($KEYGEN -a "$alg" -n zone "$zone" 2>"keygen-$alg.err" || true)
      ;;
  esac
  if grep "unsupported algorithm" "keygen-$alg.err" >/dev/null; then
@@ -4264,7 +4264,7 @@ test "$ret" -eq 0 || echo_i "failed"
 status=$((status + ret))

 # Roll the ZSK.
-zsk2=$("$KEYGEN" -q -P none -A none -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -K ns2 "$zone")
+zsk2=$("$KEYGEN" -q -P none -A none -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -K ns2 -n zone "$zone")
 keyfile_to_key_id "$zsk2" >ns2/$zone.zsk.id2
 ZSK_ID2=$(cat ns2/$zone.zsk.id2)
 ret=0
@@ -4360,7 +4360,7 @@ mv ns2/$KSK.key.bak ns2/$KSK.key
 mv ns2/$KSK.private.bak ns2/$KSK.private

 # Roll the ZSK again.
-zsk3=$("$KEYGEN" -q -P none -A none -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -K ns2 "$zone")
+zsk3=$("$KEYGEN" -q -P none -A none -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -K ns2 -n zone "$zone")
 ret=0
 keyfile_to_key_id "$zsk3" >ns2/$zone.zsk.id3
 ZSK_ID3=$(cat ns2/$zone.zsk.id3)
@@ -4616,8 +4616,8 @@ status=$((status + ret))
 echo_i "check that dnssec-keygen honours key tag ranges ($n)"
 ret=0
 zone=settagrange
-ksk=$("$KEYGEN" -f KSK -q -a $DEFAULT_ALGORITHM -M 0:32767 "$zone")
-zsk=$("$KEYGEN" -q -a $DEFAULT_ALGORITHM -M 32768:65535 "$zone")
+ksk=$("$KEYGEN" -f KSK -q -a $DEFAULT_ALGORITHM -n zone -M 0:32767 "$zone")
+zsk=$("$KEYGEN" -q -a $DEFAULT_ALGORITHM -n zone -M 32768:65535 "$zone")
 kid=$(keyfile_to_key_id "$ksk")
 zid=$(keyfile_to_key_id "$zsk")
 [ $kid -ge 0 -a $kid -le 32767 ] || ret=1
@@ -22,8 +22,8 @@ zonefile=root.db
 cp ../ns2/dsset-good. .
 cp ../ns2/dsset-bad. .

-key1=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} $zone)
-key2=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -f KSK $zone)
+key1=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+key2=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone)

 cat $infile $key1.key $key2.key >$zonefile

@@ -20,10 +20,10 @@ zone2=bad
 infile2=bad.db.in
 zonefile2=bad.db

-keyname11=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} $zone1)
-keyname12=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -f KSK $zone1)
-keyname21=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} $zone2)
-keyname22=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -f KSK $zone2)
+keyname11=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone1)
+keyname12=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone1)
+keyname21=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone2)
+keyname22=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone2)

 cat $infile1 $keyname11.key $keyname12.key >$zonefile1
 cat $infile2 $keyname21.key $keyname22.key >$zonefile2
@@ -24,15 +24,15 @@ echo_i "ns1/sign.sh"
 cp $infile $zonefile

 if [ $ECDSAP256SHA256_SUPPORTED = 1 ]; then
-  zsk256=$($KEYGEN -q -a ECDSA256 "$zone")
-  ksk256=$($KEYGEN -q -a ECDSA256 -f KSK "$zone")
+  zsk256=$($KEYGEN -q -a ECDSA256 -n zone "$zone")
+  ksk256=$($KEYGEN -q -a ECDSA256 -n zone -f KSK "$zone")
  cat "$ksk256.key" "$zsk256.key" >>"$zonefile"
  $DSFROMKEY -a sha-256 "$ksk256.key" >>dsset-256
 fi

 if [ $ECDSAP384SHA384_SUPPORTED = 1 ]; then
-  zsk384=$($KEYGEN -q -a ECDSA384 "$zone")
-  ksk384=$($KEYGEN -q -a ECDSA384 -f KSK "$zone")
+  zsk384=$($KEYGEN -q -a ECDSA384 -n zone "$zone")
+  ksk384=$($KEYGEN -q -a ECDSA384 -n zone -f KSK "$zone")
  cat "$ksk384.key" "$zsk384.key" >>"$zonefile"
  $DSFROMKEY -a sha-256 "$ksk384.key" >>dsset-256
 fi
@@ -24,15 +24,15 @@ echo_i "ns1/sign.sh"
 cp $infile $zonefile

 if [ $ED25519_SUPPORTED = 1 ]; then
-  zsk25519=$($KEYGEN -q -a ED25519 "$zone")
-  ksk25519=$($KEYGEN -q -a ED25519 -f KSK "$zone")
+  zsk25519=$($KEYGEN -q -a ED25519 -n zone "$zone")
+  ksk25519=$($KEYGEN -q -a ED25519 -n zone -f KSK "$zone")
  cat "$ksk25519.key" "$zsk25519.key" >>"$zonefile"
  $DSFROMKEY -a sha-256 "$ksk25519.key" >>dsset-256
 fi

 if [ $ED448_SUPPORTED = 1 ]; then
-  zsk448=$($KEYGEN -q -a ED448 "$zone")
-  ksk448=$($KEYGEN -q -a ED448 -f KSK "$zone")
+  zsk448=$($KEYGEN -q -a ED448 -n zone "$zone")
+  ksk448=$($KEYGEN -q -a ED448 -n zone -f KSK "$zone")
  cat "$ksk448.key" "$zsk448.key" >>"$zonefile"
  $DSFROMKEY -a sha-256 "$ksk448.key" >>dsset-256
 fi
@@ -22,8 +22,8 @@ zonefile=root.db

 echo_i "ns1/sign.sh"

-ksk=$("$KEYGEN" -q -fk -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
-zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+ksk=$("$KEYGEN" -q -fk -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
+zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")

 cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile"

@@ -21,7 +21,7 @@ zonefile=tc-test-signed.db
 # been carefully chosen to ensure that the signed referral response checked in
 # the test will be around 512 bytes in size with glue records excluded.  Please
 # keep this in mind when updating signing algorithms used in system tests.
-keyname=$($KEYGEN -q -a RSASHA256 -b 2048 $zone)
+keyname=$($KEYGEN -q -a RSASHA256 -b 2048 -n zone $zone)
 cat "$infile" "$keyname.key" >"$zonefile"

 $SIGNER -P -o $zone $zonefile >/dev/null
@@ -16,8 +16,8 @@
 zone=.
 rm -f K.+*+*.key
 rm -f K.+*+*.private
-keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} $zone)
-keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -f KSK $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone)
 $SIGNER -S -x -T 1200 -o ${zone} root.db >signer.out
 [ $? = 0 ] || cat signer.out

@@ -14,43 +14,43 @@
 . ../../conf.sh

 # Fake an unsupported key
-unsupportedkey=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" unsupported)
+unsupportedkey=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone unsupported)
 awk '$3 == "DNSKEY" { $6 = 255 } { print }' ${unsupportedkey}.key >${unsupportedkey}.tmp
 mv ${unsupportedkey}.tmp ${unsupportedkey}.key

 zone=bits
 rm -f K${zone}.+*+*.key
 rm -f K${zone}.+*+*.private
-keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} $zone)
-keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -f KSK $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone)
 $DSFROMKEY -T 1200 $keyname >>../ns1/root.db

 zone=noixfr
 rm -f K${zone}.+*+*.key
 rm -f K${zone}.+*+*.private
-keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} $zone)
-keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -f KSK $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone)
 $DSFROMKEY -T 1200 $keyname >>../ns1/root.db

 zone=primary
 rm -f K${zone}.+*+*.key
 rm -f K${zone}.+*+*.private
-keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} $zone)
-keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -f KSK $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone)
 $DSFROMKEY -T 1200 $keyname >>../ns1/root.db

 zone=dynamic
 rm -f K${zone}.+*+*.key
 rm -f K${zone}.+*+*.private
-keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} $zone)
-keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -f KSK $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone)
 $DSFROMKEY -T 1200 $keyname >>../ns1/root.db

 zone=updated
 rm -f K${zone}.+*+*.key
 rm -f K${zone}.+*+*.private
-zsk=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -L 3600 $zone)
-ksk=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -L 3600 -f KSK $zone)
+zsk=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -L 3600 -n zone $zone)
+ksk=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -L 3600 -n zone -f KSK $zone)
 $SETTIME -s -g OMNIPRESENT -k RUMOURED now -z RUMOURED now "$zsk" >settime.out.updated.1 2>&1
 $SETTIME -s -g OMNIPRESENT -k RUMOURED now -r RUMOURED now -d HIDDEN now "$ksk" >settime.out.updated.2 2>&1
 $DSFROMKEY -T 1200 $ksk >>../ns1/root.db
@@ -61,53 +61,53 @@ cp primary2.db.in updated.db
 zone=expired
 rm -f K${zone}.+*+*.key
 rm -f K${zone}.+*+*.private
-keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} $zone)
-keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -f KSK $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone)
 $DSFROMKEY -T 1200 $keyname >>../ns1/root.db
 $SIGNER -PS -s 20100101000000 -e 20110101000000 -O raw -L 2000042407 -o ${zone} ${zone}.db >/dev/null

 zone=retransfer
 rm -f K${zone}.+*+*.key
 rm -f K${zone}.+*+*.private
-keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} $zone)
-keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -f KSK $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone)
 $DSFROMKEY -T 1200 $keyname >>../ns1/root.db

 zone=nsec3
 rm -f K${zone}.+*+*.key
 rm -f K${zone}.+*+*.private
-keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -f KSK $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone)
 $DSFROMKEY -T 1200 $keyname >>../ns1/root.db

 zone=delayedkeys
 rm -f K${zone}.+*+*.key
 rm -f K${zone}.+*+*.private
-keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} $zone)
-keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -f KSK $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone)
 # Keys for the "delayedkeys" zone should not be initially accessible.
 mv K${zone}.+*+*.* ../

 zone=removedkeys-primary
 rm -f K${zone}.+*+*.key
 rm -f K${zone}.+*+*.private
-keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} $zone)
-keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -f KSK $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone)

 zone=removedkeys-secondary
 rm -f K${zone}.+*+*.key
 rm -f K${zone}.+*+*.private
-keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} $zone)
-keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -f KSK $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone)

 for s in a c d h k l m q z; do
  zone=test-$s
-  keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} $zone)
+  keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
 done

 for s in b f i o p t v; do
  zone=test-$s
-  keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} $zone)
-  keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -f KSK $zone)
+  keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+  keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone)
 done

 zone=externalkey
@@ -116,10 +116,10 @@ rm -f K${zone}.+*+*.key
 rm -f K${zone}.+*+*.private

 for alg in ${DEFAULT_ALGORITHM} ${ALTERNATIVE_ALGORITHM}; do
-  k1=$($KEYGEN -q -a $alg -f KSK $zone)
-  k2=$($KEYGEN -q -a $alg $zone)
-  k3=$($KEYGEN -q -a $alg $zone)
-  k4=$($KEYGEN -q -a $alg -f KSK $zone)
+  k1=$($KEYGEN -q -a $alg -n zone -f KSK $zone)
+  k2=$($KEYGEN -q -a $alg -n zone $zone)
+  k3=$($KEYGEN -q -a $alg -n zone $zone)
+  k4=$($KEYGEN -q -a $alg -n zone -f KSK $zone)
  $DSFROMKEY -T 1200 $k4 >>../ns1/root.db

  cat $k1.key $k2.key >>$zonefile
@@ -19,6 +19,6 @@
 zone=nsec3-loop
 rm -f K${zone}.+*+*.key
 rm -f K${zone}.+*+*.private
-keyname=$($KEYGEN -q -a RSASHA256 -b 4096 $zone)
-keyname=$($KEYGEN -q -a RSASHA256 -b 2048 $zone)
-keyname=$($KEYGEN -q -a RSASHA256 -b 2048 -f KSK $zone)
+keyname=$($KEYGEN -q -a RSASHA256 -b 4096 -n zone $zone)
+keyname=$($KEYGEN -q -a RSASHA256 -b 2048 -n zone $zone)
+keyname=$($KEYGEN -q -a RSASHA256 -b 2048 -n zone -f KSK $zone)
@@ -19,8 +19,8 @@ for zone in example01.com example02.com example03.com example04.com \
  example13.com example14.com example15.com example16.com; do
  rm -f K${zone}.+*+*.key
  rm -f K${zone}.+*+*.private
-  keyname=$($KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS $zone)
-  keyname=$($KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -f KSK $zone)
+  keyname=$($KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone)
+  keyname=$($KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone -f KSK $zone)
  cp example.com.db.in ${zone}.db
  $SIGNER -S -T 3600 -O raw -L 2000042407 -o ${zone} ${zone}.db >/dev/null 2>&1
 done
@@ -28,7 +28,7 @@ done
 for zone in example unsigned-serial-test; do
  rm -f K${zone}.+*+*.key
  rm -f K${zone}.+*+*.private
-  keyname=$($KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS $zone)
-  keyname=$($KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -f KSK $zone)
+  keyname=$($KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone)
+  keyname=$($KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone -f KSK $zone)
  cp example.db.in ${zone}.db
 done
@@ -20,8 +20,8 @@ infile=edns512.db.in
 zonefile=edns512.db
 outfile=edns512.db.signed

-keyname1=$($KEYGEN -a RSASHA512 -b 4096 $zone 2>/dev/null)
-keyname2=$($KEYGEN -f KSK -a RSASHA512 -b 4096 $zone 2>/dev/null)
+keyname1=$($KEYGEN -a RSASHA512 -b 4096 -n zone $zone 2>/dev/null)
+keyname2=$($KEYGEN -f KSK -a RSASHA512 -b 4096 -n zone $zone 2>/dev/null)

 cat $infile $keyname1.key $keyname2.key >$zonefile

@@ -20,8 +20,8 @@ infile=edns512-notcp.db.in
 zonefile=edns512-notcp.db
 outfile=edns512-notcp.db.signed

-keyname1=$($KEYGEN -a RSASHA512 -b 4096 $zone 2>/dev/null)
-keyname2=$($KEYGEN -f KSK -a RSASHA512 -b 4096 $zone 2>/dev/null)
+keyname1=$($KEYGEN -a RSASHA512 -b 4096 -n zone $zone 2>/dev/null)
+keyname2=$($KEYGEN -f KSK -a RSASHA512 -b 4096 -n zone $zone 2>/dev/null)

 cat $infile $keyname1.key $keyname2.key >$zonefile

@@ -17,8 +17,8 @@ zone=nsec3param.test.
 infile=nsec3param.test.db.in
 zonefile=nsec3param.test.db

-keyname1=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -f KSK $zone)
-keyname2=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} $zone)
+keyname1=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone)
+keyname2=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)

 cat $infile $keyname1.key $keyname2.key >$zonefile

@@ -28,8 +28,8 @@ zone=dnskey.test.
 infile=dnskey.test.db.in
 zonefile=dnskey.test.db

-keyname1=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -f KSK $zone)
-keyname2=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} $zone)
+keyname1=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone)
+keyname2=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)

 cat $infile $keyname1.key $keyname2.key >$zonefile

@@ -445,7 +445,7 @@ grep "mx03.update.nil/MX:.*MX is an address" ns1/named.run >/dev/null 2>&1 || re

 ret=0
 echo_i "check SIG(0) key is accepted"
-key=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -T KEY xxx)
+key=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -T KEY -n ENTITY xxx)
 echo "" | $NSUPDATE -k ${key}.private >/dev/null 2>&1 || ret=1
 [ $ret = 0 ] || {
  echo_i "failed"
@@ -22,8 +22,8 @@ zonefile=root.db
 cp ../ns2/dsset-example. .
 cp ../ns2/dsset-example.com. .

-keyname1=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} $zone)
-keyname2=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -f KSK $zone)
+keyname1=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+keyname2=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -f KSK -n zone $zone)
 cat $infile $keyname1.key $keyname2.key >$zonefile

 $SIGNER -g -o $zone $zonefile >/dev/null
@@ -18,8 +18,8 @@ for domain in example example.com; do
  infile=${domain}.db.in
  zonefile=${domain}.db

-  keyname1=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} $zone)
-  keyname2=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -f KSK $zone)
+  keyname1=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+  keyname2=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -f KSK -n zone $zone)

  cat $infile $keyname1.key $keyname2.key >$zonefile

@@ -20,6 +20,8 @@ use IO::Socket;
 use Net::DNS;
 use Net::DNS::Packet;

+print "Using Net::DNS $Net::DNS::VERSION\n";
+
 my $localport = int($ENV{'PORT'});
 if (!$localport) { $localport = 5300; }

@@ -170,6 +172,15 @@ for (;;) {
 			$packet->push("authority",
 				      new Net::DNS::RR($qname . " 300 SOA . . 0 0 0 0 0"));
 		}
+	} elsif ($qname eq "zoneversion") {
+		$packet->push("authority", new Net::DNS::RR(". 300 SOA . . 0 0 0 0 0"));
+		if ($Net::DNS::VERSION >= 1.49) {
+			$packet->edns->option('ZONEVERSION' => [0, 1, '01022304'] )
+		} elsif ($Net::DNS::VERSION >= 1.35) {
+			$packet->edns->option('19' => {'BASE16' => '000101022304'} )
+		} else {
+			$packet->edns->option('19' => pack 'H*', '000101022304')
+		}
 	} else {
 		# Data for the "bogus referrals" test
 		$packet->push("authority", new Net::DNS::RR("below.www.example.com 300 NS ns.below.www.example.com"));
@@ -31,6 +31,7 @@ options {
 	resolver-query-timeout 5000; # 5 seconds
 	attach-cache "globalcache";
 	max-recursion-queries 100;
+	request-zoneversion yes;
 };

 trust-anchors { };
@@ -26,6 +26,15 @@ options {
 	querylog yes;
 	prefetch 4 10;
 	responselog yes;
+	request-nsid yes;
+	request-zoneversion yes;
+};
+
+// Don't break tests which depend on ans10 by requesting
+// zoneversion or nsid
+server 10.53.0.10 {
+	request-nsid no;
+	request-zoneversion no;
 };

 include "trusted.conf";
@@ -901,6 +901,23 @@ test ${lines:-1} -ne 0 && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

+n=$((n + 1))
+echo_i "check that received ZONEVERSION is logged ($n)"
+ret=0
+pat="received ZONEVERSION serial 2010 from 10.53.0.4#[0-9]* for mixedttl.tld/TXT zone tld"
+grep "$pat" ns5/named.run >/dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "check that received ZONEVERSION is logged non serial ($n)"
+ret=0
+dig_with_opts +tcp @10.53.0.1 zoneversion >dig.out.${n} || ret=1
+pat='received ZONEVERSION type 1 value 01022304 (\.\.#\.) from 10.53.0.2#[0-9]* for zoneversion/A zone \.'
+grep "$pat" ns1/named.run >/dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
 n=$((n + 1))
 echo_i "check resolver behavior when FORMERR for EDNS options happens (${n})"
 ret=0
@@ -17,7 +17,7 @@ zone=.
 infile=root.db.in
 zonefile=root.db

-keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
 keyid=$(expr ${keyname} : 'K.+[0-9][0-9][0-9]+\(.*\)')

 (cd ../ns2 && $SHELL sign.sh ${keyid:-00000})
@@ -22,8 +22,8 @@ zone=example.
 infile=example.db.in
 zonefile=example.db

-keyname1=$($KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS $zone)
-keyname2=$($KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS $zone)
+keyname1=$($KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone)
+keyname2=$($KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone)

 cat $infile $keyname1.key $keyname2.key >$zonefile
 echo root-key-sentinel-is-ta-$oldid A 10.53.0.1 >>$zonefile
@@ -19,7 +19,7 @@ zonefile=root.db

 cp ../ns2/dsset-example.in dsset-example.

-keyname=$($KEYGEN -q -a RSASHA256 -b 2048 $zone)
+keyname=$($KEYGEN -q -a RSASHA256 -b 2048 -n zone $zone)

 cat $infile $keyname.key >$zonefile

@@ -24,7 +24,7 @@ zonefile=root.db

 cp "../ns2/dsset-example." .

-keyname=$($KEYGEN -q -a "${DEFAULT_ALGORITHM}" -b "${DEFAULT_BITS}" $zone)
+keyname=$($KEYGEN -q -a "${DEFAULT_ALGORITHM}" -b "${DEFAULT_BITS}" -n zone $zone)

 cat "$infile" "$keyname.key" >"$zonefile"

@@ -20,8 +20,8 @@ zone=example.
 infile=example.db.in
 zonefile=example.db

-keyname1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
-keyname2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+keyname1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
+keyname2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")

 cat "$infile" "$keyname1.key" "$keyname2.key" >"$zonefile"

@@ -16,6 +16,6 @@

 set -e

-keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" ".")
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone ".")

 keyfile_to_static_ds "$keyname" >trusted.conf
@@ -21,8 +21,8 @@ zonefile=example.db

 cp ../ns4/dsset-sub.example. .

-keyname1=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} $zone)
-keyname2=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -f KSK $zone)
+keyname1=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+keyname2=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -f KSK -n zone $zone)
 cat $infile $keyname1.key $keyname2.key >$zonefile

 $SIGNER -g -o $zone $zonefile >/dev/null
@@ -33,8 +33,8 @@ keyfile_to_static_ds $keyname2 >trusted.conf
 zone=undelegated
 infile=undelegated.db.in
 zonefile=undelegated.db
-keyname1=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} $zone)
-keyname2=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -f KSK $zone)
+keyname1=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+keyname2=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -f KSK -n zone $zone)
 cat $infile $keyname1.key $keyname2.key >$zonefile

 $SIGNER -g -o $zone $zonefile >/dev/null
@@ -17,8 +17,8 @@ zone=sub.example
 infile=${zone}.db.in
 zonefile=${zone}.db

-keyname1=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} $zone)
-keyname2=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -f KSK $zone)
+keyname1=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+keyname2=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -f KSK -n zone $zone)

 cat $infile $keyname1.key $keyname2.key >$zonefile

@@ -18,7 +18,7 @@ zone=example
 infile=example.db.in
 zonefile=example.db

-keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
 cat "$infile" "$keyname.key" >"$zonefile"
 echo insecure NS ns1.insecure >>"$zonefile"
 echo ns1.insecure A 10.53.0.1 >>"$zonefile"
@@ -29,7 +29,7 @@ zone=insecure.example
 infile=example.db.in
 zonefile=insecure.example.db

-keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
 cat "$infile" "$keyname.key" >"$zonefile"

 $SIGNER -P -o $zone $zonefile >/dev/null
@@ -38,7 +38,7 @@ zone=dnamed
 infile=dnamed.db.in
 zonefile=dnamed.db

-keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
 cat "$infile" "$keyname.key" >"$zonefile"

 $SIGNER -P -o $zone $zonefile >/dev/null
@@ -47,7 +47,7 @@ zone=minimal
 infile=minimal.db.in
 zonefile=minimal.db

-keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
 cat "$infile" "$keyname.key" >"$zonefile"

 # do not regenerate NSEC chain as there in a minimal NSEC record present
@@ -57,7 +57,7 @@ zone=soa-without-dnskey
 infile=soa-without-dnskey.db.in
 zonefile=soa-without-dnskey.db

-keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
 cat "$infile" "$keyname.key" >"$zonefile"

 # do not regenerate NSEC chain as there in a minimal NSEC record present
@@ -67,7 +67,7 @@ zone=.
 infile=root.db.in
 zonefile=root.db

-keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -b ${DEFAULT_BITS} $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -b ${DEFAULT_BITS} -n zone $zone)
 cat "$infile" "$keyname.key" >"$zonefile"

 $SIGNER -P -g -o $zone $zonefile >/dev/null
@@ -245,7 +245,7 @@ fi

 echo_i "check that dnssec-keygen won't generate TSIG keys"
 ret=0
-$KEYGEN -a hmac-sha256 -b 128 example.net >keygen.out3 2>&1 && ret=1
+$KEYGEN -a hmac-sha256 -b 128 -n host example.net >keygen.out3 2>&1 && ret=1
 grep "unknown algorithm" keygen.out3 >/dev/null || ret=1

 echo_i "check that a 'BADTIME' response with 'QR=0' is handled as a request"
@@ -15,5 +15,5 @@

 copy_setports ns1/named.conf.in ns1/named.conf

-key=$($KEYGEN -Cq -K ns1 -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -T KEY key.example.nil.)
+key=$($KEYGEN -Cq -K ns1 -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n HOST -T KEY key.example.nil.)
 cat ns1/example.nil.db.in ns1/${key}.key >ns1/example.nil.db
@@ -35,7 +35,7 @@ fi
 #
 # SIG(0) requires cryptographic support which may not be configured.
 #
-keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -T KEY sig0.example2 2>keyname.err)
+keyname=$($KEYGEN -q -n HOST -a ${DEFAULT_ALGORITHM} -T KEY sig0.example2 2>keyname.err)
 if test -n "$keyname"; then
  cat ns1/example1.db $keyname.key >ns1/example2.db
  echo $keyname >keyname
@@ -46,7 +46,7 @@ cat_i <keyname.err

 cat ns1/example1.db >ns1/example2-toomanykeys.db
 for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17; do
-  keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -T KEY sig0.example2-toomanykeys 2>/dev/null)
+  keyname=$($KEYGEN -q -n HOST -a ${DEFAULT_ALGORITHM} -T KEY sig0.example2-toomanykeys 2>/dev/null)
  if test -n "$keyname"; then
    cat $keyname.key >>ns1/example2-toomanykeys.db
    echo $keyname >keyname$i
@@ -26,8 +26,8 @@ zonefile=nsec.db
 outfile=nsec.db.signed
 dssets="$dssets dsset-${zone}."

-keyname1=$($KEYGEN -a ${DEFAULT_ALGORITHM} $zone 2>/dev/null)
-keyname2=$($KEYGEN -f KSK -a ${DEFAULT_ALGORITHM} $zone 2>/dev/null)
+keyname1=$($KEYGEN -a ${DEFAULT_ALGORITHM} -n zone $zone 2>/dev/null)
+keyname2=$($KEYGEN -f KSK -a ${DEFAULT_ALGORITHM} -n zone $zone 2>/dev/null)

 cat $infile $keyname1.key $keyname2.key >$zonefile

@@ -39,8 +39,8 @@ infile=private.nsec.db.in
 zonefile=private.nsec.db
 outfile=private.nsec.db.signed

-keyname1=$($KEYGEN -a ${DEFAULT_ALGORITHM} $zone 2>/dev/null)
-keyname2=$($KEYGEN -f KSK -a ${DEFAULT_ALGORITHM} $zone 2>/dev/null)
+keyname1=$($KEYGEN -a ${DEFAULT_ALGORITHM} -n zone $zone 2>/dev/null)
+keyname2=$($KEYGEN -f KSK -a ${DEFAULT_ALGORITHM} -n zone $zone 2>/dev/null)

 cat $infile $keyname1.key $keyname2.key >$zonefile

@@ -55,8 +55,8 @@ zonefile=nsec3.db
 outfile=nsec3.db.signed
 dssets="$dssets dsset-${zone}."

-keyname1=$($KEYGEN -a ${DEFAULT_ALGORITHM} $zone 2>/dev/null)
-keyname2=$($KEYGEN -f KSK -a ${DEFAULT_ALGORITHM} $zone 2>/dev/null)
+keyname1=$($KEYGEN -a ${DEFAULT_ALGORITHM} -n zone $zone 2>/dev/null)
+keyname2=$($KEYGEN -f KSK -a ${DEFAULT_ALGORITHM} -n zone $zone 2>/dev/null)

 cat $infile $keyname1.key $keyname2.key >$zonefile

@@ -68,8 +68,8 @@ infile=private.nsec3.db.in
 zonefile=private.nsec3.db
 outfile=private.nsec3.db.signed

-keyname1=$($KEYGEN -a ${DEFAULT_ALGORITHM} $zone 2>/dev/null)
-keyname2=$($KEYGEN -f KSK -a ${DEFAULT_ALGORITHM} $zone 2>/dev/null)
+keyname1=$($KEYGEN -a ${DEFAULT_ALGORITHM} -n zone $zone 2>/dev/null)
+keyname2=$($KEYGEN -f KSK -a ${DEFAULT_ALGORITHM} -n zone $zone 2>/dev/null)

 cat $infile $keyname1.key $keyname2.key >$zonefile

@@ -83,8 +83,8 @@ infile=root.db.in
 zonefile=root.db
 outfile=root.db.signed

-keyname1=$($KEYGEN -a ${DEFAULT_ALGORITHM} $zone 2>/dev/null)
-keyname2=$($KEYGEN -f KSK -a ${DEFAULT_ALGORITHM} $zone 2>/dev/null)
+keyname1=$($KEYGEN -a ${DEFAULT_ALGORITHM} -n zone $zone 2>/dev/null)
+keyname2=$($KEYGEN -f KSK -a ${DEFAULT_ALGORITHM} -n zone $zone 2>/dev/null)

 cat $infile $keyname1.key $keyname2.key $dssets >$zonefile

@@ -127,3 +127,7 @@

 ``zoneload``
    Loading of zones and creation of automatic empty zones.
+
+``zoneversion``
+    ZONEVERSION options received from upstream servers.
+
@@ -2165,6 +2165,14 @@ Boolean Options
   ultimate primary should be set to still send NOTIFY messages to all the name servers
   listed in the NS RRset.

+.. namedconf:statement:: provide-zoneversion
+   :tags: transfer
+   :short: Controls the return EDNS ZONEVERSION answers.
+
+   If ``yes`` EDNS ZONEVERSION answers will be returned otherwise
+   not for primary, secondary and mirror zones.  The default is
+   ``yes``.
+
 .. namedconf:statement:: recursion
   :tags: query
   :short: Defines whether recursion and caching are allowed.
@@ -2188,6 +2196,18 @@ Boolean Options
   option in its response, then its contents are logged in the ``nsid``
   category at level ``info``. The default is ``no``.

+.. namedconf:statement:: request-zoneversion
+   :tags: query
+   :short: Controls whether an empty EDNS(0) ZONEVERSION option is sent with all queries to authoritative name servers during iterative resolution.
+
+   If ``yes``, then an empty EDNS(0) ZONEVERSION option is sent
+   with all queries to authoritative name servers during iterative
+   resolution. If the authoritative server returns an ZONEVERSION
+   option in its response, then its contents are logged in the
+   ``zoneversion`` category at level ``info``.  If the NSID has
+   also been requested and it is returned then that is appended to
+   the log message.  The default is ``no``.
+
 .. namedconf:statement:: require-cookie
   :tags: query
   :short: Controls whether responses without a server cookie are accepted.
@@ -5601,11 +5621,13 @@ and :namedconf:ref:`options` blocks:
   - :namedconf:ref:`notify-source-v6`
   - :namedconf:ref:`notify-source`
   - :namedconf:ref:`provide-ixfr`
+   - :namedconf:ref:`provide-zoneversion`
   - :namedconf:ref:`query-source-v6`
   - :namedconf:ref:`query-source`
   - :namedconf:ref:`request-expire`
   - :namedconf:ref:`request-ixfr`
   - :namedconf:ref:`request-nsid`
+   - :namedconf:ref:`request-zoneversion`
   - :namedconf:ref:`require-cookie`
   - :namedconf:ref:`send-cookie`
   - :namedconf:ref:`transfer-format`
@@ -33,6 +33,7 @@ zone <string> [ <class> ] {
 	notify-source ( <ipv4_address> | * );
 	notify-source-v6 ( <ipv6_address> | * );
 	primaries [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
+	provide-zoneversion <boolean>;
 	request-expire <boolean>;
 	request-ixfr <boolean>;
 	request-ixfr-max-diffs <integer>;
@@ -226,6 +226,7 @@ options {
 	preferred-glue <string>;
 	prefetch <integer> [ <integer> ];
 	provide-ixfr <boolean>;
+	provide-zoneversion <boolean>;
 	qname-minimization ( strict | relaxed | disabled | off );
 	query-source [ address ] ( <ipv4_address> | * | none );
 	query-source-v6 [ address ] ( <ipv6_address> | * | none );
@@ -254,6 +255,7 @@ options {
 	request-ixfr <boolean>;
 	request-ixfr-max-diffs <integer>;
 	request-nsid <boolean>;
+	request-zoneversion <boolean>;
 	require-server-cookie <boolean>;
 	resolver-query-timeout <integer>;
 	resolver-use-dns64 <boolean>;
@@ -343,6 +345,7 @@ server <netprefix> {
 	request-ixfr <boolean>;
 	request-ixfr-max-diffs <integer>;
 	request-nsid <boolean>;
+	request-zoneversion <boolean>;
 	require-cookie <boolean>;
 	send-cookie <boolean>;
 	tcp-keepalive <boolean>;
@@ -509,6 +512,7 @@ view <string> [ <class> ] {
 	preferred-glue <string>;
 	prefetch <integer> [ <integer> ];
 	provide-ixfr <boolean>;
+	provide-zoneversion <boolean>;
 	qname-minimization ( strict | relaxed | disabled | off );
 	query-source [ address ] ( <ipv4_address> | * | none );
 	query-source-v6 [ address ] ( <ipv6_address> | * | none );
@@ -534,6 +538,7 @@ view <string> [ <class> ] {
 	request-ixfr <boolean>;
 	request-ixfr-max-diffs <integer>;
 	request-nsid <boolean>;
+	request-zoneversion <boolean>;
 	require-server-cookie <boolean>;
 	resolver-query-timeout <integer>;
 	resolver-use-dns64 <boolean>;
@@ -561,6 +566,7 @@ view <string> [ <class> ] {
 		request-ixfr <boolean>;
 		request-ixfr-max-diffs <integer>;
 		request-nsid <boolean>;
+		request-zoneversion <boolean>;
 		require-cookie <boolean>;
 		send-cookie <boolean>;
 		tcp-keepalive <boolean>;
@@ -51,6 +51,7 @@ zone <string> [ <class> ] {
 	parental-agents [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
 	parental-source ( <ipv4_address> | * );
 	parental-source-v6 ( <ipv6_address> | * );
+	provide-zoneversion <boolean>;
 	send-report-channel <string>;
 	serial-update-method ( date | increment | unixtime );
 	sig-signing-nodes <integer>;
@@ -50,6 +50,7 @@ zone <string> [ <class> ] {
 	parental-source ( <ipv4_address> | * );
 	parental-source-v6 ( <ipv6_address> | * );
 	primaries [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
+	provide-zoneversion <boolean>;
 	request-expire <boolean>;
 	request-ixfr <boolean>;
 	request-ixfr-max-diffs <integer>;
@@ -2909,6 +2909,7 @@ fetch_name(dns_adbname_t *adbname, bool start_at_zone, bool no_validation,
 	 * createfetch to find deepest cached name when we're providing
 	 * domain and nameservers.
 	 */
+	dns_adbname_ref(adbname);
 	result = dns_resolver_createfetch(
 		adb->res, adbname->name, type, name, nameservers, NULL, NULL, 0,
 		options, depth, qc, gqc, isc_loop(), fetch_callback, adbname,
@@ -2916,11 +2917,10 @@ fetch_name(dns_adbname_t *adbname, bool start_at_zone, bool no_validation,
 	if (result != ISC_R_SUCCESS) {
 		DP(ENTER_LEVEL, "fetch_name: createfetch failed with %s",
 		   isc_result_totext(result));
+		dns_adbname_unref(adbname);
 		goto cleanup;
 	}

-	dns_adbname_ref(adbname);
-
 	if (type == dns_rdatatype_a) {
 		adbname->fetch_a = fetch;
 		inc_resstats(adb, dns_resstatscounter_gluefetchv4);
@@ -1200,3 +1200,14 @@ dns__db_logtoomanyrecords(dns_db_t *db, const dns_name_t *name,
 		(db->attributes & DNS_DBATTR_CACHE) != 0 ? "cache" : "zone",
 		isc_result_totext(DNS_R_TOOMANYRECORDS), limit);
 }
+
+isc_result_t
+dns_db_getzoneversion(dns_db_t *db, isc_buffer_t *b) {
+	REQUIRE(db != NULL);
+	REQUIRE(b != NULL);
+
+	if (db->methods->getzoneversion != NULL) {
+		return (db->methods->getzoneversion)(db, b);
+	}
+	return ISC_R_NOTIMPLEMENTED;
+}
@@ -191,6 +191,7 @@ dns_dnssec_sign(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
 	isc_result_t ret;
 	isc_buffer_t *databuf = NULL;
 	char data[256 + 8];
+	uint32_t flags;
 	unsigned int sigsize;
 	dns_fixedname_t fnewname;
 	dns_fixedname_t fsigner;
@@ -208,6 +209,17 @@ dns_dnssec_sign(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
 		return DNS_R_INVALIDTIME;
 	}

+	/*
+	 * Is the key allowed to sign data?
+	 */
+	flags = dst_key_flags(key);
+	if ((flags & DNS_KEYTYPE_NOAUTH) != 0) {
+		return DNS_R_KEYUNAUTHORIZED;
+	}
+	if ((flags & DNS_KEYFLAG_OWNERMASK) != DNS_KEYOWNER_ZONE) {
+		return DNS_R_KEYUNAUTHORIZED;
+	}
+
 	sig.mctx = mctx;
 	sig.common.rdclass = set->rdclass;
 	sig.common.rdtype = dns_rdatatype_rrsig;
@@ -369,6 +381,7 @@ dns_dnssec_verify(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
 	unsigned char data[300];
 	dst_context_t *ctx = NULL;
 	int labels = 0;
+	uint32_t flags;
 	bool downcase = false;

 	REQUIRE(name != NULL);
@@ -433,6 +446,19 @@ dns_dnssec_verify(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
 		break;
 	}

+	/*
+	 * Is the key allowed to sign data?
+	 */
+	flags = dst_key_flags(key);
+	if ((flags & DNS_KEYTYPE_NOAUTH) != 0) {
+		inc_stat(dns_dnssecstats_fail);
+		return DNS_R_KEYUNAUTHORIZED;
+	}
+	if ((flags & DNS_KEYFLAG_OWNERMASK) != DNS_KEYOWNER_ZONE) {
+		inc_stat(dns_dnssecstats_fail);
+		return DNS_R_KEYUNAUTHORIZED;
+	}
+
 again:
 	ret = dst_context_create(key, mctx, DNS_LOGCATEGORY_DNSSEC, false,
 				 maxbits, &ctx);
@@ -1078,6 +1104,7 @@ dns_dnssec_signs(dns_rdata_t *rdata, const dns_name_t *name,
 bool
 dns_dnssec_iszonekey(dns_rdata_dnskey_t *key) {
 	return (key->flags & DNS_KEYFLAG_OWNERMASK) == DNS_KEYOWNER_ZONE &&
+	       (key->flags & DNS_KEYTYPE_NOAUTH) == 0 &&
 	       (key->protocol == DNS_KEYPROTO_DNSSEC ||
 		key->protocol == DNS_KEYPROTO_ANY);
 }
@@ -1588,7 +1615,9 @@ dns_dnssec_keylistfromrdataset(const dns_name_t *origin, dns_kasp_t *kasp,
 		RETERR(dns_dnssec_keyfromrdata(origin, &rdata, mctx, &dnskey));
 		dst_key_setttl(dnskey, keys.ttl);

-		if (!is_zone_key(dnskey)) {
+		if (!is_zone_key(dnskey) ||
+		    (dst_key_flags(dnskey) & DNS_KEYTYPE_NOAUTH) != 0)
+		{
 			goto skip;
 		}

@@ -1694,6 +1723,11 @@ dns_dnssec_keylistfromrdataset(const dns_name_t *origin, dns_kasp_t *kasp,
 		}
 		RETERR(result);

+		/* This should never happen. */
+		if ((dst_key_flags(privkey) & DNS_KEYTYPE_NOAUTH) != 0) {
+			goto skip;
+		}
+
 		/*
 		 * Whatever the key's default TTL may have
 		 * been, the rdataset TTL takes priority.
@@ -182,6 +182,7 @@ typedef struct dns_dbmethods {
 				     dns_name_t *name);
 	void (*setmaxrrperset)(dns_db_t *db, uint32_t value);
 	void (*setmaxtypepername)(dns_db_t *db, uint32_t value);
+	isc_result_t (*getzoneversion)(dns_db_t *db, isc_buffer_t *b);
 } dns_dbmethods_t;

 typedef isc_result_t (*dns_dbcreatefunc_t)(isc_mem_t	    *mctx,
@@ -1805,3 +1806,21 @@ dns_db_setmaxtypepername(dns_db_t *db, uint32_t value);
 * stored at a given node, then any subsequent attempt to add an rdataset
 * with a new RR type will return ISC_R_TOOMANYRECORDS.
 */
+
+isc_result_t
+dns_db_getzoneversion(dns_db_t *db, isc_buffer_t *b);
+/*%<
+ * Provides a database specific EDNS ZONEVERSION option.
+ *
+ * Requires:
+ * \li 'db' is a valid database
+ * \li 'b' is a valid buffer
+ *
+ * Returns:
+ * \li ISC_R_SUCCESS when it has populated the buffer with the ZONEVERSION
+ *     response (maybe empty implying no ZONEVERSION to be returned).
+ * \li ISC_R_NOSPACE if the buffer is too small.
+ * \li ISC_R_NOTIMPLEMENTED if there is not a database specific
+ *     ZONEVERSION
+ * \li ISC_R_FAILURE other failures
+ */
@@ -16,84 +16,89 @@
 /*! \file dns/keyvalues.h */

 /*
- * Flags field of the KEY rdata. Also used by DNSKEY, CDNSKEY, RKEY,
- * KEYDATA. Some values are only defined for KEY and not the others,
- * and vice versa.
+ * Flags field of the KEY RR rdata
 */
-enum {
-	/* valid for KEY only. if both are set, there is no key data. */
-	DNS_KEYTYPE_NOAUTH = 1 << 15, /* cannot be used for authentication. */
-	DNS_KEYTYPE_NOCONF = 1 << 14, /* cannot be used for confidentiality. */
+#define DNS_KEYFLAG_TYPEMASK 0xC000 /*%< Mask for "type" bits */
+#define DNS_KEYTYPE_AUTHCONF 0x0000 /*%< Key usable for both */
+#define DNS_KEYTYPE_CONFONLY 0x8000 /*%< Key usable for confidentiality */
+#define DNS_KEYTYPE_AUTHONLY 0x4000 /*%< Key usable for authentication */
+#define DNS_KEYTYPE_NOKEY    0xC000 /*%< No key usable for either; no key */
+#define DNS_KEYTYPE_NOAUTH   DNS_KEYTYPE_CONFONLY
+#define DNS_KEYTYPE_NOCONF   DNS_KEYTYPE_AUTHONLY

-	DNS_KEYFLAG_RESERVED2 = 1 << 13, /* reserved: must be zero. */
+#define DNS_KEYFLAG_RESERVED2  0x2000 /*%< reserved - must be zero */
+#define DNS_KEYFLAG_EXTENDED   0x1000 /*%< key has extended flags */
+#define DNS_KEYFLAG_RESERVED4  0x0800 /*%< reserved - must be zero */
+#define DNS_KEYFLAG_RESERVED5  0x0400 /*%< reserved - must be zero */
+#define DNS_KEYFLAG_OWNERMASK  0x0300 /*%< these bits determine the type */
+#define DNS_KEYOWNER_USER      0x0000 /*%< key is assoc. with user */
+#define DNS_KEYOWNER_ENTITY    0x0200 /*%< key is assoc. with entity eg host */
+#define DNS_KEYOWNER_ZONE      0x0100 /*%< key is zone key */
+#define DNS_KEYOWNER_RESERVED  0x0300 /*%< reserved meaning */
+#define DNS_KEYFLAG_REVOKE     0x0080 /*%< key revoked (per rfc5011) */
+#define DNS_KEYFLAG_RESERVED9  0x0040 /*%< reserved - must be zero */
+#define DNS_KEYFLAG_RESERVED10 0x0020 /*%< reserved - must be zero */
+#define DNS_KEYFLAG_RESERVED11 0x0010 /*%< reserved - must be zero */
+#define DNS_KEYFLAG_SIGNATORYMASK                  \
+	0x000F /*%< key can sign RR's of same name \
+		*/

-	DNS_KEYFLAG_EXTENDED = 1 << 12, /* key has extended flags: if this is
-					 * set, the first two octets of the
-					 * key data are an additional flags
-					 * field, at least one bit of which
-					 * must be nonzero. (valid for KEY
-					 * only.) */
+#define DNS_KEYFLAG_RESERVEDMASK                         \
+	(DNS_KEYFLAG_RESERVED2 | DNS_KEYFLAG_RESERVED4 | \
+	 DNS_KEYFLAG_RESERVED5 | DNS_KEYFLAG_RESERVED9 | \
+	 DNS_KEYFLAG_RESERVED10 | DNS_KEYFLAG_RESERVED11)
+#define DNS_KEYFLAG_KSK 0x0001 /*%< key signing key */

-	DNS_KEYFLAG_RESERVED4 = 1 << 11, /* reserved: must be zero. */
-	DNS_KEYFLAG_RESERVED5 = 1 << 10, /* reserved: must be zero. */
-
-	/* if nether of these is set, this is a user key (valid for KEY only) */
-	DNS_KEYOWNER_ENTITY = 1 << 9, /* host key (valid for KEY only). */
-	DNS_KEYOWNER_ZONE = 1 << 8,   /* zone key (mandatory for DNSKEY). */
-
-	DNS_KEYFLAG_REVOKE = 1 << 7,	 /* key revoked (per rfc5011) */
-	DNS_KEYFLAG_RESERVED9 = 1 << 6,	 /* reserved: must be zero. */
-	DNS_KEYFLAG_RESERVED10 = 1 << 5, /* reserved: must be zero. */
-	DNS_KEYFLAG_RESERVED11 = 1 << 4, /* reserved: must be zero. */
-
-	DNS_KEYFLAG_RESERVED12 = 1 << 3, /* reserved: must be zero. */
-	DNS_KEYFLAG_RESERVED13 = 1 << 4, /* reserved: must be zero. */
-	DNS_KEYFLAG_RESERVED14 = 1 << 2, /* reserved: must be zero. */
-
-	DNS_KEYFLAG_KSK = 1 << 0, /* key signing key */
-};
-
-#define DNS_KEYFLAG_OWNERMASK (DNS_KEYOWNER_ENTITY | DNS_KEYOWNER_ZONE)
-#define DNS_KEYFLAG_TYPEMASK  (DNS_KEYTYPE_NOAUTH | DNS_KEYTYPE_NOCONF)
-#define DNS_KEYTYPE_NOKEY     DNS_KEYFLAG_TYPEMASK
+#define DNS_KEYFLAG_RESERVEDMASK2 0xFFFF /*%< no bits defined here */

 /* The Algorithm field of the KEY and SIG RR's is an integer, {1..254} */
-enum {
-	DNS_KEYALG_RSAMD5 = 1,	      /*%< RSA with MD5 */
-	DNS_KEYALG_DH_DEPRECATED = 2, /*%< deprecated */
-	DNS_KEYALG_DSA = 3,	      /*%< DSA KEY */
-	DNS_KEYALG_RSASHA1 = 5,
-	DNS_KEYALG_NSEC3DSA = 6,
-	DNS_KEYALG_NSEC3RSASHA1 = 7,
-	DNS_KEYALG_RSASHA256 = 8,
-	DNS_KEYALG_RSASHA512 = 10,
-	DNS_KEYALG_ECCGOST = 12,
-	DNS_KEYALG_ECDSA256 = 13,
-	DNS_KEYALG_ECDSA384 = 14,
-	DNS_KEYALG_ED25519 = 15,
-	DNS_KEYALG_ED448 = 16,
-	DNS_KEYALG_INDIRECT = 252,
-	DNS_KEYALG_PRIVATEDNS = 253,
-	DNS_KEYALG_PRIVATEOID = 254, /*%< Key begins with OID giving alg */
-	DNS_KEYALG_MAX = 255,
-};
+#define DNS_KEYALG_RSAMD5	 1 /*%< RSA with MD5 */
+#define DNS_KEYALG_RSA		 1 /*%< Used just for tagging */
+#define DNS_KEYALG_DH_DEPRECATED 2 /*%< deprecated */
+#define DNS_KEYALG_DSA		 3 /*%< DSA KEY */
+#define DNS_KEYALG_NSEC3DSA	 6
+#define DNS_KEYALG_DSS		 DNS_ALG_DSA
+#define DNS_KEYALG_ECC		 4
+#define DNS_KEYALG_RSASHA1	 5
+#define DNS_KEYALG_NSEC3RSASHA1	 7
+#define DNS_KEYALG_RSASHA256	 8
+#define DNS_KEYALG_RSASHA512	 10
+#define DNS_KEYALG_ECCGOST	 12
+#define DNS_KEYALG_ECDSA256	 13
+#define DNS_KEYALG_ECDSA384	 14
+#define DNS_KEYALG_ED25519	 15
+#define DNS_KEYALG_ED448	 16
+#define DNS_KEYALG_INDIRECT	 252
+#define DNS_KEYALG_PRIVATEDNS	 253
+#define DNS_KEYALG_PRIVATEOID	 254 /*%< Key begins with OID giving alg */
+#define DNS_KEYALG_MAX		 255

 /* Protocol values  */
-enum {
-	DNS_KEYPROTO_RESERVED = 0,
-	DNS_KEYPROTO_DNSSEC = 3,
-	DNS_KEYPROTO_ANY = 255,
-};
+#define DNS_KEYPROTO_RESERVED 0
+#define DNS_KEYPROTO_TLS      1
+#define DNS_KEYPROTO_EMAIL    2
+#define DNS_KEYPROTO_DNSSEC   3
+#define DNS_KEYPROTO_IPSEC    4
+#define DNS_KEYPROTO_ANY      255
+
+/* Signatures */
+#define DNS_SIG_RSAMINBITS 512 /*%< Size of a mod or exp in bits */
+#define DNS_SIG_RSAMAXBITS 2552
+/* Total of binary mod and exp */
+#define DNS_SIG_RSAMAXBYTES ((DNS_SIG_RSAMAXBITS + 7 / 8) * 2 + 3)
+/*%< Max length of text sig block */
+#define DNS_SIG_RSAMAXBASE64 (((DNS_SIG_RSAMAXBYTES + 2) / 3) * 4)
+#define DNS_SIG_RSAMINSIZE   ((DNS_SIG_RSAMINBITS + 7) / 8)
+#define DNS_SIG_RSAMAXSIZE   ((DNS_SIG_RSAMAXBITS + 7) / 8)

-/* Key and signature sizes */
-#define DNS_KEY_ECDSA256SIZE 64
 #define DNS_SIG_ECDSA256SIZE 64
-
-#define DNS_KEY_ECDSA384SIZE 96
 #define DNS_SIG_ECDSA384SIZE 96

-#define DNS_KEY_ED25519SIZE 32
-#define DNS_SIG_ED25519SIZE 64
+#define DNS_KEY_ECDSA256SIZE 64
+#define DNS_KEY_ECDSA384SIZE 96

-#define DNS_KEY_ED448SIZE 57
-#define DNS_SIG_ED448SIZE 114
+#define DNS_SIG_ED25519SIZE 64
+#define DNS_SIG_ED448SIZE   114
+
+#define DNS_KEY_ED25519SIZE 32
+#define DNS_KEY_ED448SIZE   57
@@ -102,7 +102,6 @@
 #define DNS_MESSAGEEXTFLAG_DO 0x8000U

 /*%< EDNS0 extended OPT codes */
-
 #define DNS_OPT_LLQ	       1  /*%< LLQ opt code */
 #define DNS_OPT_UL	       2  /*%< UL opt code */
 #define DNS_OPT_NSID	       3  /*%< NSID opt code */
@@ -129,7 +128,7 @@
 * options we know about. Extended DNS Errors may occur multiple times, see
 * DNS_EDE_MAX_ERRORS.
 */
-#define DNS_EDNSOPTIONS 8 + DNS_EDE_MAX_ERRORS
+#define DNS_EDNSOPTIONS 9 + DNS_EDE_MAX_ERRORS

 #define DNS_MESSAGE_REPLYPRESERVE	 (DNS_MESSAGEFLAG_RD | DNS_MESSAGEFLAG_CD)
 #define DNS_MESSAGEEXTFLAG_REPLYPRESERVE (DNS_MESSAGEEXTFLAG_DO)
@@ -115,6 +115,12 @@ dns_peer_setrequestnsid(dns_peer_t *peer, bool newval);
 isc_result_t
 dns_peer_getrequestnsid(dns_peer_t *peer, bool *retval);

+isc_result_t
+dns_peer_setrequestzoneversion(dns_peer_t *peer, bool newval);
+
+isc_result_t
+dns_peer_getrequestzoneversion(dns_peer_t *peer, bool *retval);
+
 isc_result_t
 dns_peer_setsendcookie(dns_peer_t *peer, bool newval);

@@ -105,31 +105,32 @@ typedef enum { dns_quotatype_zone = 0, dns_quotatype_server } dns_quotatype_t;
 * Options that modify how a 'fetch' is done.
 */
 enum {
-	DNS_FETCHOPT_TCP = 1 << 0,	       /*%< Use TCP. */
-	DNS_FETCHOPT_UNSHARED = 1 << 1,	       /*%< See below. */
-	DNS_FETCHOPT_RECURSIVE = 1 << 2,       /*%< Set RD? */
-	DNS_FETCHOPT_NOEDNS0 = 1 << 3,	       /*%< Do not use EDNS. */
-	DNS_FETCHOPT_FORWARDONLY = 1 << 4,     /*%< Only use forwarders. */
-	DNS_FETCHOPT_NOVALIDATE = 1 << 5,      /*%< Disable validation. */
-	DNS_FETCHOPT_WANTNSID = 1 << 6,	       /*%< Request NSID */
-	DNS_FETCHOPT_PREFETCH = 1 << 7,	       /*%< Do prefetch */
-	DNS_FETCHOPT_NOCDFLAG = 1 << 8,	       /*%< Don't set CD flag. */
-	DNS_FETCHOPT_NONTA = 1 << 9,	       /*%< Ignore NTA table. */
-	DNS_FETCHOPT_NOCACHED = 1 << 10,       /*%< Force cache update. */
-	DNS_FETCHOPT_QMINIMIZE = 1 << 11,      /*%< Use qname minimization. */
-	DNS_FETCHOPT_NOFOLLOW = 1 << 12,       /*%< Don't retrieve the NS RRset
-						* from the child zone when a
-						* delegation is returned in
-						* response to a NS query. */
-	DNS_FETCHOPT_QMIN_STRICT = 1 << 13,    /*%< Do not work around servers
-						* that return errors on
-						* non-empty terminals. */
-	DNS_FETCHOPT_QMIN_SKIP_IP6A = 1 << 14, /*%< Skip some labels when
-						* doing qname minimization
-						* on ip6.arpa. */
-	DNS_FETCHOPT_NOFORWARD = 1 << 15,      /*%< Do not use forwarders if
-						* possible. */
-	DNS_FETCHOPT_QMINFETCH = 1 << 16,      /*%< Qmin fetch */
+	DNS_FETCHOPT_TCP = 1 << 0,		/*%< Use TCP. */
+	DNS_FETCHOPT_UNSHARED = 1 << 1,		/*%< See below. */
+	DNS_FETCHOPT_RECURSIVE = 1 << 2,	/*%< Set RD? */
+	DNS_FETCHOPT_NOEDNS0 = 1 << 3,		/*%< Do not use EDNS. */
+	DNS_FETCHOPT_FORWARDONLY = 1 << 4,	/*%< Only use forwarders. */
+	DNS_FETCHOPT_NOVALIDATE = 1 << 5,	/*%< Disable validation. */
+	DNS_FETCHOPT_WANTNSID = 1 << 6,		/*%< Request NSID */
+	DNS_FETCHOPT_PREFETCH = 1 << 7,		/*%< Do prefetch */
+	DNS_FETCHOPT_NOCDFLAG = 1 << 8,		/*%< Don't set CD flag. */
+	DNS_FETCHOPT_NONTA = 1 << 9,		/*%< Ignore NTA table. */
+	DNS_FETCHOPT_NOCACHED = 1 << 10,	/*%< Force cache update. */
+	DNS_FETCHOPT_QMINIMIZE = 1 << 11,	/*%< Use qname minimization. */
+	DNS_FETCHOPT_NOFOLLOW = 1 << 12,	/*%< Don't retrieve the NS RRset
+						 * from the child zone when a
+						 * delegation is returned in
+						 * response to a NS query. */
+	DNS_FETCHOPT_QMIN_STRICT = 1 << 13,	/*%< Do not work around servers
+						 * that return errors on
+						 * non-empty terminals. */
+	DNS_FETCHOPT_QMIN_SKIP_IP6A = 1 << 14,	/*%< Skip some labels when
+						 * doing qname minimization
+						 * on ip6.arpa. */
+	DNS_FETCHOPT_NOFORWARD = 1 << 15,	/*%< Do not use forwarders if
+						 * possible. */
+	DNS_FETCHOPT_QMINFETCH = 1 << 16,	/*%< Qmin fetch */
+	DNS_FETCHOPT_WANTZONEVERSION = 1 << 17, /*%< Request ZONEVERSION */

 	/*% EDNS version bits: */
 	DNS_FETCHOPT_EDNSVERSIONSET = 1 << 23,
@@ -145,6 +145,7 @@ struct dns_view {
 	dns_rrl_t	     *rrl;
 	bool		      provideixfr;
 	bool		      requestnsid;
+	bool		      requestzoneversion;
 	bool		      sendcookie;
 	dns_ttl_t	      maxcachettl;
 	dns_ttl_t	      maxncachettl;
@@ -102,6 +102,7 @@ typedef enum {
 	DNS_ZONEOPT_CHECKTTL = 1 << 28,	      /*%< check max-zone-ttl */
 	DNS_ZONEOPT_AUTOEMPTY = 1 << 29,      /*%< automatic empty zone */
 	DNS_ZONEOPT_CHECKSVCB = 1 << 30,      /*%< check SVBC records */
+	DNS_ZONEOPT_ZONEVERSION = 1U << 31,   /*%< enable zoneversion */
 	DNS_ZONEOPT___MAX = UINT64_MAX, /* trick to make the ENUM 64-bit wide */
 } dns_zoneopt_t;

@@ -2785,6 +2786,24 @@ dns_zone_getrad(dns_zone_t *zone, dns_name_t *name);
 * \li	'name' is a valid name with a buffer.
 */

+isc_result_t
+dns_zone_getzoneversion(dns_zone_t *zone, isc_buffer_t *b);
+/**<
+ * Return the EDNS ZONEVERSION for this zone.
+ *
+ * Note: For type SERIAL a buffer of at least 6 octets is required.
+ *
+ * Requires:
+ * \li	'zone' to be a valid zone.
+ * \li	'b' to be a valid buffer.
+ *
+ * Returns
+ * \li	ISC_R_SUCCESS if the zone is loaded and supports ZONEVERSION.
+ * \li	ISC_R_NOSPACE if the buffer is too small.
+ * \li	DNS_R_NOTLOADED if the database is not loaded.
+ * \li	ISC_R_FAILURE other failure.
+ */
+
 #if DNS_ZONE_TRACE
 #define dns_zone_ref(ptr)   dns_zone__ref(ptr, __func__, __FILE__, __LINE__)
 #define dns_zone_unref(ptr) dns_zone__unref(ptr, __func__, __FILE__, __LINE__)
@@ -134,6 +134,9 @@ bool
 dst_key_iszonekey(const dst_key_t *key) {
 	REQUIRE(VALID_KEY(key));

+	if ((key->key_flags & DNS_KEYTYPE_NOAUTH) != 0) {
+		return false;
+	}
 	if ((key->key_flags & DNS_KEYFLAG_OWNERMASK) != DNS_KEYOWNER_ZONE) {
 		return false;
 	}
@@ -3512,6 +3512,116 @@ static const char *option_names[] = {
 	[DNS_OPT_ZONEVERSION] = "ZONEVERSION",
 };

+static isc_result_t
+render_zoneversion(dns_message_t *msg, isc_buffer_t *optbuf,
+		   const dns_master_style_t *style, isc_buffer_t *target) {
+	isc_result_t result = ISC_R_SUCCESS;
+	unsigned int labels = isc_buffer_getuint8(optbuf);
+	unsigned int type = isc_buffer_getuint8(optbuf);
+	char buf[sizeof("4000000000")];
+	char namebuf[DNS_NAME_FORMATSIZE];
+	dns_name_t *name = ISC_LIST_HEAD(msg->sections[DNS_SECTION_QUESTION]);
+	dns_name_t suffix = DNS_NAME_INITEMPTY;
+	bool yaml = false, rawmode = false;
+	const char *sep1 = " ", *sep2 = ", ";
+
+	if ((dns_master_styleflags(style) & DNS_STYLEFLAG_YAML) != 0) {
+		msg->indent.count++;
+		sep1 = sep2 = "\n";
+		yaml = true;
+	}
+
+	ADD_STRING(target, sep1);
+
+	if (msg->counts[DNS_SECTION_QUESTION] != 1 || name == NULL ||
+	    dns_name_countlabels(name) < labels + 1)
+	{
+		rawmode = true;
+		INDENT(style);
+		ADD_STRING(target, "LABELS: ");
+		snprintf(buf, sizeof(buf), "%u", labels);
+		ADD_STRING(target, buf);
+	} else {
+		dns_name_split(name, labels + 1, NULL, &suffix);
+		dns_name_format(&suffix, namebuf, sizeof(namebuf));
+
+		INDENT(style);
+		ADD_STRING(target, "ZONE: ");
+		if (yaml) {
+			char *s = namebuf;
+			ADD_STRING(target, "\"");
+			while (*s != 0) {
+				if (*s == '\\' || *s == '"') {
+					ADD_STRING(target, "\\");
+				}
+				if (isc_buffer_availablelength(target) < 1) {
+					result = ISC_R_NOSPACE;
+					goto cleanup;
+				}
+				isc_buffer_putmem(target, (unsigned char *)s,
+						  1);
+				s++;
+			}
+			ADD_STRING(target, "\"");
+		} else {
+			ADD_STRING(target, namebuf);
+		}
+	}
+	ADD_STRING(target, sep2);
+
+	if (!rawmode && type == 0 && isc_buffer_remaininglength(optbuf) == 4) {
+		uint32_t serial = isc_buffer_getuint32(optbuf);
+		INDENT(style);
+		ADD_STRING(target, "SOA-SERIAL: ");
+		snprintf(buf, sizeof(buf), "%u", serial);
+		ADD_STRING(target, buf);
+	} else {
+		size_t len = isc_buffer_remaininglength(optbuf);
+		unsigned char *data = isc_buffer_current(optbuf);
+		INDENT(style);
+		ADD_STRING(target, "TYPE: ");
+		snprintf(buf, sizeof(buf), "%u", type);
+		ADD_STRING(target, buf);
+		ADD_STRING(target, sep2);
+		INDENT(style);
+		ADD_STRING(target, "VALUE: ");
+		for (size_t i = 0; i < len; i++) {
+			snprintf(buf, sizeof(buf), "%02x", data[i]);
+			ADD_STRING(target, buf);
+		}
+		if (yaml) {
+			ADD_STRING(target, sep2);
+			INDENT(style);
+			ADD_STRING(target, "PVALUE: \"");
+		} else {
+			ADD_STRING(target, " (\"");
+		}
+		for (size_t i = 0; i < len; i++) {
+			if (isprint(data[i])) {
+				if (yaml && (data[i] == '\\' || data[i] == '"'))
+				{
+					ADD_STRING(target, "\\");
+				}
+				if (isc_buffer_availablelength(target) < 1) {
+					result = ISC_R_NOSPACE;
+					goto cleanup;
+				}
+				isc_buffer_putmem(target, &data[i], 1);
+			} else {
+				ADD_STRING(target, ".");
+			}
+		}
+		if (yaml) {
+			ADD_STRING(target, "\"");
+		} else {
+			ADD_STRING(target, "\")");
+		}
+		isc_buffer_forward(optbuf, len);
+	}
+cleanup:
+	return result;
+}
+
 static isc_result_t
 dns_message_pseudosectiontoyaml(dns_message_t *msg, dns_pseudosection_t section,
 				const dns_master_style_t *style,
@@ -3789,6 +3899,20 @@ dns_message_pseudosectiontoyaml(dns_message_t *msg, dns_pseudosection_t section,
 					optbuf = sb;
 				}
 				break;
+			case DNS_OPT_ZONEVERSION:
+				if (optlen >= 2U) {
+					isc_buffer_t zonebuf = optbuf;
+					isc_buffer_setactive(&zonebuf, optlen);
+					result = render_zoneversion(
+						msg, &zonebuf, style, target);
+					if (result != ISC_R_SUCCESS) {
+						goto cleanup;
+					}
+					isc_buffer_forward(&optbuf, optlen);
+					ADD_STRING(target, "\n");
+					continue;
+				}
+				break;
 			default:
 				break;
 			}
@@ -4208,6 +4332,20 @@ dns_message_pseudosectiontotext(dns_message_t *msg, dns_pseudosection_t section,
 					optbuf = sb;
 				}
 				break;
+			case DNS_OPT_ZONEVERSION:
+				if (optlen >= 2U) {
+					isc_buffer_t zonebuf = optbuf;
+					isc_buffer_setactive(&zonebuf, optlen);
+					result = render_zoneversion(
+						msg, &zonebuf, style, target);
+					if (result != ISC_R_SUCCESS) {
+						goto cleanup;
+					}
+					ADD_STRING(target, "\n");
+					isc_buffer_forward(&optbuf, optlen);
+					continue;
+				}
+				break;
 			default:
 				break;
 			}
@@ -57,6 +57,7 @@ struct dns_peer {
 	bool request_ixfr;
 	bool support_edns;
 	bool request_nsid;
+	bool request_zoneversion;
 	bool send_cookie;
 	bool require_cookie;
 	bool request_expire;
@@ -98,7 +99,8 @@ enum {
 	SERVER_PADDING_BIT,
 	REQUEST_TCP_KEEPALIVE_BIT,
 	REQUIRE_COOKIE_BIT,
-	DNS_PEER_FLAGS_COUNT
+	DNS_PEER_FLAGS_COUNT,
+	REQUEST_ZONEVERSION
 };

 STATIC_ASSERT(DNS_PEER_FLAGS_COUNT <= CHAR_BIT * sizeof(uint32_t),
@@ -382,6 +384,8 @@ ACCESS_OPTION(requestixfr, REQUEST_IXFR_BIT, bool, request_ixfr)
 ACCESS_OPTION(requestixfrmaxdiffs, REQUEST_IXFRMAXDIFFS_BIT, uint32_t,
 	      request_ixfr_maxdiffs)
 ACCESS_OPTION(requestnsid, REQUEST_NSID_BIT, bool, request_nsid)
+ACCESS_OPTION(requestzoneversion, REQUEST_ZONEVERSION, bool,
+	      request_zoneversion)
 ACCESS_OPTION(requirecookie, REQUIRE_COOKIE_BIT, bool, require_cookie)
 ACCESS_OPTION(sendcookie, SEND_COOKIE_BIT, bool, send_cookie)
 ACCESS_OPTION(supportedns, SUPPORT_EDNS_BIT, bool, support_edns)
@@ -266,6 +266,21 @@ fromwire_opt(ARGS_FROMWIRE) {
 			}
 			isc_region_consume(&sregion, length);
 			break;
+		case DNS_OPT_ZONEVERSION:
+			if (length == 0) {
+				/* Request */
+				break;
+			}
+			/* Labels and Type */
+			if (length < 2) {
+				return DNS_R_OPTERR;
+			}
+			/* Type 0 (serial), length is 6. */
+			if (sregion.base[1] == 0 && length != 6) {
+				return DNS_R_OPTERR;
+			}
+			isc_region_consume(&sregion, length);
+			break;
 		default:
 			isc_region_consume(&sregion, length);
 			break;
@@ -24,6 +24,7 @@
 #include <isc/counter.h>
 #include <isc/hash.h>
 #include <isc/hashmap.h>
+#include <isc/hex.h>
 #include <isc/log.h>
 #include <isc/loop.h>
 #include <isc/mutex.h>
@@ -2504,6 +2505,7 @@ resquery_send(resquery_t *query) {
 			unsigned int flags = query->addrinfo->flags;
 			bool reqnsid = res->view->requestnsid;
 			bool sendcookie = res->view->sendcookie;
+			bool reqzoneversion = res->view->requestzoneversion;
 			bool tcpkeepalive = false;
 			unsigned char cookie[COOKIE_BUFFER_SIZE];
 			uint16_t padding = 0;
@@ -2546,8 +2548,6 @@ resquery_send(resquery_t *query) {
 			 */
 			if (peer != NULL) {
 				uint8_t ednsversion;
-				(void)dns_peer_getrequestnsid(peer, &reqnsid);
-				(void)dns_peer_getsendcookie(peer, &sendcookie);
 				result = dns_peer_getednsversion(peer,
 								 &ednsversion);
 				if (result == ISC_R_SUCCESS &&
@@ -2555,6 +2555,10 @@ resquery_send(resquery_t *query) {
 				{
 					version = ednsversion;
 				}
+				(void)dns_peer_getrequestnsid(peer, &reqnsid);
+				(void)dns_peer_getrequestzoneversion(
+					peer, &reqzoneversion);
+				(void)dns_peer_getsendcookie(peer, &sendcookie);
 			}
 			if (NOCOOKIE(query->addrinfo)) {
 				sendcookie = false;
@@ -2566,6 +2570,13 @@ resquery_send(resquery_t *query) {
 				ednsopts[ednsopt].value = NULL;
 				ednsopt++;
 			}
+			if (reqzoneversion) {
+				INSIST(ednsopt < DNS_EDNSOPTIONS);
+				ednsopts[ednsopt].code = DNS_OPT_ZONEVERSION;
+				ednsopts[ednsopt].length = 0;
+				ednsopts[ednsopt].value = NULL;
+				ednsopt++;
+			}
 			if (sendcookie) {
 				INSIST(ednsopt < DNS_EDNSOPTIONS);
 				ednsopts[ednsopt].code = DNS_OPT_COOKIE;
@@ -2620,8 +2631,14 @@ resquery_send(resquery_t *query) {
 			query->ednsversion = version;
 			result = fctx_addopt(fctx->qmessage, version, udpsize,
 					     ednsopts, ednsopt);
-			if (reqnsid && result == ISC_R_SUCCESS) {
-				query->options |= DNS_FETCHOPT_WANTNSID;
+			if (result == ISC_R_SUCCESS) {
+				if (reqnsid) {
+					query->options |= DNS_FETCHOPT_WANTNSID;
+				}
+				if (reqzoneversion) {
+					query->options |=
+						DNS_FETCHOPT_WANTZONEVERSION;
+				}
 			} else if (result != ISC_R_SUCCESS) {
 				/*
 				 * We couldn't add the OPT, but we'll
@@ -7387,17 +7404,38 @@ checknames(dns_message_t *message) {
 	checknamessection(message, DNS_SECTION_ADDITIONAL);
 }

+static void
+make_hex(unsigned char *src, size_t srclen, char *buf, size_t buflen) {
+	isc_buffer_t b;
+	isc_region_t r;
+	isc_result_t result;
+
+	r.base = src;
+	r.length = srclen;
+	isc_buffer_init(&b, buf, buflen);
+	result = isc_hex_totext(&r, 0, "", &b);
+	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+	isc_buffer_putuint8(&b, '\0');
+}
+
+static void
+make_printable(unsigned char *src, size_t srclen, char *buf, size_t buflen) {
+	INSIST(buflen > srclen);
+	while (srclen-- > 0) {
+		unsigned char c = *src++;
+		*buf++ = isprint(c) ? c : '.';
+	}
+	*buf = '\0';
+}
+
 /*
 * Log server NSID at log level 'level'
 */
 static void
 log_nsid(isc_buffer_t *opt, size_t nsid_len, resquery_t *query, int level,
 	 isc_mem_t *mctx) {
-	static const char hex[17] = "0123456789abcdef";
-	char addrbuf[ISC_SOCKADDR_FORMATSIZE];
+	char addrbuf[ISC_SOCKADDR_FORMATSIZE], *buf = NULL, *pbuf = NULL;
 	size_t buflen;
-	unsigned char *p, *nsid;
-	unsigned char *buf = NULL, *pbuf = NULL;

 	REQUIRE(nsid_len <= UINT16_MAX);

@@ -7407,20 +7445,10 @@ log_nsid(isc_buffer_t *opt, size_t nsid_len, resquery_t *query, int level,
 	pbuf = isc_mem_get(mctx, nsid_len + 1);

 	/* Convert to hex */
-	p = buf;
-	nsid = isc_buffer_current(opt);
-	for (size_t i = 0; i < nsid_len; i++) {
-		*p++ = hex[(nsid[i] >> 4) & 0xf];
-		*p++ = hex[nsid[i] & 0xf];
-	}
-	*p = '\0';
+	make_hex(isc_buffer_current(opt), nsid_len, buf, buflen);

 	/* Make printable version */
-	p = pbuf;
-	for (size_t i = 0; i < nsid_len; i++) {
-		*p++ = isprint(nsid[i]) ? nsid[i] : '.';
-	}
-	*p = '\0';
+	make_printable(isc_buffer_current(opt), nsid_len, pbuf, nsid_len + 1);

 	isc_sockaddr_format(&query->addrinfo->sockaddr, addrbuf,
 			    sizeof(addrbuf));
@@ -7431,6 +7459,108 @@ log_nsid(isc_buffer_t *opt, size_t nsid_len, resquery_t *query, int level,
 	isc_mem_put(mctx, buf, buflen);
 }

+static void
+log_zoneversion(unsigned char *version, size_t version_len, unsigned char *nsid,
+		size_t nsid_len, resquery_t *query, int level,
+		isc_mem_t *mctx) {
+	char addrbuf[ISC_SOCKADDR_FORMATSIZE];
+	char namebuf[DNS_NAME_FORMATSIZE];
+	size_t nsid_buflen = 0;
+	char *nsid_buf = NULL;
+	char *nsid_pbuf = NULL;
+	const char *nsid_hex = "";
+	const char *nsid_print = "";
+	const char *sep_1 = "";
+	const char *sep_2 = "";
+	const char *sep_3 = "";
+	dns_name_t suffix = DNS_NAME_INITEMPTY;
+	unsigned int labels;
+
+	REQUIRE(version_len <= UINT16_MAX);
+
+	/*
+	 * Don't log reflected ZONEVERSION option.
+	 */
+	if (version_len == 0) {
+		return;
+	}
+
+	/* Enforced by dns_rdata_fromwire. */
+	INSIST(version_len >= 2);
+
+	/*
+	 * Sanity check on label count.
+	 */
+	labels = version[0] + 1;
+	if (dns_name_countlabels(query->fctx->name) < labels) {
+		return;
+	}
+
+	/*
+	 * Get zone name.
+	 */
+	dns_name_split(query->fctx->name, labels, NULL, &suffix);
+	dns_name_format(&suffix, namebuf, sizeof(namebuf));
+
+	if (nsid != NULL) {
+		nsid_buflen = nsid_len * 2 + 1;
+		nsid_hex = nsid_buf = isc_mem_get(mctx, nsid_buflen);
+		nsid_print = nsid_pbuf = isc_mem_get(mctx, nsid_len + 1);
+
+		/* Convert to hex */
+		make_hex(nsid, nsid_len, nsid_buf, nsid_buflen);
+
+		/* Convert to printable */
+		make_printable(nsid, nsid_len, nsid_pbuf, nsid_len + 1);
+
+		sep_1 = " (NSID ";
+		sep_2 = " (";
+		sep_3 = "))";
+	}
+
+	isc_sockaddr_format(&query->addrinfo->sockaddr, addrbuf,
+			    sizeof(addrbuf));
+	if (version[1] == 0 && version_len == 6) {
+		uint32_t serial = version[2] << 24 | version[3] << 2 |
+				  version[4] << 8 | version[5];
+		isc_log_write(DNS_LOGCATEGORY_ZONEVERSION,
+			      DNS_LOGMODULE_RESOLVER, level,
+			      "received ZONEVERSION serial %u from %s for %s "
+			      "zone %s%s%s%s%s%s",
+			      serial, addrbuf, query->fctx->info, namebuf,
+			      sep_1, nsid_hex, sep_2, nsid_print, sep_3);
+	} else {
+		size_t version_buflen = version_len * 2 + 1;
+		char *version_hex = isc_mem_get(mctx, version_buflen);
+		char *version_pbuf = isc_mem_get(mctx, version_len - 1);
+
+		/* Convert to hex */
+		make_hex(version + 2, version_len - 2, version_hex,
+			 version_buflen);
+
+		/* Convert to printable */
+		make_printable(version + 2, version_len - 2, version_pbuf,
+			       version_len - 1);
+
+		isc_log_write(DNS_LOGCATEGORY_ZONEVERSION,
+			      DNS_LOGMODULE_RESOLVER, level,
+			      "received ZONEVERSION type %u value %s (%s) from "
+			      "%s for %s zone %s%s%s%s%s%s",
+			      version[1], version_hex, version_pbuf, addrbuf,
+			      query->fctx->info, namebuf, sep_1, nsid_hex,
+			      sep_2, nsid_print, sep_3);
+		isc_mem_put(mctx, version_hex, version_buflen);
+		isc_mem_put(mctx, version_pbuf, version_len - 1);
+	}
+
+	if (nsid_pbuf != NULL) {
+		isc_mem_put(mctx, nsid_pbuf, nsid_len + 1);
+	}
+	if (nsid_buf != NULL) {
+		isc_mem_put(mctx, nsid_buf, nsid_buflen);
+	}
+}
+
 static bool
 betterreferral(respctx_t *rctx) {
 	isc_result_t result;
@@ -8191,6 +8321,11 @@ rctx_opt(respctx_t *rctx) {
 	isc_result_t result;
 	bool seen_cookie = false;
 	bool seen_nsid = false;
+	bool seen_zoneversion = false;
+	unsigned char *nsid = NULL;
+	uint16_t nsidlen = 0;
+	unsigned char *zoneversion = NULL;
+	uint16_t zoneversionlen = 0;

 	result = dns_rdataset_first(rctx->opt);
 	if (result != ISC_R_SUCCESS) {
@@ -8216,7 +8351,8 @@ rctx_opt(respctx_t *rctx) {
 				break;
 			}
 			seen_nsid = true;
-
+			nsid = isc_buffer_current(&optbuf);
+			nsidlen = optlen;
 			if ((query->options & DNS_FETCHOPT_WANTNSID) != 0) {
 				log_nsid(&optbuf, optlen, query, ISC_LOG_INFO,
 					 fctx->mctx);
@@ -8254,12 +8390,27 @@ rctx_opt(respctx_t *rctx) {
 						  optvalue, optlen);
 			}
 			break;
+		case DNS_OPT_ZONEVERSION:
+			if (seen_zoneversion) {
+				break;
+			}
+			seen_zoneversion = true;
+			zoneversion = isc_buffer_current(&optbuf);
+			zoneversionlen = optlen;
+			break;
 		default:
 			break;
 		}
 		isc_buffer_forward(&optbuf, optlen);
 	}
 	INSIST(isc_buffer_remaininglength(&optbuf) == 0U);
+
+	if ((query->options & DNS_FETCHOPT_WANTZONEVERSION) != 0 &&
+	    zoneversion != NULL)
+	{
+		log_zoneversion(zoneversion, zoneversionlen, nsid, nsidlen,
+				query, ISC_LOG_INFO, fctx->mctx);
+	}
 }

 /*
@@ -1497,6 +1497,56 @@ dns_zone_getserial(dns_zone_t *zone, uint32_t *serialp) {
 	return result;
 }

+isc_result_t
+dns_zone_getzoneversion(dns_zone_t *zone, isc_buffer_t *b) {
+	isc_result_t result = DNS_R_NOTLOADED;
+	unsigned int soacount;
+	uint32_t serial;
+	dns_zone_t *mayberaw = zone;
+
+	REQUIRE(DNS_ZONE_VALID(zone));
+	REQUIRE(b != NULL);
+
+	LOCK_ZONE(zone);
+	if (zone->raw != NULL) {
+		LOCK_ZONE(zone->raw);
+		mayberaw = zone->raw;
+	}
+	ZONEDB_LOCK(&mayberaw->dblock, isc_rwlocktype_read);
+	if (DNS_ZONE_OPTION(mayberaw, DNS_ZONEOPT_ZONEVERSION) &&
+	    mayberaw->db != NULL)
+	{
+		result = dns_db_getzoneversion(mayberaw->db, b);
+		if (result == ISC_R_NOTIMPLEMENTED) {
+			result = zone_get_from_db(mayberaw, mayberaw->db, NULL,
+						  &soacount, NULL, &serial,
+						  NULL, NULL, NULL, NULL, NULL);
+			if (result == ISC_R_SUCCESS && soacount == 0) {
+				result = ISC_R_FAILURE;
+			}
+			if (result == ISC_R_SUCCESS) {
+				if (isc_buffer_availablelength(b) >= 6) {
+					isc_buffer_putuint8(
+						b, dns_name_countlabels(
+							   &mayberaw->origin) -
+							   1);
+					isc_buffer_putuint8(b, 0);
+					isc_buffer_putuint32(b, serial);
+				} else {
+					result = ISC_R_NOSPACE;
+				}
+			}
+		}
+	}
+	ZONEDB_UNLOCK(&mayberaw->dblock, isc_rwlocktype_read);
+	if (zone->raw != NULL) {
+		UNLOCK_ZONE(zone->raw);
+	}
+	UNLOCK_ZONE(zone);
+
+	return result;
+}
+
 /*
 *	Single shot.
 */
@@ -6389,7 +6439,9 @@ findzonekeys(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver,
 		RETERR(dns_dnssec_keyfromrdata(name, &rdata, mctx, &pubkey));
 		dst_key_setttl(pubkey, rdataset.ttl);

-		if (!is_zone_key(pubkey)) {
+		if (!is_zone_key(pubkey) ||
+		    (dst_key_flags(pubkey) & DNS_KEYTYPE_NOAUTH) != 0)
+		{
 			goto next;
 		}
 		/* Corrupted .key file? */
@@ -6483,6 +6535,12 @@ findzonekeys(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver,
 		 * been, the rdataset TTL takes priority.
 		 */
 		dst_key_setttl(keys[count], rdataset.ttl);
+
+		if ((dst_key_flags(keys[count]) & DNS_KEYTYPE_NOAUTH) != 0) {
+			/* We should never get here. */
+			dst_key_free(&keys[count]);
+			goto next;
+		}
 		count++;
 	next:
 		if (pubkey != NULL) {
@@ -20555,7 +20613,8 @@ add_signing_records(dns_db_t *db, dns_rdatatype_t privatetype,

 		result = dns_rdata_tostruct(&tuple->rdata, &dnskey, NULL);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
-		if ((dnskey.flags & DNS_KEYFLAG_OWNERMASK) != DNS_KEYOWNER_ZONE)
+		if ((dnskey.flags & (DNS_KEYFLAG_OWNERMASK |
+				     DNS_KEYTYPE_NOAUTH)) != DNS_KEYOWNER_ZONE)
 		{
 			ISC_LIST_UNLINK(diff->tuples, tuple, link);
 			ISC_LIST_APPEND(tuples, tuple, link);
@@ -119,36 +119,37 @@ enum isc_logcategory {
 	NAMED_LOGCATEGORY_GENERAL = ISC_LOGCATEGORY_GENERAL,
 	ISC_LOGCATEGORY_SSLKEYLOG,
 	/* dns categories */
-	DNS_LOGCATEGORY_NOTIFY,
+	DNS_LOGCATEGORY_CNAME,
 	DNS_LOGCATEGORY_DATABASE,
-	DNS_LOGCATEGORY_SECURITY,
+	DNS_LOGCATEGORY_DISPATCH,
 	DNS_LOGCATEGORY_DNSSEC,
+	DNS_LOGCATEGORY_DNSTAP,
+	DNS_LOGCATEGORY_EDNS_DISABLED,
+	DNS_LOGCATEGORY_LAME_SERVERS,
+	DNS_LOGCATEGORY_NOTIFY,
+	DNS_LOGCATEGORY_NSID,
 	DNS_LOGCATEGORY_RESOLVER,
+	DNS_LOGCATEGORY_RPZ,
+	DNS_LOGCATEGORY_RPZ_PASSTHRU,
+	DNS_LOGCATEGORY_RRL,
+	DNS_LOGCATEGORY_SECURITY,
+	DNS_LOGCATEGORY_SPILL,
+	DNS_LOGCATEGORY_UPDATE_POLICY,
 	DNS_LOGCATEGORY_XFER_IN,
 	DNS_LOGCATEGORY_XFER_OUT,
-	DNS_LOGCATEGORY_DISPATCH,
-	DNS_LOGCATEGORY_LAME_SERVERS,
-	DNS_LOGCATEGORY_EDNS_DISABLED,
-	DNS_LOGCATEGORY_RPZ,
-	DNS_LOGCATEGORY_RRL,
-	DNS_LOGCATEGORY_CNAME,
-	DNS_LOGCATEGORY_SPILL,
-	DNS_LOGCATEGORY_DNSTAP,
 	DNS_LOGCATEGORY_ZONELOAD,
-	DNS_LOGCATEGORY_NSID,
-	DNS_LOGCATEGORY_RPZ_PASSTHRU,
-	DNS_LOGCATEGORY_UPDATE_POLICY,
+	DNS_LOGCATEGORY_ZONEVERSION,
 	/* ns categories */
 	NS_LOGCATEGORY_CLIENT,
-	NS_LOGCATEGORY_NETWORK,
-	NS_LOGCATEGORY_UPDATE,
-	NS_LOGCATEGORY_QUERIES,
-	NS_LOGCATEGORY_UPDATE_SECURITY,
-	NS_LOGCATEGORY_QUERY_ERRORS,
-	NS_LOGCATEGORY_TAT,
-	NS_LOGCATEGORY_SERVE_STALE,
-	NS_LOGCATEGORY_RESPONSES,
 	NS_LOGCATEGORY_DRA,
+	NS_LOGCATEGORY_NETWORK,
+	NS_LOGCATEGORY_QUERIES,
+	NS_LOGCATEGORY_QUERY_ERRORS,
+	NS_LOGCATEGORY_RESPONSES,
+	NS_LOGCATEGORY_SERVE_STALE,
+	NS_LOGCATEGORY_TAT,
+	NS_LOGCATEGORY_UPDATE,
+	NS_LOGCATEGORY_UPDATE_SECURITY,
 	/* cfg categories */
 	CFG_LOGCATEGORY_CONFIG,
 	/* named categories */
@@ -170,36 +170,37 @@ static const char *categories_description[] = {
 	[ISC_LOGCATEGORY_GENERAL] = "general",
 	[ISC_LOGCATEGORY_SSLKEYLOG] = "sslkeylog",
 	/* dns categories */
-	[DNS_LOGCATEGORY_NOTIFY] = "notify",
+	[DNS_LOGCATEGORY_CNAME] = "cname",
 	[DNS_LOGCATEGORY_DATABASE] = "database",
-	[DNS_LOGCATEGORY_SECURITY] = "security",
+	[DNS_LOGCATEGORY_DISPATCH] = "dispatch",
 	[DNS_LOGCATEGORY_DNSSEC] = "dnssec",
+	[DNS_LOGCATEGORY_DNSTAP] = "dnstap",
+	[DNS_LOGCATEGORY_EDNS_DISABLED] = "edns-disabled",
+	[DNS_LOGCATEGORY_LAME_SERVERS] = "lame-servers",
+	[DNS_LOGCATEGORY_NOTIFY] = "notify",
+	[DNS_LOGCATEGORY_NSID] = "nsid",
 	[DNS_LOGCATEGORY_RESOLVER] = "resolver",
+	[DNS_LOGCATEGORY_RPZ] = "rpz",
+	[DNS_LOGCATEGORY_RPZ_PASSTHRU] = "rpz-passthru",
+	[DNS_LOGCATEGORY_RRL] = "rate-limit",
+	[DNS_LOGCATEGORY_SECURITY] = "security",
+	[DNS_LOGCATEGORY_SPILL] = "spill",
+	[DNS_LOGCATEGORY_UPDATE_POLICY] = "update-policy",
 	[DNS_LOGCATEGORY_XFER_IN] = "xfer-in",
 	[DNS_LOGCATEGORY_XFER_OUT] = "xfer-out",
-	[DNS_LOGCATEGORY_DISPATCH] = "dispatch",
-	[DNS_LOGCATEGORY_LAME_SERVERS] = "lame-servers",
-	[DNS_LOGCATEGORY_EDNS_DISABLED] = "edns-disabled",
-	[DNS_LOGCATEGORY_RPZ] = "rpz",
-	[DNS_LOGCATEGORY_RRL] = "rate-limit",
-	[DNS_LOGCATEGORY_CNAME] = "cname",
-	[DNS_LOGCATEGORY_SPILL] = "spill",
-	[DNS_LOGCATEGORY_DNSTAP] = "dnstap",
 	[DNS_LOGCATEGORY_ZONELOAD] = "zoneload",
-	[DNS_LOGCATEGORY_NSID] = "nsid",
-	[DNS_LOGCATEGORY_RPZ_PASSTHRU] = "rpz-passthru",
-	[DNS_LOGCATEGORY_UPDATE_POLICY] = "update-policy",
+	[DNS_LOGCATEGORY_ZONEVERSION] = "zoneversion",
 	/* ns categories */
 	[NS_LOGCATEGORY_CLIENT] = "client",
-	[NS_LOGCATEGORY_NETWORK] = "network",
-	[NS_LOGCATEGORY_UPDATE] = "update",
-	[NS_LOGCATEGORY_QUERIES] = "queries",
-	[NS_LOGCATEGORY_UPDATE_SECURITY] = "update-security",
-	[NS_LOGCATEGORY_QUERY_ERRORS] = "query-errors",
-	[NS_LOGCATEGORY_TAT] = "trust-anchor-telemetry",
 	[NS_LOGCATEGORY_DRA] = "dns-reporting-agent",
-	[NS_LOGCATEGORY_SERVE_STALE] = "serve-stale",
+	[NS_LOGCATEGORY_NETWORK] = "network",
+	[NS_LOGCATEGORY_QUERIES] = "queries",
+	[NS_LOGCATEGORY_QUERY_ERRORS] = "query-errors",
 	[NS_LOGCATEGORY_RESPONSES] = "responses",
+	[NS_LOGCATEGORY_SERVE_STALE] = "serve-stale",
+	[NS_LOGCATEGORY_TAT] = "trust-anchor-telemetry",
+	[NS_LOGCATEGORY_UPDATE] = "update",
+	[NS_LOGCATEGORY_UPDATE_SECURITY] = "update-security",
 	/* cfg categories */
 	[CFG_LOGCATEGORY_CONFIG] = "config",
 	/* named categories */
@@ -4242,6 +4242,7 @@ static struct {
 	{ "request-expire", dns_peer_setrequestexpire },
 	{ "request-ixfr", dns_peer_setrequestixfr },
 	{ "request-nsid", dns_peer_setrequestnsid },
+	{ "request-zoneversion", dns_peer_setrequestzoneversion },
 	{ "send-cookie", dns_peer_setsendcookie },
 	{ "tcp-keepalive", dns_peer_settcpkeepalive },
 	{ "tcp-only", dns_peer_setforcetcp },
@@ -2110,6 +2110,7 @@ static cfg_clausedef_t view_clauses[] = {
 	{ "recursion", &cfg_type_boolean, 0 },
 	{ "request-nsid", &cfg_type_boolean, 0 },
 	{ "request-sit", NULL, CFG_CLAUSEFLAG_ANCIENT },
+	{ "request-zoneversion", &cfg_type_boolean, 0 },
 	{ "require-server-cookie", &cfg_type_boolean, 0 },
 	{ "resolver-nonbackoff-tries", NULL, CFG_CLAUSEFLAG_ANCIENT },
 	{ "resolver-query-timeout", &cfg_type_uint32, 0 },
@@ -2354,6 +2355,8 @@ static cfg_clausedef_t zone_clauses[] = {
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY },
 	{ "parental-source-v6", &cfg_type_sockaddr6wild,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY },
+	{ "provide-zoneversion", &cfg_type_boolean,
+	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR },
 	{ "send-report-channel", &cfg_type_astring,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY },
 	{ "request-expire", &cfg_type_boolean,
@@ -2603,6 +2606,7 @@ static cfg_clausedef_t server_clauses[] = {
 	{ "request-ixfr", &cfg_type_boolean, 0 },
 	{ "request-ixfr-max-diffs", &cfg_type_uint32, 0 },
 	{ "request-nsid", &cfg_type_boolean, 0 },
+	{ "request-zoneversion", &cfg_type_boolean, 0 },
 	{ "request-sit", NULL, CFG_CLAUSEFLAG_ANCIENT },
 	{ "require-cookie", &cfg_type_boolean, 0 },
 	{ "send-cookie", &cfg_type_boolean, 0 },
@@ -102,6 +102,8 @@
 #define WANTNSID(x)	(((x)->attributes & NS_CLIENTATTR_WANTNSID) != 0)
 #define WANTPAD(x)	(((x)->attributes & NS_CLIENTATTR_WANTPAD) != 0)
 #define WANTRC(x)	(((x)->attributes & NS_CLIENTATTR_WANTRC) != 0)
+#define WANTZONEVERSION(x) \
+	(((x)->attributes & NS_CLIENTATTR_WANTZONEVERSION) != 0)

 #define MANAGER_MAGIC	 ISC_MAGIC('N', 'S', 'C', 'm')
 #define VALID_MANAGER(m) ISC_MAGIC_VALID(m, MANAGER_MAGIC)
@@ -218,6 +220,17 @@ ns_client_settimeout(ns_client_t *client, unsigned int seconds) {
 	/* XXXWPK TODO use netmgr to set timeout */
 }

+static void
+client_zoneversion_reset(ns_client_t *client) {
+	if (client->zoneversion == NULL) {
+		return;
+	}
+	isc_mem_put(client->manager->mctx, client->zoneversion,
+		    client->zoneversionlength);
+	client->zoneversion = NULL;
+	client->zoneversionlength = 0;
+}
+
 static void
 ns_client_endrequest(ns_client_t *client) {
 	INSIST(client->state == NS_CLIENTSTATE_WORKING ||
@@ -258,6 +271,7 @@ ns_client_endrequest(ns_client_t *client) {
 		dns_message_puttemprdataset(client->message, &client->opt);
 	}

+	client_zoneversion_reset(client);
 	client->signer = NULL;
 	client->udpsize = 512;
 	client->extflags = 0;
@@ -1192,6 +1206,13 @@ no_nsid:
 		ednsopts[count].value = ede->value;
 		count++;
 	}
+	if ((client->attributes & NS_CLIENTATTR_HAVEZONEVERSION) != 0) {
+		INSIST(count < DNS_EDNSOPTIONS);
+		ednsopts[count].code = DNS_OPT_ZONEVERSION;
+		ednsopts[count].length = client->zoneversionlength;
+		ednsopts[count].value = client->zoneversion;
+		count++;
+	}

 	if (WANTRC(client)) {
 		dns_name_t *rad = NULL;
@@ -1609,8 +1630,7 @@ process_opt(ns_client_t *client, dns_rdataset_t *opt) {
 			case DNS_OPT_CLIENT_SUBNET:
 				result = process_ecs(client, &optbuf, optlen);
 				if (result != ISC_R_SUCCESS) {
-					ns_client_error(client, result);
-					return result;
+					goto formerr;
 				}
 				ns_stats_increment(
 					client->manager->sctx->nsstats,
@@ -1638,13 +1658,24 @@ process_opt(ns_client_t *client, dns_rdataset_t *opt) {
 				result = process_keytag(client, &optbuf,
 							optlen);
 				if (result != ISC_R_SUCCESS) {
-					ns_client_error(client, result);
-					return result;
+					goto formerr;
 				}
 				ns_stats_increment(
 					client->manager->sctx->nsstats,
 					ns_statscounter_keytagopt);
 				break;
+			case DNS_OPT_ZONEVERSION:
+				if (optlen != 0 || WANTZONEVERSION(client)) {
+					result = DNS_R_FORMERR;
+					goto formerr;
+				}
+				ns_stats_increment(
+					client->manager->sctx->nsstats,
+					ns_statscounter_zoneversionopt);
+				client->attributes |=
+					NS_CLIENTATTR_WANTZONEVERSION;
+				isc_buffer_forward(&optbuf, optlen);
+				break;
 			default:
 				ns_stats_increment(
 					client->manager->sctx->nsstats,
@@ -1660,6 +1691,17 @@ process_opt(ns_client_t *client, dns_rdataset_t *opt) {
 	client->attributes |= NS_CLIENTATTR_WANTOPT;

 	return result;
+
+formerr:
+	if (result == DNS_R_FORMERR || result == DNS_R_OPTERR) {
+		result = ns_client_addopt(client, client->message,
+					  &client->opt);
+		if (result == ISC_R_SUCCESS) {
+			result = DNS_R_FORMERR;
+		}
+	}
+	ns_client_error(client, result);
+	return result;
 }

 static void
@@ -1724,6 +1766,7 @@ ns__client_put_cb(void *client0) {
 	 */
 	ns_query_free(client);
 	dns_ede_invalidate(&client->edectx);
+	client_zoneversion_reset(client);

 	client->magic = 0;

@@ -224,6 +224,8 @@ struct ns_client {
 	ISC_LINK(ns_client_t) rlink;
 	unsigned char  cookie[8];
 	uint32_t       expire;
+	unsigned char *zoneversion;
+	uint32_t       zoneversionlength;
 	unsigned char *keytag;
 	uint16_t       keytag_len;

@@ -241,26 +243,28 @@ struct ns_client {
 #define NS_CLIENT_MAGIC	   ISC_MAGIC('N', 'S', 'C', 'c')
 #define NS_CLIENT_VALID(c) ISC_MAGIC_VALID(c, NS_CLIENT_MAGIC)

-#define NS_CLIENTATTR_TCP	 0x00001
-#define NS_CLIENTATTR_RA	 0x00002 /*%< Client gets recursive service */
-#define NS_CLIENTATTR_PKTINFO	 0x00004 /*%< pktinfo is valid */
-#define NS_CLIENTATTR_MULTICAST	 0x00008 /*%< recv'd from multicast */
-#define NS_CLIENTATTR_WANTDNSSEC 0x00010 /*%< include dnssec records */
-#define NS_CLIENTATTR_WANTNSID	 0x00020 /*%< include nameserver ID */
+#define NS_CLIENTATTR_TCP	 0x000001
+#define NS_CLIENTATTR_RA	 0x000002 /*%< Client gets recursive service */
+#define NS_CLIENTATTR_PKTINFO	 0x000004 /*%< pktinfo is valid */
+#define NS_CLIENTATTR_MULTICAST	 0x000008 /*%< recv'd from multicast */
+#define NS_CLIENTATTR_WANTDNSSEC 0x000010 /*%< include dnssec records */
+#define NS_CLIENTATTR_WANTNSID	 0x000020 /*%< include nameserver ID */
 #define NS_CLIENTATTR_BADCOOKIE \
-	0x00040 /*%< Presented cookie is bad/out-of-date */
-#define NS_CLIENTATTR_WANTRC	   0x00080 /*%< include Report-Channel */
-#define NS_CLIENTATTR_WANTAD	   0x00100 /*%< want AD in response if possible */
-#define NS_CLIENTATTR_WANTCOOKIE   0x00200 /*%< return a COOKIE */
-#define NS_CLIENTATTR_HAVECOOKIE   0x00400 /*%< has a valid COOKIE */
-#define NS_CLIENTATTR_WANTEXPIRE   0x00800 /*%< return seconds to expire */
-#define NS_CLIENTATTR_HAVEEXPIRE   0x01000 /*%< return seconds to expire */
-#define NS_CLIENTATTR_WANTOPT	   0x02000 /*%< add opt to reply */
-#define NS_CLIENTATTR_HAVEECS	   0x04000 /*%< received an ECS option */
-#define NS_CLIENTATTR_WANTPAD	   0x08000 /*%< pad reply */
-#define NS_CLIENTATTR_USEKEEPALIVE 0x10000 /*%< use TCP keepalive */
-#define NS_CLIENTATTR_NOSETFC	   0x20000 /*%< don't set servfail cache */
-#define NS_CLIENTATTR_NEEDTCP	   0x40000 /*%< send TC=1 */
+	0x000040 /*%< Presented cookie is bad/out-of-date */
+#define NS_CLIENTATTR_WANTRC	      0x000080 /*%< include Report-Channel */
+#define NS_CLIENTATTR_WANTAD	      0x000100 /*%< want AD in response if possible */
+#define NS_CLIENTATTR_WANTCOOKIE      0x000200 /*%< return a COOKIE */
+#define NS_CLIENTATTR_HAVECOOKIE      0x000400 /*%< has a valid COOKIE */
+#define NS_CLIENTATTR_WANTEXPIRE      0x000800 /*%< return seconds to expire */
+#define NS_CLIENTATTR_HAVEEXPIRE      0x001000 /*%< return seconds to expire */
+#define NS_CLIENTATTR_WANTOPT	      0x002000 /*%< add opt to reply */
+#define NS_CLIENTATTR_HAVEECS	      0x004000 /*%< received an ECS option */
+#define NS_CLIENTATTR_WANTPAD	      0x008000 /*%< pad reply */
+#define NS_CLIENTATTR_USEKEEPALIVE    0x010000 /*%< use TCP keepalive */
+#define NS_CLIENTATTR_NOSETFC	      0x020000 /*%< don't set servfail cache */
+#define NS_CLIENTATTR_NEEDTCP	      0x040000 /*%< send TC=1 */
+#define NS_CLIENTATTR_WANTZONEVERSION 0x100000 /*%< return zoneversion */
+#define NS_CLIENTATTR_HAVEZONEVERSION 0x200000 /*%< return zoneversion */

 /*
 * Flag to use with the SERVFAIL cache to indicate
@@ -84,49 +84,50 @@ enum {
 	ns_statscounter_ecsopt = 46,
 	ns_statscounter_padopt = 47,
 	ns_statscounter_keepaliveopt = 48,
+	ns_statscounter_zoneversionopt = 49,

-	ns_statscounter_nxdomainredirect = 49,
-	ns_statscounter_nxdomainredirect_rlookup = 50,
+	ns_statscounter_nxdomainredirect = 50,
+	ns_statscounter_nxdomainredirect_rlookup = 51,

-	ns_statscounter_cookiein = 51,
-	ns_statscounter_cookiebadsize = 52,
-	ns_statscounter_cookiebadtime = 53,
-	ns_statscounter_cookienomatch = 54,
-	ns_statscounter_cookiematch = 55,
-	ns_statscounter_cookienew = 56,
-	ns_statscounter_badcookie = 57,
+	ns_statscounter_cookiein = 52,
+	ns_statscounter_cookiebadsize = 53,
+	ns_statscounter_cookiebadtime = 54,
+	ns_statscounter_cookienomatch = 55,
+	ns_statscounter_cookiematch = 56,
+	ns_statscounter_cookienew = 57,
+	ns_statscounter_badcookie = 58,

-	ns_statscounter_nxdomainsynth = 58,
-	ns_statscounter_nodatasynth = 59,
-	ns_statscounter_wildcardsynth = 60,
+	ns_statscounter_nxdomainsynth = 59,
+	ns_statscounter_nodatasynth = 60,
+	ns_statscounter_wildcardsynth = 61,

-	ns_statscounter_trystale = 61,
-	ns_statscounter_usedstale = 62,
+	ns_statscounter_trystale = 62,
+	ns_statscounter_usedstale = 63,

-	ns_statscounter_prefetch = 63,
-	ns_statscounter_keytagopt = 64,
+	ns_statscounter_prefetch = 64,
+	ns_statscounter_keytagopt = 65,

-	ns_statscounter_tcphighwater = 65,
+	ns_statscounter_tcphighwater = 66,

-	ns_statscounter_reclimitdropped = 66,
+	ns_statscounter_reclimitdropped = 67,

-	ns_statscounter_updatequota = 67,
+	ns_statscounter_updatequota = 68,

-	ns_statscounter_recurshighwater = 68,
+	ns_statscounter_recurshighwater = 69,

-	ns_statscounter_dot = 69,
-	ns_statscounter_doh = 70,
-	ns_statscounter_dohplain = 71,
+	ns_statscounter_dot = 70,
+	ns_statscounter_doh = 71,
+	ns_statscounter_dohplain = 72,

-	ns_statscounter_proxyudp = 72,
-	ns_statscounter_proxytcp = 73,
-	ns_statscounter_proxydot = 74,
-	ns_statscounter_proxydoh = 75,
-	ns_statscounter_proxydohplain = 76,
-	ns_statscounter_encryptedproxydot = 77,
-	ns_statscounter_encryptedproxydoh = 78,
+	ns_statscounter_proxyudp = 73,
+	ns_statscounter_proxytcp = 74,
+	ns_statscounter_proxydot = 75,
+	ns_statscounter_proxydoh = 76,
+	ns_statscounter_proxydohplain = 77,
+	ns_statscounter_encryptedproxydot = 78,
+	ns_statscounter_encryptedproxydoh = 79,

-	ns_statscounter_max = 79,
+	ns_statscounter_max = 80,
 };

 void
@@ -7938,6 +7938,55 @@ query_getexpire(query_ctx_t *qctx) {
 	}
 }

+/*
+ * Set the zone version, if requested, when answering from a secondary,
+ * mirror, or primary zone.
+ */
+static void
+query_getzoneversion(query_ctx_t *qctx) {
+	CCTRACE(ISC_LOG_DEBUG(3), __func__);
+
+	if (qctx->zone == NULL || !qctx->is_zone ||
+	    qctx->client->query.restarts != 0 ||
+	    (qctx->client->attributes & NS_CLIENTATTR_WANTZONEVERSION) == 0 ||
+	    (qctx->client->attributes & NS_CLIENTATTR_HAVEZONEVERSION) != 0)
+	{
+		return;
+	}
+
+	switch (dns_zone_gettype(qctx->zone)) {
+	case dns_zone_mirror:
+	case dns_zone_primary:
+	case dns_zone_secondary: {
+		isc_buffer_t b;
+		unsigned char buf[128];
+		isc_buffer_init(&b, buf, sizeof(buf));
+		isc_result_t result = dns_zone_getzoneversion(qctx->zone, &b);
+		if (result == ISC_R_SUCCESS) {
+			size_t len = isc_buffer_usedlength(&b);
+			/*
+			 * Sanity check zone version from database
+			 * implementations.  Minimum length and type 0
+			 * contraints.
+			 */
+			if (len < 2 || (buf[1] == 0 && len != 6)) {
+				return;
+			}
+			qctx->client->attributes |=
+				NS_CLIENTATTR_HAVEZONEVERSION;
+			INSIST(qctx->client->zoneversion == NULL);
+			qctx->client->zoneversion =
+				isc_mem_get(qctx->client->manager->mctx, len);
+			qctx->client->zoneversionlength = len;
+			memmove(qctx->client->zoneversion, buf, len);
+		}
+		break;
+	}
+	default:
+		break;
+	}
+}
+
 /*%
 * Fill the ANSWER section of a positive response.
 */
@@ -8101,6 +8150,11 @@ query_respond(query_ctx_t *qctx) {
 	 */
 	query_getexpire(qctx);

+	/*
+	 * Set the zone version
+	 */
+	query_getzoneversion(qctx);
+
 	result = query_addanswer(qctx);
 	if (result != ISC_R_COMPLETE) {
 		return result;
Author	SHA1	Message	Date
Mark Andrews	5c7397b9cb	Return raw zone serial for inline zones	2025-03-24 17:32:52 +11:00
Mark Andrews	a5ae37ad0b	Disable ZONEVERSION for built-in chaos and empty zones	2025-03-24 17:32:52 +11:00
Mark Andrews	e081ab6ecf	Check that 'provide-zoneversion no;' works	2025-03-24 17:32:52 +11:00
Mark Andrews	9604b13d00	Add an option to disable ZONEVERSION responses The option provide-zoneversion controls whether ZONEVERSION is returned. This applies to primary, secondary and mirror zones.	2025-03-24 17:32:52 +11:00
Mark Andrews	d7a667d91b	Check that received ZONEVERSION is logged	2025-03-24 17:32:52 +11:00
Mark Andrews	70470169a9	Add option request-zoneversion This can be set at the option, view and server levels and causes named to add an EDNS ZONEVERSION option to requests. Replies are logged to the 'zoneversion' category.	2025-03-24 14:22:07 +11:00
Mark Andrews	9bb834750d	Add system tests for EDNS zoneversion	2025-03-24 11:08:25 +11:00
Mark Andrews	d17eda82e0	Return EDNS ZONEVERSION if requested If there was an EDNS ZONEVERSION option in the DNS request and the answer was from a zone, return the zone's serial and number of labels excluding the root label with the type set to 0 (ZONE-SERIAL).	2025-03-24 11:08:25 +11:00
Mark Andrews	ca3e61a462	Add dns_zone_getzoneversion Returns the EDNS ZONEVERSION for the zone. Return the database specific version otherwise return a type 0 version (serial).	2025-03-24 11:08:25 +11:00
Mark Andrews	7f07c989b5	Add dns_db_getzoneversion Provides a database method to return a database specific EDNS ZONEVERSION option. The default EDNS ZONEVERSION is serial.	2025-03-24 11:08:25 +11:00
Mark Andrews	83115b931d	Add EDNS ZONEVERSION option counter	2025-03-24 11:08:24 +11:00
Mark Andrews	184c7caff9	Add support for EDNS ZONEVERSION to dig This add the +[no]zoneversion option to dig which adds the EDNS ZONEVERSION option to requests.	2025-03-24 11:08:24 +11:00
Mark Andrews	4199d2d5e4	Extend message code to display ZONEVERSION	2025-03-24 11:08:24 +11:00
Mark Andrews	6a5e60231f	Check EDNS ZONEVERSION when parsing OPT record	2025-03-21 15:38:56 +11:00
Mark Andrews	49ecb158d4	fix: dev: Fix adbname reference Call `dns_adbname_ref` before calling `dns_resolver_createfetch` to ensure `adbname->name` remains stable for the life of the fetch. Closes #5239 Merge branch '5239-fix-adb-reference-counting' into 'main' See merge request isc-projects/bind9!10290	2025-03-21 00:26:25 +00:00
Mark Andrews	8e7229f641	Fix gaining adbname reference Call dns_adbname_ref before calling dns_resolver_createfetch to ensure adbname->name remains stable for the life of the fetch.	2025-03-20 23:25:29 +00:00
Evan Hunt	3415392d01	fix: dev: Optimize key ID check when searching for matching keys When searching through a DNSKEY or KEY rrset for the key matching a particular algorithm and ID, it's a waste of time to convert every key into a `dst_key` object; it's faster to compute the key ID from the rdata, then do the full key conversion after determining that we've found the right key. This optimization was already used in the validator, but it's been refactored for code clarity, and is now also used in query.c and message.c. Merge branch 'each-refactor-key-search' into 'main' See merge request isc-projects/bind9!10258	2025-03-20 18:25:05 +00:00