WIP: Allow lower query timeouts

2023-11-09 07:49:40 +01:00
2149 changed files with 126263 additions and 123598 deletions
@@ -79,5 +79,3 @@ PenaltyExcessCharacter: 100
 Standard: Cpp11
 ContinuationIndentWidth: 8
 ForEachMacros: [ 'cds_lfs_for_each', 'cds_lfs_for_each_safe', 'cds_list_for_each_entry_safe', 'ISC_LIST_FOREACH', 'ISC_LIST_FOREACH_SAFE', 'ISC_LIST_FOREACH_REV', 'ISC_LIST_FOREACH_REV_SAFE' ]
-RemoveParentheses: ReturnStatement
-RemoveSemicolon: true
@@ -78,5 +78,3 @@ PenaltyBreakString: 80
 PenaltyExcessCharacter: 100
 Standard: Cpp11
 ContinuationIndentWidth: 8
-RemoveParentheses: ReturnStatement
-RemoveSemicolon: true
@@ -1536,15 +1536,3 @@ ffbe6b95371c99b7fb05e6de17a8d6b7bf4f629f
 05baf7206b7baaf91cb8e049ad13e413c52cdf3f
 # reformat shell scripts with shfmt
 4cb8b13987b930952238cc88e84272b8cf911933
-# Reformat sources with up-to-date clang-format-17
-79d93600116faabd89798522817ad95a69684fff
-# Reformat sources with up-to-date clang-format-18
-b7de2c7cb959fa35099d72c3f9b13938348c74e6
-# Reformat sources with up-to-date clang-format-19
-ff69d07fed2619a9bedf5ccc18cf106b7dd49bef
-# Reformat sources with up-to-date clang-format-19
-ebb5bd9c0f079de8970b538fe48e5f5c60ea7ee9
-# Remove redundant semicolons after the closing braces of functions
-1a19ce39db12ed4ecf59a3d0f5734656d24999a5
-# Remove redundant parentheses from the return statement
-0258850f202b7a46b52f3e3a4968c3fc68fe9a45
@@ -10,4 +10,4 @@
 /util/**			 export-ignore
 /util/bindkeys.pl		-export-ignore
 /util/check-make-install.in	-export-ignore
-/util/dtrace.sh		-export-ignore
+/util/mksymtbl.pl		-export-ignore
@@ -1 +0,0 @@
-contrib/gitchangelog/changelog.rc.py
@@ -75,7 +75,6 @@ doc/man/dnssec-importkey.8in
 doc/man/dnssec-keyfromlabel.8in
 doc/man/dnssec-keygen.8in
 doc/man/dnssec-keymgr.8in
-doc/man/dnssec-ksr.8in
 doc/man/dnssec-revoke.8in
 doc/man/dnssec-settime.8in
 doc/man/dnssec-signzone.8in
@@ -96,7 +95,6 @@ doc/man/pkcs11-tokens.8in
 /GPATH
 /GRTAGS
 /GTAGS
-TAGS
 # Emacs specific files
 \.dir-locals-2.el
 /emacs.desktop
@@ -2,62 +2,45 @@
 If the bug you are reporting is potentially security-related - for example,
 if it involves an assertion failure or other crash in `named` that can be
 triggered repeatedly - then please make sure that you make the new issue
-confidential by clicking the checkbox at the bottom!
+confidential!
 -->

 ### Summary

-<!-- Concisely summarize the bug encountered. -->
+(Summarize the bug encountered concisely.)

-### BIND version affected
-<!--
-Make sure you are testing with the **latest** supported version of BIND
-for a given branch. Many bugs have been fixed over time!
+### BIND version used

-See https://kb.isc.org/docs/supported-platforms for the current list.
-The latest source is available from https://www.isc.org/download/#BIND
-
-Paste the output of `named -V` here.
-->
+(Paste the output of `named -V`.)

 ### Steps to reproduce

-<!--
-This is extremely important! Be precise and use itemized lists, please.
-
-Even if a default configuration is affected, please include the full configuration
-files _you were testing with_.
-
-Example:
-1. Use _attached_ configuration file
-2. Start BIND server with command: `named -g -c named.conf ...`
-3. Simulate legitimate clients using command `dnsperf -S1 -d legit-queries ...`
-4. Simulate attack traffic using command `dnsperf -S1 -d attack-queries ...`
-->
-
-1.
-2.
-3.
+(How one can reproduce the issue - this is very important.)

 ### What is the current *bug* behavior?

-<!-- What actually happens. -->
+(What actually happens.)

 ### What is the expected *correct* behavior?

-<!-- What you should see instead. -->
+(What you should see instead.)

 ### Relevant configuration files

-<!-- Paste any relevant configuration files here - please use code blocks (```)
+(Paste any relevant configuration files - please use code blocks (```)
 to format console output. If submitting the contents of your
-configuration file in a non-confidential issue, it is advisable to
-obscure key secrets; this can be done automatically by using
-`named-checkconf -px`. -->
+configuration file in a non-confidential Issue, it is advisable to
+obscure key secrets: this can be done automatically by using
+`named-checkconf -px`.)

-### Relevant logs
+### Relevant logs and/or screenshots

-<!-- Paste any relevant logs here - please use code blocks (```) to format console
-output, logs, and code, as it's very hard to read otherwise. -->
+(Paste any relevant logs - please use code blocks (```) to format console
+output, logs, and code, as it's very hard to read otherwise.)

-/label ~Bug
+### Possible fixes
+
+(If you can, link to the line of code that might be responsible for the
+problem.)
+
+/label ~bug
@@ -12,15 +12,15 @@ confidential!
 | Deputy Incident Manager: | @user                                |
 | Public Disclosure Date:  | YYYY-MM-DD                           |
 | CVSS Score:              | [0.0][cvss_score]                    |
-| CWE:                     | [CWE-NNN][cwe_category]
 | Security Advisory:       | isc-private/printing-press!NNN       |
 | Mattermost Channel:      | [CVE-YYYY-NNNN][mattermost_url]      |
 | Support Ticket:          | [URL]                                |
 | Release Checklist:       | #NNNN                                |
+| Post-mortem Etherpad:    | [postmortem-YYYY-MM][postmortem_url] |

 [cvss_score]: https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:X/AC:X/PR:X/UI:X/S:X/C:X/I:X/A:X&version=3.1
-[cwe_category]: https://cwe.mitre.org/data/definitions/NNN.html
 [mattermost_url]:
+[postmortem_url]:

 :bulb: **Click [here][checklist_explanations] (internal resource) for general information about the security incident handling process.**

@@ -30,14 +30,14 @@ confidential!

  - [ ] [:link:][step_deputy]            **(IM)** Pick a Deputy Incident Manager
  - [ ] [:link:][step_respond]           **(IM)** Respond to the bug reporter
+  - [ ] [:link:][step_etherpad]          **(IM)** Create an Etherpad for post-mortem
  - [ ] [:link:][step_public_mrs]        **(SwEng)** Ensure there are no public merge requests which inadvertently disclose the issue
-  - [ ] [:link:][step_coordinate_cve_id] **(SwEng)** Check if we need to coordinate with other vendors (an industry-wide CVE identifier might be necessary)
  - [ ] [:link:][step_assign_cve_id]     **(IM)** Assign a CVE identifier
-  - [ ] [:link:][step_note_cve_info]     **(SwEng)** Update this issue with the assigned CVE identifier, the CVSS score, and the CWE category
+  - [ ] [:link:][step_note_cve_info]     **(SwEng)** Update this issue with the assigned CVE identifier and the CVSS score
  - [ ] [:link:][step_versions_affected] **(SwEng)** Determine the range of product versions affected (including the Subscription Edition)
  - [ ] [:link:][step_workarounds]       **(SwEng)** Determine whether workarounds for the problem exist
-  - [ ] [:link:][step_earliest_prepare]  **(Support)** Prepare "earliest" notification text
-  - [ ] [:link:][step_earliest_send]     **(Support)** Update "earliest" notification ticket in support portal Earliest queue which will notify earliest customers
+  - [ ] [:link:][step_coordinate]        **(SwEng)** If necessary, coordinate with other parties
+  - [ ] [:link:][step_earliest]          **(Support)** Prepare and send out "earliest" notifications
  - [ ] [:link:][step_advisory_mr]       **(Support)** Create a merge request for the Security Advisory and include all readily available information in it
  - [ ] [:link:][step_reproducer_mr]     **(SwEng)** Prepare a private merge request containing a system test reproducing the problem
  - [ ] [:link:][step_notify_support]    **(SwEng)** Notify Support when a reproducer is ready
@@ -48,52 +48,53 @@ confidential!
  - [ ] [:link:][step_backports]         **(SwEng)** Prepare backports of the merge request addressing the problem for all affected (and still maintained) branches of a given product
  - [ ] [:link:][step_finish_advisory]   **(Support)** Finish preparing the Security Advisory
  - [ ] [:link:][step_meta_issue]        **(QA)** Create (or update) the private issue containing links to fixes & reproducers for all CVEs fixed in a given release cycle
-  - [ ] [:link:][step_coordinate_check]  **(SwEng)** Make sure other vendors are able to release on the date that was previously agreed upon
+  - [ ] [:link:][step_changes]           **(QA)** (BIND 9 only) Reserve a block of `CHANGES` placeholders once the complete set of vulnerabilities fixed in a given release cycle is determined
  - [ ] [:link:][step_merge_fixes]       **(QA)** Merge the CVE fixes in CVE identifier order
  - [ ] [:link:][step_patches]           **(QA)** Prepare a standalone patch for the last stable release of each affected (and still maintained) product branch
  - [ ] [:link:][step_asn_releases]      **(QA)** Prepare ASN releases (as outlined in the Release Checklist)

 ### At T-5

-  - [ ] [:link:][step_asn_links]         **(Marketing)** (BIND 9 only) Update the BIND -S information document in the support portal with download links to the new versions
-  - [ ] [:link:][step_asn_send]          **(Support)** Notify eligible customers by adding a ticket to the 5 Day queue in RT with the text of the advisory (earliest, and T-5)
-  - [ ] [:link:][step_preannouncement]   **(Marketing)** (BIND 9 only) Send a pre-announcement email to the *bind-announce* mailing list to alert users that the upcoming release will include security fixes
+  - [ ] [:link:][step_send_asn]          **(Support)** Send ASN to eligible customers
+  - [ ] [:link:][step_preannouncement]   **(Support)** (BIND 9 only) Send a pre-announcement email to the *bind-announce* mailing list to alert users that the upcoming release will include security fixes

-### At T-3
-  - [ ] [:link:][step_asn_send]          **(Support)** Notify eligible customers by adding a ticket to the 3 Day queue in RT with the text of the advisory (T-3)
+### At T-4
+
+  - [ ] [:link:][step_verify_asn]        **(Support)** Verify that all ASN-eligible customers have received the notification email

 ### At T-1

+  - [ ] [:link:][step_check_customers]   **(Support)** Verify that any new or reinstated customers have received the notification email
  - [ ] [:link:][step_packager_emails]   **(First IM)** Send notifications to OS packagers

 ### On the Day of Public Disclosure

-  - [ ] [:link:][step_clearance]         **(IM)** Grant QA & Marketing clearance to proceed with public release
+  - [ ] [:link:][step_clearance]         **(IM)** Grant Support clearance to proceed with public release
+  - [ ] [:link:][step_publish]           **(Support)** Publish the releases (as outlined in the release checklist)
  - [ ] [:link:][step_matrix]            **(Support)** (BIND 9 only) Add the new CVEs to the vulnerability matrix in the Knowledge Base
-  - [ ] [:link:][step_bump_advisory]     **(Support)** Bump Document Version for the Security Advisory in Printing Press
-  - [ ] [:link:][step_publish_advisory]  **(Support)** Publish the Security Advisory in the Knowledge Base
-  - [ ] [:link:][step_publish]           **(QA/Marketing)** Publish the releases (as outlined in the release checklist)
+  - [ ] [:link:][step_publish_advisory]  **(Support)** Bump Document Version for the Security Advisory and publish it in the Knowledge Base
  - [ ] [:link:][step_notifications]     **(First IM)** Send notification emails to third parties
  - [ ] [:link:][step_mitre]             **(First IM)** Advise MITRE about the disclosed CVEs
  - [ ] [:link:][step_merge_advisory]    **(First IM)** Merge the Security Advisory merge request
  - [ ] [:link:][step_embargo_end]       **(IM)** Inform original reporter (if external) that the security disclosure process is complete
-  - [ ] [:link:][step_asn_clear]         **(Support)** Update the tickets in the ASN queues in RT that the embargo is lifted
-  - [ ] [:link:][step_customers]         **(Marketing)** Open a ticket in the appropriate announce queue in RT that the release is published
+  - [ ] [:link:][step_customers]         **(Support)** Inform customers a fix has been released

 ### After Public Disclosure

+  - [ ] [:link:][step_postmortem]        **(First IM)** Organize post-mortem meeting and make sure it happens
+  - [ ] [:link:][step_tickets]           **(Support)** Close support tickets
  - [ ] [:link:][step_regression]        **(QA)** Merge a regression test reproducing the bug into all affected (and still maintained) branches

 [step_deputy]:            https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#pick-a-deputy-incident-manager
 [step_respond]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#respond-to-the-bug-reporter
+[step_etherpad]:          https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#create-an-etherpad-for-post-mortem
 [step_public_mrs]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#ensure-there-are-no-public-merge-requests-which-inadvertently-disclose-the-issue
-[step_coordinate_cve_id]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#check-if-we-need-to-coordinate-with-other-vendors-an-industry-wide-cve-identifier-might-be-necessary
 [step_assign_cve_id]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#assign-a-cve-identifier
-[step_note_cve_info]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-this-issue-with-the-assigned-cve-identifier-the-cvss-score-and-the-cwe-category
+[step_note_cve_info]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-this-issue-with-the-assigned-cve-identifier-and-the-cvss-score
 [step_versions_affected]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#determine-the-range-of-product-versions-affected-including-the-subscription-edition
 [step_workarounds]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#determine-whether-workarounds-for-the-problem-exist
-[step_earliest_prepare]:  https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-earliest-notification-text
-[step_earliest_send]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-earliest-notification-ticket-in-support-portal-earliest-queue-which-will-notify-earliest-customers
+[step_coordinate]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#if-necessary-coordinate-with-other-parties
+[step_earliest]:          https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-and-send-out-earliest-notifications
 [step_advisory_mr]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#create-a-merge-request-for-the-security-advisory-and-include-all-readily-available-information-in-it
 [step_reproducer_mr]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-a-private-merge-request-containing-a-system-test-reproducing-the-problem
 [step_notify_support]:    https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#notify-support-when-a-reproducer-is-ready
@@ -104,26 +105,24 @@ confidential!
 [step_backports]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-backports-of-the-merge-request-addressing-the-problem-for-all-affected-and-still-maintained-branches-of-a-given-product
 [step_finish_advisory]:   https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#finish-preparing-the-security-advisory
 [step_meta_issue]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#create-or-update-the-private-issue-containing-links-to-fixes-reproducers-for-all-cves-fixed-in-a-given-release-cycle
-[step_coordinate_check]:  https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#make-sure-other-vendors-are-able-to-release-on-the-date-that-was-previously-agreed-upon
+[step_changes]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-reserve-a-block-of-changes-placeholders-once-the-complete-set-of-vulnerabilities-fixed-in-a-given-release-cycle-is-determined
 [step_merge_fixes]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#merge-the-cve-fixes-in-cve-identifier-order
 [step_patches]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-a-standalone-patch-for-the-last-stable-release-of-each-affected-and-still-maintained-product-branch
 [step_asn_releases]:      https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-asn-releases-as-outlined-in-the-release-checklist
-[step_asn_links]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-update-the-bind-s-information-document-in-the-support-portal-with-download-links-to-the-new-versions
-[step_asn_send]:          https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#notify-eligible-customers-by-adding-a-ticket-to-the-5-day-queue-in-rt-with-the-text-of-the-advisory-earliest-and-t-5
+[step_send_asn]:          https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#send-asn-to-eligible-customers
 [step_preannouncement]:   https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-send-a-pre-announcement-email-to-the-bind-announce-mailing-list-to-alert-users-that-the-upcoming-release-will-include-security-fixes
-[step_asn_send]:          https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#notify-eligible-customers-by-adding-a-ticket-to-the-3-day-queue-in-rt-with-the-text-of-the-advisory-t-3
+[step_verify_asn]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#verify-that-all-asn-eligible-customers-have-received-the-notification-email
+[step_check_customers]:   https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#verify-that-any-new-or-reinstated-customers-have-received-the-notification-email
 [step_packager_emails]:   https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#send-notifications-to-os-packagers
-[step_clearance]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#grant-qa-marketing-clearance-to-proceed-with-public-release
-[step_matrix]:            https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-add-the-new-cves-to-the-vulnerability-matrix-in-the-knowledge-base
-[step_bump_advisory]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bump-document-version-for-the-security-advisory-in-printing-press
-[step_publish_advisory]:  https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#publish-the-security-advisory-in-the-knowledge-base
+[step_clearance]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#grant-support-clearance-to-proceed-with-public-release
 [step_publish]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#publish-the-releases-as-outlined-in-the-release-checklist
+[step_matrix]:            https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-add-the-new-cves-to-the-vulnerability-matrix-in-the-knowledge-base
+[step_publish_advisory]:  https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bump-document-version-for-the-security-advisory-and-publish-it-in-the-knowledge-base
 [step_notifications]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#send-notification-emails-to-third-parties
 [step_mitre]:             https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#advise-mitre-about-the-disclosed-cves
 [step_merge_advisory]:    https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#merge-the-security-advisory-merge-request
 [step_embargo_end]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#inform-original-reporter-if-external-that-the-security-disclosure-process-is-complete
-[step_asn_clear]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-the-tickets-in-the-asn-queues-in-rt-that-the-embargo-is-lifted
-[step_customers]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#open-a-ticket-in-the-appropriate-announce-queue-in-rt-that-the-release-is-published
+[step_customers]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#inform-customers-a-fix-has-been-released
+[step_postmortem]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#organize-post-mortem-meeting-and-make-sure-it-happens
+[step_tickets]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#close-support-tickets
 [step_regression]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#merge-a-regression-test-reproducing-the-bug-into-all-affected-and-still-maintained-branches
-
-/confidential
@@ -1,8 +0,0 @@
-Hi and thanks for filing an issue! It will be read with care by human beings.
-
-It would be a tremendous help if you could follow these steps first:
- [ ] Search the existing issues in GitLab (both open and closed) to see if your report might be a duplicate. We have a large database here and many issues have already been fixed in the latest versions!
- [ ] Make sure this is **not** a support question. If you have specific trouble configuring or debugging your setup, please use the bind-users mailing list: https://lists.isc.org/mailman/listinfo/bind-users
- [ ] You have read and understood the "out in the open" support policy: https://blog.powerdns.com/2016/01/18/open-source-support-out-in-the-open/ . Even though it was written by the PowerDNS folks, we follow it as well!
-
-Before continuing, **please select the appropriate issue template in the drop-down menu above, under the heading _Description_**.
@@ -8,4 +8,4 @@

 ### Links / references

-/label ~Feature
+/label ~"feature request"
@@ -0,0 +1,101 @@
+## Release Schedule
+
+**Code Freeze:**
+
+**Tagging Deadline:**
+
+**Public Release:**
+
+## Documentation Review Links
+
+**Closed issues assigned to the milestone without a release note:**
+
+ - []()
+ - []()
+ - []()
+
+**Merge requests merged into the milestone without a release note:**
+
+ - []()
+ - []()
+ - []()
+
+**Merge requests merged into the milestone without a `CHANGES` entry:**
+
+ - []()
+ - []()
+ - []()
+
+## Release Checklist
+
+### Before the Code Freeze
+
+ - [ ] ***(QA)*** Rebase -S editions on top of current open-source versions: `git checkout bind-9.18-sub && git rebase origin/bind-9.18`
+ - [ ] ***(QA)*** [Inform](https://gitlab.isc.org/isc-private/bind-qa/-/blob/master/bind9/releng/inform_supp_marketing.py) Support and Marketing of impending release (and give estimated release dates).
+ - [ ] ***(QA)*** Ensure there are no permanent test failures on any platform. Check [public](https://gitlab.isc.org/isc-projects/bind9/-/pipelines?scope=all&source=schedule) and [private](https://gitlab.isc.org/isc-private/bind9/-/pipelines?scope=all&source=schedule) scheduled pipelines.
+ - [ ] ***(QA)*** Check charts from `shotgun:*` jobs in the scheduled pipelines to verify there is no unexplained performance drop for any protocol.
+ - [ ] ***(QA)*** Check [Perflab](https://perflab.isc.org/) to ensure there has been no unexplained drop in performance for the versions being released.
+ - [ ] ***(QA)*** Check whether all issues assigned to the release milestone are resolved[^1].
+ - [ ] ***(QA)*** Ensure that there are no outstanding [merge requests in the private repository](https://gitlab.isc.org/isc-private/bind9/-/merge_requests/)[^1] (Subscription Edition only).
+ - [ ] ***(QA)*** [Ensure](https://gitlab.isc.org/isc-private/bind-qa/-/blob/master/bind9/releng/check_backports.py) all merge requests marked for backporting have been indeed backported.
+ - [ ] ***(QA)*** [Announce](https://gitlab.isc.org/isc-private/bind-qa/-/blob/master/bind9/releng/inform_code_freeze.py) (on Mattermost) that the code freeze is in effect.
+
+### Before the Tagging Deadline
+
+ - [ ] ***(QA)*** Inspect the current output of the `cross-version-config-tests` job to verify that no unexpected backward-incompatible change was introduced in the current release cycle.
+ - [ ] ***(QA)*** Ensure release notes are correct, ask Support and Marketing to check them as well. [Example](https://gitlab.isc.org/isc-private/bind9/-/merge_requests/510)
+ - [ ] ***(QA)*** Add a release marker to `CHANGES`. Examples: [9.18](https://gitlab.isc.org/isc-projects/bind9/-/commit/f14d8ad78c0506fd4247187f2177f8eceeb6b3b9), [9.16](https://gitlab.isc.org/isc-projects/bind9/-/commit/1bcdf21874f99a00da389d723e0ad07dfd70f9f1)
+ - [ ] ***(QA)*** Add a release marker to `CHANGES.SE` (Subscription Edition only). [Example](https://gitlab.isc.org/isc-private/bind9/-/commit/0f03d5737bcbdaa1bf713c6db1887b14938c3421)
+ - [ ] ***(QA)*** Update BIND 9 version in `configure.ac` ([9.18+](https://gitlab.isc.org/isc-projects/bind9/-/commit/3c85ab7f4c35e6d8acef1393606002a0a8730100)) or `version` ([9.16](https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/7692/diffs?commit_id=1bcdf21874f99a00da389d723e0ad07dfd70f9f1)).
+ - [ ] ***(QA)*** Rebuild `configure` using Autoconf on `docs.isc.org` (9.16).
+ - [ ] ***(QA)*** Update GitLab settings for all maintained branches to disallow merging to them: [public](https://gitlab.isc.org/isc-projects/bind9/-/settings/repository), [private](https://gitlab.isc.org/isc-private/bind9/-/settings/repository)
+ - [ ] ***(QA)*** Tag the releases in the private repository (`git tag -s -m "BIND 9.x.y" v9.x.y`).
+
+### Before the ASN Deadline (for ASN Releases) or the Public Release Date (for Regular Releases)
+
+ - [ ] ***(QA)*** Check that the formatting is correct for the HTML version of release notes.
+ - [ ] ***(QA)*** Check that the formatting of the generated man pages is correct.
+ - [ ] ***(QA)*** Verify GitLab CI results [for the tags](https://gitlab.isc.org/isc-private/bind9/-/pipelines?scope=tags) created and sign off on the releases to be published.
+ - [ ] ***(QA)*** Update GitLab settings for all maintained branches to allow merging to them again: [public](https://gitlab.isc.org/isc-projects/bind9/-/settings/repository), [private](https://gitlab.isc.org/isc-private/bind9/-/settings/repository)
+ - [ ] ***(QA)*** Prepare (using [`version_bump.py`](https://gitlab.isc.org/isc-private/bind-qa/-/blob/master/bind9/releng/version_bump.py)) and merge MRs resetting the release notes and updating the version string for each maintained branch.
+ - [ ] ***(QA)*** Announce (on Mattermost) that the code freeze is over.
+ - [ ] ***(QA)*** Request signatures for the tarballs, providing their location and checksums. Ask [signers on Mattermost](https://mattermost.isc.org/isc/channels/bind-9-qa).
+ - [ ] ***(Signers)*** Ensure that the contents of tarballs and tags are identical.
+ - [ ] ***(Signers)*** Validate tarball checksums, sign tarballs, and upload signatures.
+ - [ ] ***(QA)*** Verify tarball signatures and check tarball checksums again: Run `publish_bind.sh` on repo.isc.org to pre-publish.
+ - [ ] ***(Support)*** Pre-publish ASN and/or Subscription Edition tarballs so that packages can be built.
+ - [ ] ***(QA)*** Build and test ASN and/or Subscription Edition packages (in [cloudsmith branch in private repo](https://gitlab.isc.org/isc-private/rpms/bind/-/tree/cloudsmith)). [Example](https://gitlab.isc.org/isc-private/rpms/bind/-/commit/e2512f4cfaf991827a635e374e7e93b27a5f38ba)
+ - [ ] ***(QA)*** Prepare the `patches/` subdirectory for each security release (if applicable).
+ - [ ] ***(QA)*** Notify Support that the releases have been prepared.
+ - [ ] ***(Support)*** Send out ASNs (if applicable).
+
+### On the Day of Public Release
+
+ - [ ] ***(Support)*** Wait for clearance from Security Officer to proceed with the public release (if applicable).
+ - [ ] ***(Support)*** Place tarballs in public location on FTP site.
+ - [ ] ***(Support)*** Publish links to downloads on ISC website. [Example](https://gitlab.isc.org/website/theme-staging-site/-/commit/1ac7b30b73cb03228df4cd5651fa4e774ac35625)
+ - [ ] ***(Support)*** Add the new releases to the [vulnerability matrix in the Knowledge Base](https://kb.isc.org/docs/aa-00913).
+ - [ ] ***(Support)*** Use the [Printing Press project](https://gitlab.isc.org/isc-private/printing-press/-/wikis/home#adding-new-documents) to prepare a release announcement email and send it to the *bind-announce* mailing list.
+ - [ ] ***(Support)*** Write email to *bind-users* (if a major release). [Example](https://lists.isc.org/pipermail/bind-users/2022-January/105624.html)
+ - [ ] ***(Support)*** Send eligible customers updated links to the Subscription Edition (update the -S edition delivery tickets, even if those links were provided earlier via an ASN ticket).
+ - [ ] ***(Support)*** Update tickets in case of waiting support customers.
+ - [ ] ***(QA)*** Build and test any outstanding private packages in [private repo](https://gitlab.isc.org/isc-private/rpms/bind/-/tree/cloudsmith). [Example](https://gitlab.isc.org/isc-private/rpms/bind/-/commit/2007d566db81dd9dfd79e571e2f600a3bc284da4)
+ - [ ] ***(QA)*** Build [public RPMs](https://gitlab.isc.org/isc-packages/rpms/bind). [Example commit](https://gitlab.isc.org/isc-packages/rpms/bind/-/commit/3b5e851ea7c4e3570371a4878b5461f02a44f8cc) which triggers [Copr builds](https://copr.fedorainfracloud.org/coprs/isc/) automatically
+ - [ ] ***(SwEng)*** Build Debian/Ubuntu packages.
+ - [ ] ***(SwEng)*** Update Docker files [here](https://gitlab.isc.org/isc-projects/bind9-docker/-/branches) and make sure push is synchronized to [GitHub](https://github.com/isc-projects/bind9-docker). [Docker Hub](https://hub.docker.com/r/internetsystemsconsortium/bind9) should pick it up automatically. [Example](https://gitlab.isc.org/isc-projects/bind9-docker/-/commit/cada7e10e9af951595c98bfffc4bd42512faac05)
+ - [ ] ***(QA)*** Inform Marketing of the release.
+ - [ ] ***(Marketing)*** Post a short note to Mastodon.
+ - [ ] ***(Marketing)*** Update [Wikipedia entry for BIND](https://en.wikipedia.org/wiki/BIND).
+ - [ ] ***(Marketing)*** Write blog article (if a major release).
+ - [ ] ***(QA)*** Ensure all new tags are annotated and signed. `git show --show-signature v9.19.12`
+ - [ ] ***(QA)*** Push tags for the published releases to the public repository.
+ - [ ] ***(QA)*** Using [`merge_tag.py`](https://gitlab.isc.org/isc-private/bind-qa/-/blob/master/bind9/releng/merge_tag.py), merge published release tags back into the their relevant development/maintenance branches.
+ - [ ] ***(QA)*** Ensure `allow_failure: true` is removed from the `cross-version-config-tests` job if it was set during the current release cycle.
+ - [ ] ***(QA)*** Sanitize confidential issues which are assigned to the current release milestone and do not describe a security vulnerability, then make them public.
+ - [ ] ***(QA)*** Sanitize [confidential issues](https://gitlab.isc.org/isc-projects/bind9/-/issues/?sort=milestone_due_desc&state=opened&confidential=yes) which are assigned to older release milestones and describe security vulnerabilities, then make them public if appropriate[^2].
+ - [ ] ***(QA)*** Update QA tools used in GitLab CI (e.g. Black, PyLint, Sphinx) by modifying the relevant [`Dockerfile`](https://gitlab.isc.org/isc-projects/images/-/merge_requests/228/diffs).
+ - [ ] ***(QA)*** Run a pipeline to rebuild all [images](https://gitlab.isc.org/isc-projects/images) used in GitLab CI.
+ - [ ] ***(QA)*** Update [`metadata.json`](https://gitlab.isc.org/isc-private/bind-qa/-/blob/master/bind9/releng/metadata.json) with the upcoming release information.
+
+[^1]: If not, use the time remaining until the tagging deadline to ensure all outstanding issues are either resolved or moved to a different milestone.
+[^2]: As a rule of thumb, security vulnerabilities which have reproducers merged to the public repository are considered okay for full disclosure.
@@ -1,139 +0,0 @@
-### Summary
-<!--
-Concisely summarize the bug encountered,
-preferably in one paragraph or less.
-->
-
-### BIND versions affected
-<!--
-Make sure you are testing with the **latest** supported version of BIND.
-See https://kb.isc.org/docs/supported-platforms for the current list.
-The latest source is available from https://www.isc.org/download/#BIND
-
-Paste the output of `named -V` here.
-->
-
-### Preconditions and assumptions
-<!--
-Is a specific setup needed?
-
-Please check the BIND Security Assumptions chapter in the ARM:
-https://bind9.readthedocs.io/en/latest/chapter7.html#security-assumptions
-
-E.g. DNSSEC validation must be disabled, etc.
-E.g. Resolver must be configured to forward to attacker's server via DNS-over-TLS, etc.
-E.g. Authoritative server must be configured to transfer specific primary zone.
-E.g. Attacker must be in posession of a key authorized to modify at least one zone.
-E.g. Attacker can affect system clock on the server running BIND.
-->
-
-### Attacker's abilities
-<!--
-What resources does an attacker need to have under their control to mount this attack?
-
-E.g. If attacking an authoritative server, does the attacked have to have prior
-relationship with it? "The authoritative server under attack needs to
-transfer a malicious zone from attacker's authoritative server via TLS."
-
-E.g. If attacking a resolver, does the attacker need the ability to send
-arbitrary queries to the resolver under attack? Do they need to _also_ control
-an authoritative server at the same time?
-->
-
-
-### Impact
-<!--
-Who or what is the victim of the attack and what is the impact?
-
-Is a third party receiving many packets generated by a reflection attack?
-
-If the affected party is the BIND server itself, please quantify the impact
-on legitimate clients:
-E.g. After launching the attack, the answers-per-second metric for legitimate
-traffic drops to 1/1000 within the first minute of the attack.
-->
-
-
-### Steps to reproduce
-<!--
-This is extremely important! Be precise and use itemized lists, please.
-
-Even if a default configuration is affected, please include the full configuration
-files _you were testing with_.
-
-Example:
-1. Use the _attached_ configuration file
-2. Start the BIND server with command: `named -g -c named.conf ...`
-3. Simulate legitimate clients using the command `dnsperf -S1 -d legit-queries ...`
-4. Simulate attack traffic using the command `dnsperf -S1 -d attack-queries ...`
-->
-
-1.
-2.
-3.
-
-### What is the current *bug* behavior?
-
-<!--
-Examples:
-Legitimate QPS drops 1000x.
-Memory consumption increases out of bounds and the server crashes.
-The server crashes immediately.
-->
-
-### What is the expected *correct* behavior?
-
-<!--
-If the attack causes resource exhaustion, what do you think the correct
-behavior should be? Should BIND refuse to process more requests?
-
-What heuristic do you propose to distinguish legitimate and attack traffic?
-->
-
-### Relevant logs
-<!--
-Please provide log files from your testing. Include full named logs and also
-the output from any testing tools (e.g. dnsperf, DNS Shotgun, kxdpgun, etc.)
-
-If multiple log files are needed, make sure all the files have matching timestamps
-so we can correlate log events across log files.
-
-In the case of resource exhaustion attacks, please _also_ include system monitoring
-data. You can use https://gitlab.isc.org/isc-projects/resource-monitor/ to
-gather system-wide statistics.
-->
-
-### Coordination
- Does this issue affect multiple implementations?
-<!--
-Issues affecting multiple implementations require very careful coordination. We
-have to make sure the information does not leak to the public until vendors are ready to
-release fixed versions. If it is a multi-vendor issue, we need to know about the situation
-as soon as possible to start the (confidential!) coordination process within
-DNS-OARC and other suitable fora.
-
-Please list implementations you have tested.
-->
-
- Have you shared the information with anyone else?
-<!--
-Have you informed other affected vendors? Or maybe submitted a paper for
-review?
-->
-
- What is your plan to publicize this issue?
-<!--
-E.g. we plan to go public during conference XYZ on 20XX-XX-XX
-->
-
-### Acknowledgements
-<!--
-Please specify whether and how you would like to be publicly credited with
-discovering the issue. We normally use the format:
-First_name Last_name, Company_or_Team.
-->
-
-<!-- DO NOT modify the following two lines. -->
-
-/label ~Bug ~Security
-/confidential
@@ -1,27 +0,0 @@
-Alan Clegg <aclegg@isc.org>
-Alessio Podda <alessio@isc.org>
-Aram Sargsyan <aram@isc.org>
-Artem Boldariev <artem@isc.org> <artem@boldariev.com>
-Curtis Blackburn <ckb@isc.org> <ckb@freebsd11.local>
-Curtis Blackburn <ckb@isc.org> <ckb@isc.org>
-Diego Fronza <diego@isc.org>
-Evan Hunt <each@isc.org> Evan Hunt <fanf@isc.org>
-Håvard Eidnes <he@uninett.no>
-Jeremy C. Reed <jreed@isc.org> <jreed@docs.lab.isc.org>
-Jeremy C. Reed <jreed@isc.org> <jreed@ISC.org>
-Joey Salazar <joey@isc.org>
-John H. DuBois III <johnd>
-Mark Andrews <marka@isc.org>
-Mark Andrews <marka@isc.org> <marka@daemon.lab.isc.org>
-Mark Andrews <marka@isc.org> <marka@newdocs.lab.isc.org>
-Matthijs Mekking <matthijs@isc.org> <github@pletterpet.nl>
-Nicki Křížek <nicki@isc.org> <tkrizek@isc.org>
-Ondřej Surý <ondrej@isc.org>
-Ondřej Surý <ondrej@isc.org> <ondrej@openbsd-6-9.home.sury.org>
-Ondřej Surý <ondrej@isc.org> <ondrej@sury.org>
-Petr Menšík <pemensik@redhat.com>
-Petr Menšík <pemensik@redhat.com> <pmensik@redhat.com>
-Robert Edmonds <edmonds>
-Tatuya JINMEI 神明達哉 <jinmei@isc.org>
-Witold Kręcicki <wpk@isc.org>
-Witold Kręcicki <wpk@isc.org> <wpk@culm.net>
@@ -1,28 +1,10 @@
-[IMPORTS]
-
-deprecated-modules=
-    dns.resolver,
-
-[MESSAGES CONTROL]
-
+[MASTER]
 disable=
    C0103, # invalid-name
    C0114, # missing-module-docstring
    C0115, # missing-class-docstring
    C0116, # missing-function-docstring
    C0209, # consider-using-f-string
-    C0301, # line-too-long, handled better by black
-    C0302, # too-many-lines
    C0415, # import-outside-toplevel
    R0801, # duplicate-code
-    R0901, # too-many-ancestors
-    R0902, # too-many-instance-attributes
    R0903, # too-few-public-methods
-    R0904, # too-many-public-methods
-    R0911, # too-many-return-statements
-    R0912, # too-many-branches
-    R0913, # too-many-arguments
-    R0914, # too-many-locals
-    R0915, # too-many-statements
-    R0916, # too-many-boolean-expressions
-    R0917, # too-many-positional-arguments
@@ -6,9 +6,6 @@ build:
  os: ubuntu-22.04
  tools:
    python: "3.11"
-  jobs:
-    pre_build:
-      - python -m pip install -r https://gitlab.isc.org/isc-projects/bind9/-/raw/main/doc/arm/requirements.txt

 # Build documentation in doc/arm/ with Sphinx
 sphinx:
@@ -16,3 +13,8 @@ sphinx:

 # Build all formats
 formats: all
+
+# Explicitly set the version of Python and its requirements
+python:
+   install:
+   - requirements: doc/arm/requirements.txt
@@ -24,8 +24,8 @@ Files: **/*.after*
       **/testdata/*
       .github/*
       .gitlab/*
-       .mailmap
       AUTHORS
+       CHANGES
       COPYRIGHT
       Makefile
       Makefile.*
@@ -38,31 +38,15 @@ Files: **/*.after*
       bin/tests/system/doth/CA/index.txt
       bin/tests/system/doth/CA/index.txt.attr
       bin/tests/system/doth/CA/serial
-       bin/tests/system/formerr/badnsec3owner
-       bin/tests/system/formerr/badrecordname
-       bin/tests/system/formerr/dupans
-       bin/tests/system/formerr/dupquestion
-       bin/tests/system/formerr/keyclass
-       bin/tests/system/formerr/malformeddeltype
-       bin/tests/system/formerr/malformedrrsig
+       bin/tests/system/notify/ns4/named.port.in
       bin/tests/system/formerr/nametoolong
       bin/tests/system/formerr/noquestions
-       bin/tests/system/formerr/optwrongname
-       bin/tests/system/formerr/qtypeasanswer
-       bin/tests/system/formerr/questionclass
-       bin/tests/system/formerr/shortquestion
-       bin/tests/system/formerr/shortrecord
-       bin/tests/system/formerr/tsignotlast
-       bin/tests/system/formerr/tsigwrongclass
-       bin/tests/system/formerr/twoquestionnames
-       bin/tests/system/formerr/twoquestiontypes
-       bin/tests/system/formerr/wrongclass
+       bin/tests/system/formerr/twoquestions
       bin/tests/system/forward/CA/CA.cfg
       bin/tests/system/forward/CA/README
       bin/tests/system/forward/CA/index.txt
       bin/tests/system/forward/CA/index.txt.attr
       bin/tests/system/forward/CA/serial
-       bin/tests/system/isctest/vars/.ac_vars/*
       bin/tests/system/journal/ns1/managed-keys.bind.in
       bin/tests/system/journal/ns1/managed-keys.bind.jnl.in
       bin/tests/system/journal/ns2/managed-keys.bind.in
@@ -70,15 +54,6 @@ Files: **/*.after*
       bin/tests/system/keepalive/expected
       bin/tests/system/legacy/ns6/edns512.db.signed
       bin/tests/system/legacy/ns7/edns512-notcp.db.signed
-       bin/tests/system/masterfile/knowngood.include
-       bin/tests/system/masterfile/knowngood.ttl1
-       bin/tests/system/masterfile/knowngood.ttl2
-       bin/tests/system/notify/CA/CA.cfg
-       bin/tests/system/notify/CA/README
-       bin/tests/system/notify/CA/index.txt
-       bin/tests/system/notify/CA/index.txt.attr
-       bin/tests/system/notify/CA/serial
-       bin/tests/system/notify/ns4/named.port.in
       bin/tests/system/nsupdate/CA/CA.cfg
       bin/tests/system/nsupdate/CA/README
       bin/tests/system/nsupdate/CA/index.txt
@@ -195,8 +170,6 @@ Files: **/.clang-format
       .readthedocs.yaml
       .tsan-suppress
       .uncrustify.cfg
-       contrib/gitchangelog/changelog.rc.py
-       contrib/gitchangelog/relnotes.rc.py
       doc/misc/*.zoneopt
       doc/misc/options
       doc/misc/rndc.grammar
@@ -11,7 +11,7 @@ See the COPYRIGHT file distributed with this work for additional
 information regarding copyright ownership.
 -->
 ## BIND 9 Source Access and Contributor Guidelines
-*Nov 26, 2024*
+*May 28, 2020*

 ### Contents

@@ -72,13 +72,13 @@ To clone the repository, use:
 >       $ git clone https://gitlab.isc.org/isc-projects/bind9.git

 Release branch names are of the form `bind-9.X`, where X represents the second
-number in the BIND 9 version number.  So, to check out the BIND 9.20
+number in the BIND 9 version number.  So, to check out the BIND 9.18
 branch, use:

->       $ git checkout bind-9.20
+>       $ git checkout bind-9.18

 Whenever a branch is ready for publication, a tag is placed of the
-form `v9.X.Y`.  The 9.20.0 release, for instance, is tagged as `v9.20.0`.
+form `v9.X.Y`.  The 9.18.0 release, for instance, is tagged as `v9.18.0`.

 The branch in which the next major release is being developed is called
 `main`.
@@ -121,9 +121,8 @@ patch will be applied.
 #### <a name="bind"></a>BIND code

 Patches for BIND may be submitted directly via merge requests in
-[ISC's GitLab](https://gitlab.isc.org/isc-projects/bind9/) source repository for
-BIND. Please contact ISC and provide your GitLab username in order to be allowed
-to fork the project and submit merge requests.
+[ISC's GitLab](https://gitlab.isc.org/isc-projects/bind9/) source
+repository for BIND.

 Patches can also be submitted as diffs against a specific version of
 BIND -- preferably the current top of the `main` branch.  Diffs may
@@ -145,8 +144,8 @@ we're busy with other work, it may take us a long time to get to it.
 To ensure your patch is acted on as promptly as possible, please:

 * Try to adhere to the [BIND 9 coding style](doc/dev/style.md).
-* Run unit and system tests to ensure your change hasn't caused any
-  functional regressions (these can be checked in the CI pipeline).
+* Run `make check` to ensure your change hasn't caused any
+  functional regressions.
 * Document your work, both in the patch itself and in the
  accompanying email.
 * In patches that make non-trivial functional changes, include system
@@ -157,12 +156,12 @@ To ensure your patch is acted on as promptly as possible, please:
 ##### Changes to `configure`

 If you need to make changes to `configure`, you should not edit it
-directly; instead, edit `configure.ac`, then run `autoconf`.  Similarly,
-instead of editing `config.h.in` directly, edit `configure.ac` and run
+directly; instead, edit `configure.in`, then run `autoconf`.  Similarly,
+instead of editing `config.h.in` directly, edit `configure.in` and run
 `autoheader`.

 When submitting a patch as a diff, it's fine to omit the `configure`
-diffs to save space.  Just send the `configure.ac` diffs and we'll
+diffs to save space.  Just send the `configure.in` diffs and we'll
 generate the new `configure` during the review process.

 ##### Documentation
@@ -1 +1 @@
-doc/arm/changelog.rst
+CHANGES
@@ -21,6 +21,7 @@ EXTRA_DIST =			\
 	util/bindkeys.pl	\
 	util/dtrace.sh		\
 	contrib			\
+	CHANGES			\
 	COPYRIGHT		\
 	LICENSE			\
 	*.md
@@ -21,8 +21,3 @@ AM_CPPFLAGS +=					\
 LDADD +=						\
 	$(top_builddir)/tests/libtest/libtest.la	\
 	$(CMOCKA_LIBS)
-
-if HAVE_JEMALLOC
-AM_CFLAGS += $(JEMALLOC_CFLAGS)
-LDADD += $(JEMALLOC_LIBS)
-endif
@@ -23,20 +23,12 @@ AM_LDFLAGS +=					\
 	-Wl,-flat_namespace
 endif HOST_MACOS

-if HAVE_JEMALLOC
-LIBISC_CFLAGS = $(JEMALLOC_CFLAGS)
-LIBISC_LIBS = $(JEMALLOC_LIBS)
-else
-LIBISC_CFLAGS =
-LIBISC_LIBS =
-endif
-
-LIBISC_CFLAGS +=						\
+LIBISC_CFLAGS =						\
 	-I$(top_srcdir)/include				\
 	-I$(top_srcdir)/lib/isc/include			\
 	-I$(top_builddir)/lib/isc/include

-LIBISC_LIBS += $(top_builddir)/lib/isc/libisc.la
+LIBISC_LIBS = $(top_builddir)/lib/isc/libisc.la
 if HAVE_DTRACE
 LIBISC_DTRACE = $(top_builddir)/lib/isc/probes.lo
 endif
@@ -1 +1 @@
-doc/arm/changelog.rst
+CHANGES
@@ -26,3 +26,4 @@ Some of these settings are:
 | `-DISC_MEM_TRACKLINES=0`     | Don't track memory allocations by file and line number; this improves performance but makes debugging more difficult                   |
 | `-DNAMED_RUN_PID_DIR=0`      | Create default PID files in `${localstatedir}/run` rather than `${localstatedir}/run/named/`                                           |
 | `-DNS_CLIENT_DROPPORT=0`     | Disable dropping queries from particular well-known ports                                                                              |
+| `-DOPENSSL_API_COMPAT=10100` | Build using the deprecated OpenSSL APIs so that the `engine` API is available when building with OpenSSL 3.0.0 for PKCS#11 support     |
@@ -20,6 +20,7 @@ information regarding copyright ownership.
 1. [Building BIND](#build)
 1. [Automated testing](#testing)
 1. [Documentation](#doc)
+1. [Change log](#changes)
 1. [Acknowledgments](#ack)

 ### <a name="intro"/> Introduction
@@ -48,7 +49,8 @@ ongoing maintenance and improvement. BIND is open source software
 licensed under the terms of the Mozilla Public License, version 2.0.

 For a detailed list of changes made throughout the history of BIND 9, see
-the [changelog](doc/arm/changelog.rst).
+the file [CHANGES](CHANGES). See [below](#changes) for details on the
+CHANGES file format.

 For up-to-date versions and release notes, see
 [https://www.isc.org/download/](https://www.isc.org/download/).
@@ -161,9 +163,38 @@ can be found in the ISC Knowledgebase at
 Additional information on various subjects can be found in other
 `README` files throughout the source tree.

+### <a name="changes"/> Change log
+
+A detailed list of all changes that have been made throughout the
+development of BIND 9 is included in the file CHANGES, with the most recent
+changes listed first. Change notes include tags indicating the category of
+the change that was made; these categories are:
+
+|Category	|Description	        			|
+|--------------	|-----------------------------------------------|
+| [func] | New feature |
+| [bug] | General bug fix |
+| [security] | Fix for a significant security flaw |
+| [experimental] | Used for new features when the syntax or other aspects of the design are still in flux and may change |
+| [port] | Portability enhancement |
+| [maint] | Updates to built-in data such as root server addresses and keys |
+| [tuning] | Changes to built-in configuration defaults and constants to improve performance |
+| [performance] | Other changes to improve server performance |
+| [protocol] | Updates to the DNS protocol such as new RR types |
+| [test] | Changes to the automatic tests, not affecting server functionality |
+| [cleanup] | Minor corrections and refactoring |
+| [doc] | Documentation |
+| [contrib] | Changes to the contributed tools and libraries in the 'contrib' subdirectory |
+| [placeholder] | Used in the main development branch to reserve change numbers for use in other branches, e.g., when fixing a bug that only exists in older releases |
+
+In general, [func] and [experimental] tags only appear in new-feature
+releases (i.e., those with version numbers ending in zero). Some new
+functionality may be backported to older releases on a case-by-case basis.
+All other change types may be applied to all currently supported releases.
+
 #### Bug report identifiers

-Most notes in the ARM Changelog appendix include a reference to a bug report or
+Most notes in the CHANGES file include a reference to a bug report or
 issue number. Prior to 2018, these were usually of the form `[RT #NNN]`
 and referred to entries in the "bind9-bugs" RT database, which was not open
 to the public. More recent entries use the form `[GL #NNN]` or, less often,
@@ -33,6 +33,7 @@
 #include <dns/db.h>
 #include <dns/dbiterator.h>
 #include <dns/fixedname.h>
+#include <dns/log.h>
 #include <dns/name.h>
 #include <dns/rdata.h>
 #include <dns/rdataclass.h>
@@ -42,6 +43,10 @@
 #include <dns/types.h>
 #include <dns/zone.h>

+#include <isccfg/log.h>
+
+#include <ns/log.h>
+
 #include "check-tool.h"

 #ifndef CHECK_SIBLING
@@ -68,7 +73,7 @@
 #define ERR_IS_MXCNAME	   6
 #define ERR_IS_SRVCNAME	   7

-static const char *dbtype[] = { ZONEDB_DEFAULT };
+static const char *dbtype[] = { "rbt" };

 int debug = 0;
 const char *journal = NULL;
@@ -83,7 +88,6 @@ bool dochecksrv = false;
 bool docheckns = false;
 #endif /* if CHECK_LOCAL */
 dns_zoneopt_t zone_options = DNS_ZONEOPT_CHECKNS | DNS_ZONEOPT_CHECKMX |
-			     DNS_ZONEOPT_CHECKDUPRR | DNS_ZONEOPT_CHECKSPF |
 			     DNS_ZONEOPT_MANYERRORS | DNS_ZONEOPT_CHECKNAMES |
 			     DNS_ZONEOPT_CHECKINTEGRITY |
 #if CHECK_SIBLING
@@ -92,6 +96,13 @@ dns_zoneopt_t zone_options = DNS_ZONEOPT_CHECKNS | DNS_ZONEOPT_CHECKMX |
 			     DNS_ZONEOPT_CHECKSVCB | DNS_ZONEOPT_CHECKWILDCARD |
 			     DNS_ZONEOPT_WARNMXCNAME | DNS_ZONEOPT_WARNSRVCNAME;

+/*
+ * This needs to match the list in bin/named/log.c.
+ */
+static isc_logcategory_t categories[] = { { "", 0 },
+					  { "unmatched", 0 },
+					  { NULL, 0 } };
+
 static isc_symtab_t *symtab = NULL;
 static isc_mem_t *sym_mctx;

@@ -112,7 +123,11 @@ add(char *key, int value) {
 	}

 	if (symtab == NULL) {
-		isc_symtab_create(sym_mctx, freekey, sym_mctx, false, &symtab);
+		result = isc_symtab_create(sym_mctx, 100, freekey, sym_mctx,
+					   false, &symtab);
+		if (result != ISC_R_SUCCESS) {
+			return;
+		}
 	}

 	key = isc_mem_strdup(sym_mctx, key);
@@ -130,92 +145,14 @@ logged(char *key, int value) {
 	isc_result_t result;

 	if (symtab == NULL) {
-		return false;
+		return (false);
 	}

 	result = isc_symtab_lookup(symtab, key, value, NULL);
 	if (result == ISC_R_SUCCESS) {
-		return true;
-	}
-	return false;
-}
-
-static bool
-checkisservedby(dns_zone_t *zone, dns_rdatatype_t type,
-		const dns_name_t *name) {
-	char namebuf[DNS_NAME_FORMATSIZE + 1];
-	char ownerbuf[DNS_NAME_FORMATSIZE + 1];
-	/*
-	 * Not all getaddrinfo implementations distinguish NODATA
-	 * from NXDOMAIN with PF_INET6 so use PF_UNSPEC and look at
-	 * the returned ai_family values.
-	 */
-	struct addrinfo hints = {
-		.ai_flags = AI_CANONNAME,
-		.ai_family = PF_UNSPEC,
-		.ai_socktype = SOCK_STREAM,
-		.ai_protocol = IPPROTO_TCP,
-	};
-	struct addrinfo *ai = NULL, *cur;
-	bool has_type = false;
-	int eai;
-
-	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
-	/*
-	 * Turn off search.
-	 */
-	if (dns_name_countlabels(name) > 1U) {
-		strlcat(namebuf, ".", sizeof(namebuf));
-	}
-	eai = getaddrinfo(namebuf, NULL, &hints, &ai);
-
-	switch (eai) {
-	case 0:
-		cur = ai;
-		while (cur != NULL) {
-			if (cur->ai_family == AF_INET &&
-			    type == dns_rdatatype_a)
-			{
-				has_type = true;
-				break;
-			}
-			if (cur->ai_family == AF_INET6 &&
-			    type == dns_rdatatype_aaaa)
-			{
-				has_type = true;
-				break;
-			}
-			cur = cur->ai_next;
-		}
-		freeaddrinfo(ai);
-		return has_type;
-#if defined(EAI_NODATA) && (EAI_NODATA != EAI_NONAME)
-	case EAI_NODATA:
-#endif /* if defined(EAI_NODATA) && (EAI_NODATA != EAI_NONAME) */
-	case EAI_NONAME:
-		if (!logged(namebuf, ERR_NO_ADDRESSES)) {
-			dns_name_format(dns_zone_getorigin(zone), ownerbuf,
-					sizeof(ownerbuf));
-			dns_name_format(name, namebuf, sizeof(namebuf) - 1);
-			dns_zone_log(zone, ISC_LOG_ERROR,
-				     "%s/NS '%s' (out of zone) "
-				     "has no addresses records (A or AAAA)",
-				     ownerbuf, namebuf);
-			add(namebuf, ERR_NO_ADDRESSES);
-		}
-		return false;
-	default:
-		if (!logged(namebuf, ERR_LOOKUP_FAILURE)) {
-			dns_name_format(dns_zone_getorigin(zone), ownerbuf,
-					sizeof(ownerbuf));
-			dns_name_format(name, namebuf, sizeof(namebuf) - 1);
-			dns_zone_log(zone, ISC_LOG_WARNING,
-				     "getaddrinfo(%s) failed: %s", namebuf,
-				     gai_strerror(eai));
-			add(namebuf, ERR_LOOKUP_FAILURE);
-		}
-		return true;
+		return (true);
 	}
+	return (false);
 }

 static bool
@@ -223,14 +160,7 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 	dns_rdataset_t *a, dns_rdataset_t *aaaa) {
 	dns_rdataset_t *rdataset;
 	dns_rdata_t rdata = DNS_RDATA_INIT;
-	isc_result_t result;
-	struct addrinfo hints = {
-		.ai_flags = AI_CANONNAME,
-		.ai_family = PF_UNSPEC,
-		.ai_socktype = SOCK_STREAM,
-		.ai_protocol = IPPROTO_TCP,
-	};
-	struct addrinfo *ai = NULL, *cur;
+	struct addrinfo hints, *ai, *cur;
 	char namebuf[DNS_NAME_FORMATSIZE + 1];
 	char ownerbuf[DNS_NAME_FORMATSIZE];
 	char addrbuf[sizeof("xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:123.123.123.123")];
@@ -238,7 +168,7 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 	bool match;
 	const char *type;
 	void *ptr = NULL;
-	int eai;
+	int result;

 	REQUIRE(a == NULL || !dns_rdataset_isassociated(a) ||
 		a->type == dns_rdatatype_a);
@@ -246,9 +176,15 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 		aaaa->type == dns_rdatatype_aaaa);

 	if (a == NULL || aaaa == NULL) {
-		return answer;
+		return (answer);
 	}

+	memset(&hints, 0, sizeof(hints));
+	hints.ai_flags = AI_CANONNAME;
+	hints.ai_family = PF_UNSPEC;
+	hints.ai_socktype = SOCK_STREAM;
+	hints.ai_protocol = IPPROTO_TCP;
+
 	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
 	/*
 	 * Turn off search.
@@ -258,9 +194,9 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 	}
 	dns_name_format(owner, ownerbuf, sizeof(ownerbuf));

-	eai = getaddrinfo(namebuf, NULL, &hints, &ai);
+	result = getaddrinfo(namebuf, NULL, &hints, &ai);
 	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
-	switch (eai) {
+	switch (result) {
 	case 0:
 		/*
 		 * Work around broken getaddrinfo() implementations that
@@ -297,16 +233,16 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 			add(namebuf, ERR_NO_ADDRESSES);
 		}
 		/* XXX950 make fatal for 9.5.0 */
-		return true;
+		return (true);

 	default:
 		if (!logged(namebuf, ERR_LOOKUP_FAILURE)) {
 			dns_zone_log(zone, ISC_LOG_WARNING,
 				     "getaddrinfo(%s) failed: %s", namebuf,
-				     gai_strerror(eai));
+				     gai_strerror(result));
 			add(namebuf, ERR_LOOKUP_FAILURE);
 		}
-		return true;
+		return (true);
 	}

 	/*
@@ -433,27 +369,25 @@ checkmissing:
 			add(namebuf, ERR_MISSING_GLUE);
 		}
 	}
-	if (ai != NULL) {
-		freeaddrinfo(ai);
-	}
-	return answer;
+	freeaddrinfo(ai);
+	return (answer);
 }

 static bool
 checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
-	struct addrinfo hints = {
-		.ai_flags = AI_CANONNAME,
-		.ai_family = PF_UNSPEC,
-		.ai_socktype = SOCK_STREAM,
-		.ai_protocol = IPPROTO_TCP,
-	};
-	struct addrinfo *ai = NULL, *cur;
+	struct addrinfo hints, *ai, *cur;
 	char namebuf[DNS_NAME_FORMATSIZE + 1];
 	char ownerbuf[DNS_NAME_FORMATSIZE];
-	int eai;
+	int result;
 	int level = ISC_LOG_ERROR;
 	bool answer = true;

+	memset(&hints, 0, sizeof(hints));
+	hints.ai_flags = AI_CANONNAME;
+	hints.ai_family = PF_UNSPEC;
+	hints.ai_socktype = SOCK_STREAM;
+	hints.ai_protocol = IPPROTO_TCP;
+
 	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
 	/*
 	 * Turn off search.
@@ -463,9 +397,9 @@ checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 	}
 	dns_name_format(owner, ownerbuf, sizeof(ownerbuf));

-	eai = getaddrinfo(namebuf, NULL, &hints, &ai);
+	result = getaddrinfo(namebuf, NULL, &hints, &ai);
 	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
-	switch (eai) {
+	switch (result) {
 	case 0:
 		/*
 		 * Work around broken getaddrinfo() implementations that
@@ -498,10 +432,8 @@ checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 				}
 			}
 		}
-		if (ai != NULL) {
-			freeaddrinfo(ai);
-		}
-		return answer;
+		freeaddrinfo(ai);
+		return (answer);

 	case EAI_NONAME:
 #if defined(EAI_NODATA) && (EAI_NODATA != EAI_NONAME)
@@ -515,34 +447,34 @@ checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 			add(namebuf, ERR_NO_ADDRESSES);
 		}
 		/* XXX950 make fatal for 9.5.0. */
-		return true;
+		return (true);

 	default:
 		if (!logged(namebuf, ERR_LOOKUP_FAILURE)) {
 			dns_zone_log(zone, ISC_LOG_WARNING,
 				     "getaddrinfo(%s) failed: %s", namebuf,
-				     gai_strerror(eai));
+				     gai_strerror(result));
 			add(namebuf, ERR_LOOKUP_FAILURE);
 		}
-		return true;
+		return (true);
 	}
 }

 static bool
 checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
-	struct addrinfo hints = {
-		.ai_flags = AI_CANONNAME,
-		.ai_family = PF_UNSPEC,
-		.ai_socktype = SOCK_STREAM,
-		.ai_protocol = IPPROTO_TCP,
-	};
-	struct addrinfo *ai = NULL, *cur;
+	struct addrinfo hints, *ai, *cur;
 	char namebuf[DNS_NAME_FORMATSIZE + 1];
 	char ownerbuf[DNS_NAME_FORMATSIZE];
-	int eai;
+	int result;
 	int level = ISC_LOG_ERROR;
 	bool answer = true;

+	memset(&hints, 0, sizeof(hints));
+	hints.ai_flags = AI_CANONNAME;
+	hints.ai_family = PF_UNSPEC;
+	hints.ai_socktype = SOCK_STREAM;
+	hints.ai_protocol = IPPROTO_TCP;
+
 	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
 	/*
 	 * Turn off search.
@@ -552,9 +484,9 @@ checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 	}
 	dns_name_format(owner, ownerbuf, sizeof(ownerbuf));

-	eai = getaddrinfo(namebuf, NULL, &hints, &ai);
+	result = getaddrinfo(namebuf, NULL, &hints, &ai);
 	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
-	switch (eai) {
+	switch (result) {
 	case 0:
 		/*
 		 * Work around broken getaddrinfo() implementations that
@@ -587,10 +519,8 @@ checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 				}
 			}
 		}
-		if (ai != NULL) {
-			freeaddrinfo(ai);
-		}
-		return answer;
+		freeaddrinfo(ai);
+		return (answer);

 	case EAI_NONAME:
 #if defined(EAI_NODATA) && (EAI_NODATA != EAI_NONAME)
@@ -604,28 +534,45 @@ checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 			add(namebuf, ERR_NO_ADDRESSES);
 		}
 		/* XXX950 make fatal for 9.5.0. */
-		return true;
+		return (true);

 	default:
 		if (!logged(namebuf, ERR_LOOKUP_FAILURE)) {
 			dns_zone_log(zone, ISC_LOG_WARNING,
 				     "getaddrinfo(%s) failed: %s", namebuf,
-				     gai_strerror(eai));
+				     gai_strerror(result));
 			add(namebuf, ERR_LOOKUP_FAILURE);
 		}
-		return true;
+		return (true);
 	}
 }

 isc_result_t
-setup_logging(FILE *errout) {
-	isc_logconfig_t *logconfig = isc_logconfig_get();
-	isc_log_createandusechannel(
-		logconfig, "default_stderr", ISC_LOG_TOFILEDESC,
-		ISC_LOG_DYNAMIC, ISC_LOGDESTINATION_FILE(errout), 0,
-		ISC_LOGCATEGORY_DEFAULT, ISC_LOGMODULE_DEFAULT);
+setup_logging(isc_mem_t *mctx, FILE *errout, isc_log_t **logp) {
+	isc_logdestination_t destination;
+	isc_logconfig_t *logconfig = NULL;
+	isc_log_t *log = NULL;

-	return ISC_R_SUCCESS;
+	isc_log_create(mctx, &log, &logconfig);
+	isc_log_registercategories(log, categories);
+	isc_log_setcontext(log);
+	dns_log_init(log);
+	dns_log_setcontext(log);
+	cfg_log_init(log);
+	ns_log_init(log);
+
+	destination.file.stream = errout;
+	destination.file.name = NULL;
+	destination.file.versions = ISC_LOG_ROLLNEVER;
+	destination.file.maximum_size = 0;
+	isc_log_createchannel(logconfig, "stderr", ISC_LOG_TOFILEDESC,
+			      ISC_LOG_DYNAMIC, &destination, 0);
+
+	RUNTIME_CHECK(isc_log_usechannel(logconfig, "stderr", NULL, NULL) ==
+		      ISC_R_SUCCESS);
+
+	*logp = log;
+	return (ISC_R_SUCCESS);
 }

 /*% load the zone */
@@ -655,18 +602,18 @@ load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,
 	isc_buffer_constinit(&buffer, zonename, strlen(zonename));
 	isc_buffer_add(&buffer, strlen(zonename));
 	origin = dns_fixedname_initname(&fixorigin);
-	CHECK(dns_name_fromtext(origin, &buffer, dns_rootname, 0));
-	dns_zone_setorigin(zone, origin);
+	CHECK(dns_name_fromtext(origin, &buffer, dns_rootname, 0, NULL));
+	CHECK(dns_zone_setorigin(zone, origin));
 	dns_zone_setdbtype(zone, 1, (const char *const *)dbtype);
 	if (strcmp(filename, "-") == 0) {
-		dns_zone_setstream(zone, stdin, fileformat,
-				   &dns_master_style_default);
+		CHECK(dns_zone_setstream(zone, stdin, fileformat,
+					 &dns_master_style_default));
 	} else {
-		dns_zone_setfile(zone, filename, fileformat,
-				 &dns_master_style_default);
+		CHECK(dns_zone_setfile(zone, filename, fileformat,
+				       &dns_master_style_default));
 	}
 	if (journal != NULL) {
-		dns_zone_setjournal(zone, journal);
+		CHECK(dns_zone_setjournal(zone, journal));
 	}

 	region.base = UNCONST(classname);
@@ -684,7 +631,6 @@ load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,
 	}
 	if (docheckns) {
 		dns_zone_setcheckns(zone, checkns);
-		dns_zone_setcheckisservedby(zone, checkisservedby);
 	}
 	if (dochecksrv) {
 		dns_zone_setchecksrv(zone, checksrv);
@@ -701,7 +647,7 @@ cleanup:
 	if (zone != NULL) {
 		dns_zone_detach(&zone);
 	}
-	return result;
+	return (result);
 }

 /*% dump the zone */
@@ -732,7 +678,7 @@ dump_zone(const char *zonename, dns_zone_t *zone, const char *filename,
 				"could not open output "
 				"file \"%s\" for writing\n",
 				filename);
-			return ISC_R_FAILURE;
+			return (ISC_R_FAILURE);
 		}
 	}

@@ -742,5 +688,5 @@ dump_zone(const char *zonename, dns_zone_t *zone, const char *filename,
 		(void)isc_stdio_close(output);
 	}

-	return result;
+	return (result);
 }
@@ -18,6 +18,7 @@
 #include <inttypes.h>
 #include <stdbool.h>

+#include <isc/lang.h>
 #include <isc/stdio.h>
 #include <isc/types.h>

@@ -25,8 +26,10 @@
 #include <dns/types.h>
 #include <dns/zone.h>

+ISC_LANG_BEGINDECLS
+
 isc_result_t
-setup_logging(FILE *errout);
+setup_logging(isc_mem_t *mctx, FILE *errout, isc_log_t **logp);

 isc_result_t
 load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,
@@ -45,3 +48,5 @@ extern bool docheckmx;
 extern bool docheckns;
 extern bool dochecksrv;
 extern dns_zoneopt_t zone_options;
+
+ISC_LANG_ENDDECLS
@@ -22,7 +22,6 @@
 #include <isc/commandline.h>
 #include <isc/dir.h>
 #include <isc/hash.h>
-#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
@@ -31,7 +30,7 @@

 #include <dns/db.h>
 #include <dns/fixedname.h>
-#include <dns/lib.h>
+#include <dns/log.h>
 #include <dns/name.h>
 #include <dns/rdataclass.h>
 #include <dns/rootns.h>
@@ -45,6 +44,8 @@

 static const char *program = "named-checkconf";

+isc_log_t *logc = NULL;
+
 #define CHECK(r)                             \
 	do {                                 \
 		result = (r);                \
@@ -53,7 +54,7 @@ static const char *program = "named-checkconf";
 	} while (0)

 /*% usage */
-ISC_NORETURN static void
+noreturn static void
 usage(void);

 static void
@@ -62,7 +63,7 @@ usage(void) {
 		"usage: %s [-achijlvz] [-p [-x]] [-t directory] "
 		"[named.conf]\n",
 		program);
-	exit(EXIT_SUCCESS);
+	exit(1);
 }

 /*% directory callback */
@@ -82,13 +83,13 @@ directory_callback(const char *clausename, const cfg_obj_t *obj, void *arg) {
 	directory = cfg_obj_asstring(obj);
 	result = isc_dir_chdir(directory);
 	if (result != ISC_R_SUCCESS) {
-		cfg_obj_log(obj, ISC_LOG_ERROR,
+		cfg_obj_log(obj, logc, ISC_LOG_ERROR,
 			    "change directory to '%s' failed: %s\n", directory,
 			    isc_result_totext(result));
-		return result;
+		return (result);
 	}

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static bool
@@ -96,10 +97,10 @@ get_maps(const cfg_obj_t **maps, const char *name, const cfg_obj_t **obj) {
 	int i;
 	for (i = 0;; i++) {
 		if (maps[i] == NULL) {
-			return false;
+			return (false);
 		}
 		if (cfg_map_get(maps[i], name, obj) == ISC_R_SUCCESS) {
-			return true;
+			return (true);
 		}
 	}
 }
@@ -115,7 +116,7 @@ get_checknames(const cfg_obj_t **maps, const cfg_obj_t **obj) {

 	for (i = 0;; i++) {
 		if (maps[i] == NULL) {
-			return false;
+			return (false);
 		}
 		checknames = NULL;
 		result = cfg_map_get(maps[i], "check-names", &checknames);
@@ -124,7 +125,7 @@ get_checknames(const cfg_obj_t **maps, const cfg_obj_t **obj) {
 		}
 		if (checknames != NULL && !cfg_obj_islist(checknames)) {
 			*obj = checknames;
-			return true;
+			return (true);
 		}
 		for (element = cfg_list_first(checknames); element != NULL;
 		     element = cfg_list_next(element))
@@ -138,7 +139,7 @@ get_checknames(const cfg_obj_t **maps, const cfg_obj_t **obj) {
 				continue;
 			}
 			*obj = cfg_tuple_get(value, "mode");
-			return true;
+			return (true);
 		}
 	}
 }
@@ -151,23 +152,23 @@ configure_hint(const char *zfile, const char *zclass, isc_mem_t *mctx) {
 	isc_textregion_t r;

 	if (zfile == NULL) {
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

 	r.base = UNCONST(zclass);
 	r.length = strlen(zclass);
 	result = dns_rdataclass_fromtext(&rdclass, &r);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}

 	result = dns_rootns_create(mctx, rdclass, zfile, &db);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}

 	dns_db_detach(&db);
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 /*% configure the zone */
@@ -223,33 +224,31 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 		printf("%s %s %s in-view %s\n", zname, zclass, view, inview);
 	}
 	if (inviewobj != NULL) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	cfg_map_get(zoptions, "type", &typeobj);
 	if (typeobj == NULL) {
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

 	if (list) {
 		const char *ztype = cfg_obj_asstring(typeobj);
 		printf("%s %s %s %s\n", zname, zclass, view, ztype);
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	/*
 	 * Skip checks when using an alternate data source.
 	 */
 	cfg_map_get(zoptions, "database", &dbobj);
-	if (dbobj != NULL &&
-	    strcmp(ZONEDB_DEFAULT, cfg_obj_asstring(dbobj)) != 0)
-	{
-		return ISC_R_SUCCESS;
+	if (dbobj != NULL && strcmp("rbt", cfg_obj_asstring(dbobj)) != 0) {
+		return (ISC_R_SUCCESS);
 	}

 	cfg_map_get(zoptions, "dlz", &dlzobj);
 	if (dlzobj != NULL) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	cfg_map_get(zoptions, "file", &fileobj);
@@ -263,12 +262,12 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 	 * master and redirect
 	 */
 	if (strcasecmp(cfg_obj_asstring(typeobj), "hint") == 0) {
-		return configure_hint(zfile, zclass, mctx);
+		return (configure_hint(zfile, zclass, mctx));
 	} else if ((strcasecmp(cfg_obj_asstring(typeobj), "primary") != 0) &&
 		   (strcasecmp(cfg_obj_asstring(typeobj), "master") != 0) &&
 		   (strcasecmp(cfg_obj_asstring(typeobj), "redirect") != 0))
 	{
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	/*
@@ -281,12 +280,12 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 		}

 		if (primariesobj != NULL) {
-			return ISC_R_SUCCESS;
+			return (ISC_R_SUCCESS);
 		}
 	}

 	if (zfile == NULL) {
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

 	obj = NULL;
@@ -464,7 +463,7 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 		fprintf(stderr, "%s/%s/%s: %s\n", view, zname, zclass,
 			isc_result_totext(result));
 	}
-	return result;
+	return (result);
 }

 /*% configure a view */
@@ -499,7 +498,7 @@ configure_view(const char *vclass, const char *view, const cfg_obj_t *config,
 			result = tresult;
 		}
 	}
-	return result;
+	return (result);
 }

 static isc_result_t
@@ -509,11 +508,11 @@ config_getclass(const cfg_obj_t *classobj, dns_rdataclass_t defclass,

 	if (!cfg_obj_isstring(classobj)) {
 		*classp = defclass;
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}
 	r.base = UNCONST(cfg_obj_asstring(classobj));
 	r.length = strlen(r.base);
-	return dns_rdataclass_fromtext(classp, &r);
+	return (dns_rdataclass_fromtext(classp, &r));
 }

 /*% load zones from the configuration */
@@ -571,7 +570,7 @@ load_zones_fromconfig(const cfg_obj_t *config, isc_mem_t *mctx,
 	}

 cleanup:
-	return result;
+	return (result);
 }

 static void
@@ -592,11 +591,11 @@ main(int argc, char **argv) {
 	const char *conffile = NULL;
 	isc_mem_t *mctx = NULL;
 	isc_result_t result = ISC_R_SUCCESS;
+	bool cleanup_dst = true;
 	bool load_zones = false;
 	bool list_zones = false;
 	bool print = false;
 	bool nodeprecate = false;
-	bool allconfigs = false;
 	unsigned int flags = 0;
 	unsigned int checkflags = BIND_CHECK_PLUGINS | BIND_CHECK_ALGORITHMS;

@@ -605,7 +604,7 @@ main(int argc, char **argv) {
 	/*
 	 * Process memory debugging argument first.
 	 */
-#define CMDLINE_FLAGS "acdhijlm:nt:pvxz"
+#define CMDLINE_FLAGS "acdhijlm:t:pvxz"
 	while ((c = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (c) {
 		case 'm':
@@ -659,10 +658,6 @@ main(int argc, char **argv) {
 		case 'm':
 			break;

-		case 'n':
-			allconfigs = true;
-			break;
-
 		case 't':
 			result = isc_dir_chroot(isc_commandline_argument);
 			if (result != ISC_R_SUCCESS) {
@@ -729,20 +724,20 @@ main(int argc, char **argv) {
 		conffile = NAMED_CONFFILE;
 	}

-	CHECK(setup_logging(stdout));
+	CHECK(setup_logging(mctx, stdout, &logc));

-	CHECK(cfg_parser_create(mctx, &parser));
+	CHECK(dst_lib_init(mctx, NULL));
+	cleanup_dst = true;
+
+	CHECK(cfg_parser_create(mctx, logc, &parser));

 	if (nodeprecate) {
 		cfg_parser_setflags(parser, CFG_PCTX_NODEPRECATED, true);
 	}
-	if (allconfigs) {
-		cfg_parser_setflags(parser, CFG_PCTX_ALLCONFIGS, true);
-	}
 	cfg_parser_setcallback(parser, directory_callback, NULL);

 	CHECK(cfg_parse_file(parser, conffile, &cfg_type_namedconf, &config));
-	CHECK(isccfg_check_namedconf(config, checkflags, mctx));
+	CHECK(isccfg_check_namedconf(config, checkflags, logc, mctx));
 	if (load_zones || list_zones) {
 		CHECK(load_zones_fromconfig(config, mctx, list_zones));
 	}
@@ -760,9 +755,17 @@ cleanup:
 		cfg_parser_destroy(&parser);
 	}

-	if (mctx != NULL) {
-		isc_mem_detach(&mctx);
+	if (cleanup_dst) {
+		dst_lib_destroy();
 	}

-	return result == ISC_R_SUCCESS ? 0 : 1;
+	if (logc != NULL) {
+		isc_log_destroy(&logc);
+	}
+
+	if (mctx != NULL) {
+		isc_mem_destroy(&mctx);
+	}
+
+	return (result == ISC_R_SUCCESS ? 0 : 1);
 }
@@ -21,7 +21,7 @@ named-checkconf - named configuration file syntax checking tool
 Synopsis
 ~~~~~~~~

-:program:`named-checkconf` [**-achjlnvz**] [**-p** [**-x** ]] [**-t** directory] {filename}
+:program:`named-checkconf` [**-achjlvz**] [**-p** [**-x** ]] [**-t** directory] {filename}

 Description
 ~~~~~~~~~~~
@@ -71,12 +71,6 @@ Options

   This option ignores warnings on deprecated options.

-.. option:: -n
-
-   Do not print errors when encountering options that are disabled in
-   this build. This allows checking of configuration files for other
-   builds, in which those options are enabled.
-
 .. option:: -p

   This option prints out the :iscman:`named.conf` and included files in canonical form if
@@ -22,7 +22,6 @@
 #include <isc/dir.h>
 #include <isc/file.h>
 #include <isc/hash.h>
-#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
@@ -32,7 +31,7 @@

 #include <dns/db.h>
 #include <dns/fixedname.h>
-#include <dns/lib.h>
+#include <dns/log.h>
 #include <dns/master.h>
 #include <dns/masterdump.h>
 #include <dns/name.h>
@@ -63,7 +62,7 @@ static enum { progmode_check, progmode_compile } progmode;
 		}                                                             \
 	} while (0)

-ISC_NORETURN static void
+noreturn static void
 usage(void);

 static void
@@ -80,7 +79,7 @@ usage(void) {
 		"%s zonename [ (filename|-) ]\n",
 		prog_name,
 		progmode == progmode_check ? "[-o filename]" : "-o filename");
-	exit(EXIT_FAILURE);
+	exit(1);
 }

 static void
@@ -96,6 +95,7 @@ main(int argc, char **argv) {
 	int c;
 	char *origin = NULL;
 	const char *filename = NULL;
+	isc_log_t *lctx = NULL;
 	isc_result_t result;
 	char classname_in[] = "IN";
 	char *classname = classname_in;
@@ -147,12 +147,15 @@ main(int argc, char **argv) {
 		UNREACHABLE();
 	}

-	/* When compiling, disable checks by default */
+	/* Compilation specific defaults */
 	if (progmode == progmode_compile) {
-		zone_options = 0;
-		docheckmx = false;
-		docheckns = false;
-		dochecksrv = false;
+		zone_options |= (DNS_ZONEOPT_CHECKNS | DNS_ZONEOPT_FATALNS |
+				 DNS_ZONEOPT_CHECKSPF | DNS_ZONEOPT_CHECKDUPRR |
+				 DNS_ZONEOPT_CHECKNAMES |
+				 DNS_ZONEOPT_CHECKNAMESFAIL |
+				 DNS_ZONEOPT_CHECKWILDCARD);
+	} else {
+		zone_options |= (DNS_ZONEOPT_CHECKDUPRR | DNS_ZONEOPT_CHECKSPF);
 	}

 #define ARGCMP(X) (strcmp(isc_commandline_argument, X) == 0)
@@ -161,7 +164,7 @@ main(int argc, char **argv) {

 	while ((c = isc_commandline_parse(argc, argv,
 					  "c:df:hi:jJ:k:L:l:m:n:qr:s:t:o:vw:C:"
-					  "DF:M:R:S:T:W:")) != EOF)
+					  "DF:M:S:T:W:")) != EOF)
 	{
 		switch (c) {
 		case 'c':
@@ -206,7 +209,7 @@ main(int argc, char **argv) {
 			} else {
 				fprintf(stderr, "invalid argument to -i: %s\n",
 					isc_commandline_argument);
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;

@@ -240,7 +243,7 @@ main(int argc, char **argv) {
 			} else {
 				fprintf(stderr, "invalid argument to -k: %s\n",
 					isc_commandline_argument);
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;

@@ -251,7 +254,7 @@ main(int argc, char **argv) {
 			if (*endp != '\0') {
 				fprintf(stderr, "source serial number "
 						"must be numeric");
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;

@@ -262,7 +265,7 @@ main(int argc, char **argv) {
 			if (*endp != '\0') {
 				fprintf(stderr, "maximum TTL "
 						"must be numeric");
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;

@@ -279,7 +282,7 @@ main(int argc, char **argv) {
 			} else {
 				fprintf(stderr, "invalid argument to -n: %s\n",
 					isc_commandline_argument);
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;

@@ -296,7 +299,7 @@ main(int argc, char **argv) {
 			} else {
 				fprintf(stderr, "invalid argument to -m: %s\n",
 					isc_commandline_argument);
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;

@@ -321,19 +324,7 @@ main(int argc, char **argv) {
 			} else {
 				fprintf(stderr, "invalid argument to -r: %s\n",
 					isc_commandline_argument);
-				exit(EXIT_FAILURE);
-			}
-			break;
-
-		case 'R':
-			if (ARGCMP("fail")) {
-				zone_options |= DNS_ZONEOPT_LOGREPORTS;
-			} else if (ARGCMP("ignore")) {
-				zone_options &= ~DNS_ZONEOPT_LOGREPORTS;
-			} else {
-				fprintf(stderr, "invalid argument to -R: %s\n",
-					isc_commandline_argument);
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;

@@ -346,7 +337,7 @@ main(int argc, char **argv) {
 				fprintf(stderr,
 					"unknown or unsupported style: %s\n",
 					isc_commandline_argument);
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;

@@ -356,13 +347,13 @@ main(int argc, char **argv) {
 				fprintf(stderr, "isc_dir_chroot: %s: %s\n",
 					isc_commandline_argument,
 					isc_result_totext(result));
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;

 		case 'v':
 			printf("%s\n", PACKAGE_VERSION);
-			exit(EXIT_SUCCESS);
+			exit(0);

 		case 'w':
 			workdir = isc_commandline_argument;
@@ -376,7 +367,7 @@ main(int argc, char **argv) {
 			} else {
 				fprintf(stderr, "invalid argument to -C: %s\n",
 					isc_commandline_argument);
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;

@@ -397,7 +388,7 @@ main(int argc, char **argv) {
 			} else {
 				fprintf(stderr, "invalid argument to -M: %s\n",
 					isc_commandline_argument);
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;

@@ -414,7 +405,7 @@ main(int argc, char **argv) {
 			} else {
 				fprintf(stderr, "invalid argument to -S: %s\n",
 					isc_commandline_argument);
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;

@@ -426,7 +417,7 @@ main(int argc, char **argv) {
 			} else {
 				fprintf(stderr, "invalid argument to -T: %s\n",
 					isc_commandline_argument);
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;

@@ -450,7 +441,7 @@ main(int argc, char **argv) {
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n", prog_name,
 				isc_commandline_option);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}

@@ -459,7 +450,7 @@ main(int argc, char **argv) {
 		if (result != ISC_R_SUCCESS) {
 			fprintf(stderr, "isc_dir_chdir: %s: %s\n", workdir,
 				isc_result_totext(result));
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}

@@ -475,7 +466,7 @@ main(int argc, char **argv) {
 		} else {
 			fprintf(stderr, "unknown file format: %s\n",
 				inputformatstr);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}

@@ -493,12 +484,12 @@ main(int argc, char **argv) {
 			    rawversion > 1U)
 			{
 				fprintf(stderr, "unknown raw format version\n");
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 		} else {
 			fprintf(stderr, "unknown file format: %s\n",
 				outputformatstr);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}

@@ -537,7 +528,8 @@ main(int argc, char **argv) {

 	isc_mem_create(&mctx);
 	if (!quiet) {
-		RUNTIME_CHECK(setup_logging(errout) == ISC_R_SUCCESS);
+		RUNTIME_CHECK(setup_logging(mctx, errout, &lctx) ==
+			      ISC_R_SUCCESS);
 	}

 	origin = argv[isc_commandline_index++];
@@ -577,7 +569,10 @@ main(int argc, char **argv) {
 		fprintf(errout, "OK\n");
 	}
 	destroy();
-	isc_mem_detach(&mctx);
+	if (lctx != NULL) {
+		isc_log_destroy(&lctx);
+	}
+	isc_mem_destroy(&mctx);

-	return (result == ISC_R_SUCCESS) ? 0 : 1;
+	return ((result == ISC_R_SUCCESS) ? 0 : 1);
 }
@@ -23,7 +23,7 @@ named-checkzone - zone file validation tool
 Synopsis
 ~~~~~~~~

-:program:`named-checkzone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-C** mode] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-o** filename] [**-r** mode] [**-R** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {zonename} {filename}
+:program:`named-checkzone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-C** mode] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-o** filename] [**-r** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {zonename} {filename}

 Description
 ~~~~~~~~~~~
@@ -91,13 +91,9 @@ Options
   (both in-zone and out-of-zone hostnames). Mode ``local`` only
   checks SRV records which refer to in-zone hostnames.

-   Mode ``full`` checks that a zone that has A or AAAA records it is served
-   by a server with the same type of address records.
-
   Mode ``full`` checks that delegation NS records refer to A or AAAA
   records (both in-zone and out-of-zone hostnames). It also checks that
   glue address records in the zone match those advertised by the child.
-
   Mode ``local`` only checks NS records which refer to in-zone
   hostnames or verifies that some required glue exists, i.e., when the
   name server is in a child zone.
@@ -170,12 +166,6 @@ Options
   semantically equal in plain DNS. Possible modes are ``fail``,
   ``warn`` (the default), and ``ignore``.

-.. option:: -R mode
-
-   This option checks whether a TXT wildcard record exists that
-   matches the name format for RFC 9567 error-reporting queries: ``*._er``.
-   Possible modes are ``fail`` and ``ignore`` (the default).
-
 .. option:: -s style

   This option specifies the style of the dumped zone file. Possible styles are
@@ -23,23 +23,17 @@ named-compilezone - zone file converting tool
 Synopsis
 ~~~~~~~~

-:program:`named-compilezone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-C** mode] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-r** mode] [**-R** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {**-o** filename} {zonename} {filename}
+:program:`named-compilezone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-C** mode] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-r** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {**-o** filename} {zonename} {filename}

 Description
 ~~~~~~~~~~~

 :program:`named-compilezone` checks the syntax and integrity of a zone file,
 and dumps the zone contents to a specified file in a specified format.
-
-Unlike :program:`named-checkzone`, zone contents are not strictly checked
-by default. If the output is to be used as an actual zone file to be loaded
-by :iscman:`named`, then the check levels should be manually configured to
-be at least as strict as those specified in the :iscman:`named` configuration
-file.
-
-Running :program:`named-checkzone` on the input prior to compiling will
-ensure that the zone compiles with the default requirements of
-:iscman:`named`.
+It applies strict check levels by default, since the
+dump output is used as an actual zone file loaded by :iscman:`named`.
+When manually specified otherwise, the check levels must at least be as
+strict as those specified in the :iscman:`named` configuration file.

 Options
 ~~~~~~~
@@ -83,13 +77,13 @@ Options

   ``check-svcb:fail`` turns on additional checks on ``_dns`` SVCB
   records and ``check-svcb:ignore`` disables these checks.  The
-   default is ``check-svcb:ignore``.
+   default is ``check-svcb:fail``.

 .. option:: -i mode

   This option performs post-load zone integrity checks. Possible modes are
-   ``full``, ``full-sibling``, ``local``,
-   ``local-sibling``, and ``none`` (the default).
+   ``full`` (the default), ``full-sibling``, ``local``,
+   ``local-sibling``, and ``none``.

   Mode ``full`` checks that MX records refer to A or AAAA records
   (both in-zone and out-of-zone hostnames). Mode ``local`` only
@@ -133,7 +127,7 @@ Options
 .. option:: -k mode

   This option performs ``check-names`` checks with the specified failure mode.
-   Possible modes are ``fail``, ``warn``, and ``ignore`` (the default).
+   Possible modes are ``fail`` (the default), ``warn``, and ``ignore``.

 .. option:: -l ttl

@@ -150,19 +144,19 @@ Options
 .. option:: -m mode

   This option specifies whether MX records should be checked to see if they are
-   addresses. Possible modes are ``fail``, ``warn``, and
-   ``ignore`` (the default).
+   addresses. Possible modes are ``fail``, ``warn`` (the default), and
+   ``ignore``.

 .. option:: -M mode

   This option checks whether a MX record refers to a CNAME. Possible modes are
-   ``fail``, ``warn``, and ``ignore`` (the default).
+   ``fail``, ``warn`` (the default), and ``ignore``.

 .. option:: -n mode

   This option specifies whether NS records should be checked to see if they are
-   addresses. Possible modes are ``fail``, ``warn``,  and
-   ``ignore`` (the default).
+   addresses. Possible modes are ``fail`` (the default), ``warn``,  and
+   ``ignore``.

 .. option:: -o filename

@@ -173,13 +167,7 @@ Options

   This option checks for records that are treated as different by DNSSEC but are
   semantically equal in plain DNS. Possible modes are ``fail``,
-   ``warn``, and ``ignore`` (the default).
-
-.. option:: -R mode
-
-   This option checks whether a TXT wildcard record exists that
-   matches the name format for RFC 9567 error-reporting queries: ``*._er``.
-   Possible modes are ``fail`` and ``ignore`` (the default).
+   ``warn`` (the default), and ``ignore``.

 .. option:: -s style

@@ -192,7 +180,7 @@ Options
 .. option:: -S mode

   This option checks whether an SRV record refers to a CNAME. Possible modes are
-   ``fail``, ``warn``, and ``ignore`` (the default).
+   ``fail``, ``warn`` (the default), and ``ignore``.

 .. option:: -t directory

@@ -204,7 +192,7 @@ Options

   This option checks whether Sender Policy Framework (SPF) records exist and issues a
   warning if an SPF-formatted TXT record is not also present. Possible
-   modes are ``warn`` and ``ignore`` (the default).
+   modes are ``warn`` (the default) and ``ignore``.

 .. option:: -w directory

@@ -222,7 +210,7 @@ Options
   This option specifies whether to check for non-terminal wildcards. Non-terminal
   wildcards are almost always the result of a failure to understand the
   wildcard matching algorithm (:rfc:`4592`). Possible modes are ``warn``
-   and ``ignore`` (the default).
+   (the default) and ``ignore``.

 .. option:: zonename

@@ -17,6 +17,10 @@

 #include <stdio.h>

+#include <isc/lang.h>
+
+ISC_LANG_BEGINDECLS
+
 int
 set_user(FILE *fd, const char *user);
 /*%<
@@ -25,3 +29,5 @@ set_user(FILE *fd, const char *user);
 *   0 		success
 *   -1 	insufficient permissions, or 'user' does not exist.
 */
+
+ISC_LANG_ENDDECLS
@@ -44,24 +44,24 @@ alg_fromtext(const char *name) {
 	}

 	if (strcasecmp(p, "md5") == 0) {
-		return DST_ALG_HMACMD5;
+		return (DST_ALG_HMACMD5);
 	}
 	if (strcasecmp(p, "sha1") == 0) {
-		return DST_ALG_HMACSHA1;
+		return (DST_ALG_HMACSHA1);
 	}
 	if (strcasecmp(p, "sha224") == 0) {
-		return DST_ALG_HMACSHA224;
+		return (DST_ALG_HMACSHA224);
 	}
 	if (strcasecmp(p, "sha256") == 0) {
-		return DST_ALG_HMACSHA256;
+		return (DST_ALG_HMACSHA256);
 	}
 	if (strcasecmp(p, "sha384") == 0) {
-		return DST_ALG_HMACSHA384;
+		return (DST_ALG_HMACSHA384);
 	}
 	if (strcasecmp(p, "sha512") == 0) {
-		return DST_ALG_HMACSHA512;
+		return (DST_ALG_HMACSHA512);
 	}
-	return DST_ALG_UNKNOWN;
+	return (DST_ALG_UNKNOWN);
 }

 /*%
@@ -71,19 +71,19 @@ int
 alg_bits(dns_secalg_t alg) {
 	switch (alg) {
 	case DST_ALG_HMACMD5:
-		return 128;
+		return (128);
 	case DST_ALG_HMACSHA1:
-		return 160;
+		return (160);
 	case DST_ALG_HMACSHA224:
-		return 224;
+		return (224);
 	case DST_ALG_HMACSHA256:
-		return 256;
+		return (256);
 	case DST_ALG_HMACSHA384:
-		return 384;
+		return (384);
 	case DST_ALG_HMACSHA512:
-		return 512;
+		return (512);
 	default:
-		return 0;
+		return (0);
 	}
 }

@@ -120,9 +120,11 @@ generate_key(isc_mem_t *mctx, dns_secalg_t alg, int keysize,
 		fatal("unsupported algorithm %d\n", alg);
 	}

+	DO("initialize dst library", dst_lib_init(mctx, NULL));
+
 	DO("generate key",
 	   dst_key_generate(dns_rootname, alg, keysize, 0, 0, DNS_KEYPROTO_ANY,
-			    dns_rdataclass_in, NULL, mctx, &key, NULL));
+			    dns_rdataclass_in, mctx, &key, NULL));

 	isc_buffer_init(&key_rawbuffer, &key_rawsecret, sizeof(key_rawsecret));

@@ -130,12 +132,14 @@ generate_key(isc_mem_t *mctx, dns_secalg_t alg, int keysize,

 	isc_buffer_usedregion(&key_rawbuffer, &key_rawregion);

-	DO("base64 encode secret",
+	DO("bsse64 encode secret",
 	   isc_base64_totext(&key_rawregion, -1, "", key_txtbuffer));

 	if (key != NULL) {
 		dst_key_free(&key);
 	}
+
+	dst_lib_destroy();
 }

 /*%
@@ -16,10 +16,13 @@
 /*! \file */

 #include <isc/buffer.h>
+#include <isc/lang.h>
 #include <isc/mem.h>

 #include <dns/secalg.h>

+ISC_LANG_BEGINDECLS
+
 void
 generate_key(isc_mem_t *mctx, dns_secalg_t alg, int keysize,
 	     isc_buffer_t *key_txtbuffer);
@@ -34,3 +37,5 @@ dns_secalg_t
 alg_fromtext(const char *name);
 int
 alg_bits(dns_secalg_t alg);
+
+ISC_LANG_ENDDECLS
@@ -30,7 +30,7 @@ set_user(FILE *fd, const char *user) {
 	pw = getpwnam(user);
 	if (pw == NULL) {
 		errno = EINVAL;
-		return -1;
+		return (-1);
 	}
-	return fchown(fileno(fd), pw->pw_uid, -1);
+	return (fchown(fileno(fd), pw->pw_uid, -1));
 }
@@ -32,7 +32,6 @@
 #include <isc/buffer.h>
 #include <isc/commandline.h>
 #include <isc/file.h>
-#include <isc/lib.h>
 #include <isc/mem.h>
 #include <isc/net.h>
 #include <isc/result.h>
@@ -41,7 +40,6 @@
 #include <isc/util.h>

 #include <dns/keyvalues.h>
-#include <dns/lib.h>
 #include <dns/name.h>

 #include <dst/dst.h>
@@ -62,7 +60,7 @@ bool verbose = false;

 const char *keyfile, *keydef;

-ISC_NORETURN static void
+noreturn static void
 usage(int status);

 static void
@@ -148,8 +146,7 @@ main(int argc, char **argv) {
 			keyfile = isc_commandline_argument;
 			break;
 		case 'h':
-			usage(EXIT_SUCCESS);
-			break;
+			usage(0);
 		case 'k':
 		case 'y': /* Compatible with rndc -y. */
 			keyname = isc_commandline_argument;
@@ -195,15 +192,15 @@ main(int argc, char **argv) {
 			if (isc_commandline_option != '?') {
 				fprintf(stderr, "%s: invalid argument -%c\n",
 					program, isc_commandline_option);
-				usage(EXIT_FAILURE);
+				usage(1);
 			} else {
-				usage(EXIT_SUCCESS);
+				usage(0);
 			}
 			break;
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n", program,
 				isc_commandline_option);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}

@@ -212,7 +209,7 @@ main(int argc, char **argv) {
 	POST(argv);

 	if (argc > 0) {
-		usage(EXIT_FAILURE);
+		usage(1);
 	}

 	if (alg == DST_ALG_HMACMD5) {
@@ -290,7 +287,7 @@ options {\n\
 		isc_mem_stats(mctx, stderr);
 	}

-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);

-	return 0;
+	return (0);
 }
@@ -28,7 +28,6 @@
 #include <isc/buffer.h>
 #include <isc/commandline.h>
 #include <isc/file.h>
-#include <isc/lib.h>
 #include <isc/mem.h>
 #include <isc/net.h>
 #include <isc/result.h>
@@ -37,7 +36,6 @@
 #include <isc/util.h>

 #include <dns/keyvalues.h>
-#include <dns/lib.h>
 #include <dns/name.h>

 #include <dst/dst.h>
@@ -55,7 +53,7 @@ const char *progname;
 static enum { progmode_keygen, progmode_confgen } progmode;
 bool verbose = false; /* needed by util.c but not used here */

-ISC_NORETURN static void
+noreturn static void
 usage(int status);

 static void
@@ -140,13 +138,13 @@ main(int argc, char **argv) {
 			keysize = alg_bits(alg);
 			break;
 		case 'h':
-			usage(EXIT_SUCCESS);
+			usage(0);
 		case 'k':
 		case 'y':
 			if (progmode == progmode_confgen) {
 				keyname = isc_commandline_argument;
 			} else {
-				usage(EXIT_FAILURE);
+				usage(1);
 			}
 			break;
 		case 'M':
@@ -159,7 +157,7 @@ main(int argc, char **argv) {
 			if (progmode == progmode_confgen) {
 				quiet = true;
 			} else {
-				usage(EXIT_FAILURE);
+				usage(1);
 			}
 			break;
 		case 'r':
@@ -169,29 +167,29 @@ main(int argc, char **argv) {
 			if (progmode == progmode_confgen) {
 				self_domain = isc_commandline_argument;
 			} else {
-				usage(EXIT_FAILURE);
+				usage(1);
 			}
 			break;
 		case 'z':
 			if (progmode == progmode_confgen) {
 				zone = isc_commandline_argument;
 			} else {
-				usage(EXIT_FAILURE);
+				usage(1);
 			}
 			break;
 		case '?':
 			if (isc_commandline_option != '?') {
 				fprintf(stderr, "%s: invalid argument -%c\n",
 					program, isc_commandline_option);
-				usage(EXIT_FAILURE);
+				usage(1);
 			} else {
-				usage(EXIT_SUCCESS);
+				usage(0);
 			}
 			break;
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n", program,
 				isc_commandline_option);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}

@@ -202,11 +200,11 @@ main(int argc, char **argv) {
 	POST(argv);

 	if (self_domain != NULL && zone != NULL) {
-		usage(EXIT_FAILURE); /* -s and -z cannot coexist */
+		usage(1); /* -s and -z cannot coexist */
 	}

 	if (argc > isc_commandline_index) {
-		usage(EXIT_FAILURE);
+		usage(1);
 	}

 	/* Use canonical algorithm name */
@@ -296,7 +294,7 @@ nsupdate -k <keyfile>\n");
 		isc_mem_stats(mctx, stderr);
 	}

-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);

-	return 0;
+	return (0);
 }
@@ -27,10 +27,9 @@ Synopsis
 Description
 ~~~~~~~~~~~

-:program:`tsig-keygen` is an utility that generates keys for use with TSIG
-(Transaction Signatures) as defined in :rfc:`2845`. The resulting keys can be used,
-for example, to secure dynamic DNS updates to a zone, or for the :iscman:`rndc`
-command channel.
+:program:`tsig-keygen` is an utility that generates keys for use in TSIG signing.
+The resulting keys can be used, for example, to secure dynamic DNS updates
+to a zone, or for the :iscman:`rndc` command channel.

 A domain name can be specified on the command line to be used as the name
 of the generated key. If no name is specified, the default is ``tsig-key``.
@@ -13,16 +13,14 @@

 /*! \file */

+#include "util.h"
 #include <stdarg.h>
 #include <stdbool.h>
 #include <stdio.h>
 #include <stdlib.h>
-#include <unistd.h>

 #include <isc/tls.h>

-#include "util.h"
-
 extern bool verbose;
 extern const char *progname;

@@ -47,5 +45,6 @@ fatal(const char *format, ...) {
 	vfprintf(stderr, format, args);
 	va_end(args);
 	fprintf(stderr, "\n");
-	_exit(EXIT_FAILURE);
+	isc__tls_setfatalmode();
+	exit(1);
 }
@@ -17,6 +17,7 @@

 #include <isc/attributes.h>
 #include <isc/formatcheck.h>
+#include <isc/lang.h>

 #define NS_CONTROL_PORT 953

@@ -30,8 +31,12 @@
 			notify("%s", name);                               \
 	} while (0)

+ISC_LANG_BEGINDECLS
+
 void
 notify(const char *fmt, ...) ISC_FORMAT_PRINTF(1, 2);

-ISC_NORETURN void
+noreturn void
 fatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
+
+ISC_LANG_ENDDECLS
@@ -5,8 +5,7 @@ AM_CPPFLAGS +=				\
 	$(LIBISC_CFLAGS)		\
 	$(LIBDNS_CFLAGS)		\
 	$(LIBNS_CFLAGS)			\
-	$(LIBISCCFG_CFLAGS)		\
-	$(OPENSSL_CFLAGS)
+	$(LIBISCCFG_CFLAGS)

 AM_CPPFLAGS +=				\
 	-DSYSCONFDIR=\"${sysconfdir}\"
@@ -20,5 +19,4 @@ delv_LDADD =				\
 	$(LIBISC_LIBS)			\
 	$(LIBDNS_LIBS)			\
 	$(LIBNS_LIBS)			\
-	$(LIBISCCFG_LIBS)		\
-	$(OPENSSL_LIBS)
+	$(LIBISCCFG_LIBS)
@@ -25,15 +25,11 @@
 #include <sys/types.h>
 #include <unistd.h>

-#include <openssl/opensslv.h>
-
 #include <isc/async.h>
 #include <isc/attributes.h>
 #include <isc/base64.h>
 #include <isc/buffer.h>
-#include <isc/crypto.h>
 #include <isc/hex.h>
-#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/managers.h>
 #include <isc/md.h>
@@ -56,7 +52,7 @@
 #include <dns/fixedname.h>
 #include <dns/keytable.h>
 #include <dns/keyvalues.h>
-#include <dns/lib.h>
+#include <dns/log.h>
 #include <dns/masterdump.h>
 #include <dns/message.h>
 #include <dns/name.h>
@@ -74,6 +70,7 @@

 #include <dst/dst.h>

+#include <isccfg/log.h>
 #include <isccfg/namedconf.h>

 #include <ns/client.h>
@@ -91,13 +88,10 @@

 #define MAXNAME (DNS_NAME_MAXTEXT + 1)

-#define MAX_QUERIES  50
-#define MAX_TOTAL    200
-#define MAX_RESTARTS 11
-
 /* Variables used internally by delv. */
 char *progname = NULL;
 static isc_mem_t *mctx = NULL;
+static isc_log_t *lctx = NULL;
 static dns_view_t *view = NULL;
 static ns_server_t *sctx = NULL;
 static ns_interface_t *ifp = NULL;
@@ -136,10 +130,6 @@ static bool showcomments = true, showdnssec = true, showtrust = true,
 	    multiline = false, short_form = false, print_unknown_format = false,
 	    yaml = false, fulltrace = false;

-static uint32_t maxqueries = MAX_QUERIES;
-static uint32_t maxtotal = MAX_TOTAL;
-static uint32_t restarts = MAX_RESTARTS;
-
 static bool resolve_trace = false, validator_trace = false,
 	    message_trace = false, send_trace = false;

@@ -222,6 +212,7 @@ usage(void) {
 		"                 +[no]crypto         (Control display of "
 		"cryptographic\n"
 		"                                      fields in records)\n"
+		"                 +[no]dlv            (Obsolete)\n"
 		"                 +[no]dnssec         (Display DNSSEC "
 		"records)\n"
 		"                 +[no]mtrace         (Trace messages "
@@ -256,10 +247,10 @@ usage(void) {
 		"process)\n"
 		"                 +[no]yaml           (Present the results as "
 		"YAML)\n");
-	exit(EXIT_FAILURE);
+	exit(1);
 }

-ISC_NORETURN static void
+noreturn static void
 fatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);

 static void
@@ -272,7 +263,8 @@ fatal(const char *format, ...) {
 	vfprintf(stderr, format, args);
 	va_end(args);
 	fprintf(stderr, "\n");
-	_exit(EXIT_FAILURE);
+	isc__tls_setfatalmode();
+	exit(1);
 }

 static void
@@ -290,6 +282,12 @@ warn(const char *format, ...) {
 	fprintf(stderr, "\n");
 }

+static isc_logcategory_t categories[] = { { "delv", 0 }, { NULL, 0 } };
+#define LOGCATEGORY_DEFAULT (&categories[0])
+#define LOGMODULE_DEFAULT   (&modules[0])
+
+static isc_logmodule_t modules[] = { { "delv", 0 }, { NULL, 0 } };
+
 static void
 delv_log(int level, const char *fmt, ...) ISC_FORMAT_PRINTF(2, 3);

@@ -298,15 +296,15 @@ delv_log(int level, const char *fmt, ...) {
 	va_list ap;
 	char msgbuf[2048];

-	if (!isc_log_wouldlog(level)) {
+	if (!isc_log_wouldlog(lctx, level)) {
 		return;
 	}

 	va_start(ap, fmt);

 	vsnprintf(msgbuf, sizeof(msgbuf), fmt, ap);
-	isc_log_write(DELV_LOGCATEGORY_DEFAULT, DELV_LOGMODULE_DEFAULT, level,
-		      "%s", msgbuf);
+	isc_log_write(lctx, LOGCATEGORY_DEFAULT, LOGMODULE_DEFAULT, level, "%s",
+		      msgbuf);
 	va_end(ap);
 }

@@ -314,45 +312,76 @@ static int loglevel = 0;

 static void
 setup_logging(FILE *errout) {
+	isc_result_t result;
+	isc_logdestination_t destination;
+	isc_logconfig_t *logconfig = NULL;
 	int packetlevel = 10;

-	isc_log_setdebuglevel(loglevel);
+	isc_log_create(mctx, &lctx, &logconfig);
+	isc_log_registercategories(lctx, categories);
+	isc_log_registermodules(lctx, modules);
+	isc_log_setcontext(lctx);
+	dns_log_init(lctx);
+	dns_log_setcontext(lctx);
+	cfg_log_init(lctx);

-	isc_logconfig_t *logconfig = isc_logconfig_get();
+	destination.file.stream = errout;
+	destination.file.name = NULL;
+	destination.file.versions = ISC_LOG_ROLLNEVER;
+	destination.file.maximum_size = 0;
+	isc_log_createchannel(logconfig, "stderr", ISC_LOG_TOFILEDESC,
+			      ISC_LOG_DYNAMIC, &destination,
+			      ISC_LOG_PRINTPREFIX);

+	isc_log_setdebuglevel(lctx, loglevel);
 	isc_log_settag(logconfig, ";; ");

-	isc_log_createandusechannel(
-		logconfig, "default_stderr", ISC_LOG_TOFILEDESC,
-		ISC_LOG_DYNAMIC, ISC_LOGDESTINATION_FILE(errout),
-		ISC_LOG_PRINTPREFIX, ISC_LOGCATEGORY_DEFAULT,
-		ISC_LOGMODULE_DEFAULT);
+	result = isc_log_usechannel(logconfig, "stderr",
+				    ISC_LOGCATEGORY_DEFAULT, NULL);
+	if (result != ISC_R_SUCCESS) {
+		fatal("Couldn't attach to log channel 'stderr'");
+	}

 	if (resolve_trace && loglevel < 1) {
-		isc_log_createandusechannel(
-			logconfig, "resolver", ISC_LOG_TOFILEDESC,
-			ISC_LOG_DEBUG(1), ISC_LOGDESTINATION_FILE(errout),
-			ISC_LOG_PRINTPREFIX, DNS_LOGCATEGORY_RESOLVER,
-			DNS_LOGMODULE_RESOLVER);
+		isc_log_createchannel(logconfig, "resolver", ISC_LOG_TOFILEDESC,
+				      ISC_LOG_DEBUG(1), &destination,
+				      ISC_LOG_PRINTPREFIX);
+
+		result = isc_log_usechannel(logconfig, "resolver",
+					    DNS_LOGCATEGORY_RESOLVER,
+					    DNS_LOGMODULE_RESOLVER);
+		if (result != ISC_R_SUCCESS) {
+			fatal("Couldn't attach to log channel 'resolver'");
+		}
 	}

 	if (validator_trace && loglevel < 3) {
-		isc_log_createandusechannel(
-			logconfig, "validator", ISC_LOG_TOFILEDESC,
-			ISC_LOG_DEBUG(3), ISC_LOGDESTINATION_FILE(errout),
-			ISC_LOG_PRINTPREFIX, DNS_LOGCATEGORY_DNSSEC,
-			DNS_LOGMODULE_VALIDATOR);
+		isc_log_createchannel(logconfig, "validator",
+				      ISC_LOG_TOFILEDESC, ISC_LOG_DEBUG(3),
+				      &destination, ISC_LOG_PRINTPREFIX);
+
+		result = isc_log_usechannel(logconfig, "validator",
+					    DNS_LOGCATEGORY_DNSSEC,
+					    DNS_LOGMODULE_VALIDATOR);
+		if (result != ISC_R_SUCCESS) {
+			fatal("Couldn't attach to log channel 'validator'");
+		}
 	}

 	if (send_trace) {
 		packetlevel = 11;
 	}
 	if ((message_trace || send_trace) && loglevel < packetlevel) {
-		isc_log_createandusechannel(
-			logconfig, "messages", ISC_LOG_TOFILEDESC,
-			ISC_LOG_DEBUG(packetlevel),
-			ISC_LOGDESTINATION_FILE(errout), ISC_LOG_PRINTPREFIX,
-			DNS_LOGCATEGORY_RESOLVER, DNS_LOGMODULE_PACKETS);
+		isc_log_createchannel(logconfig, "messages", ISC_LOG_TOFILEDESC,
+				      ISC_LOG_DEBUG(packetlevel), &destination,
+				      ISC_LOG_PRINTPREFIX);
+
+		result = isc_log_usechannel(logconfig, "messages",
+					    DNS_LOGCATEGORY_RESOLVER,
+					    DNS_LOGMODULE_PACKETS);
+		if (result != ISC_R_SUCCESS) {
+			fatal("Couldn't attach to log channel 'messagse'");
+		}
 	}
 }

@@ -572,7 +601,7 @@ setup_style(void) {
 						48, 80, 8, splitwidth, mctx);
 	}

-	return result;
+	return (result);
 }

 static isc_result_t
@@ -589,15 +618,15 @@ convert_name(dns_fixedname_t *fn, dns_name_t **name, const char *text) {
 	isc_buffer_add(&b, len);
 	n = dns_fixedname_initname(fn);

-	result = dns_name_fromtext(n, &b, dns_rootname, 0);
+	result = dns_name_fromtext(n, &b, dns_rootname, 0, NULL);
 	if (result != ISC_R_SUCCESS) {
 		delv_log(ISC_LOG_ERROR, "failed to convert name %s: %s", text,
 			 isc_result_totext(result));
-		return result;
+		return (result);
 	}

 	*name = n;
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
@@ -630,7 +659,7 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client, dns_view_t *toview) {
 	CHECK(convert_name(&fkeyname, &keyname, keynamestr));

 	if (!root_validation) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	if (anchor_name) {
@@ -638,11 +667,11 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client, dns_view_t *toview) {
 	}

 	if (!match_root) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	if (!root_validation) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	delv_log(ISC_LOG_DEBUG(3), "adding trust anchor %s", trust_anchor);
@@ -661,7 +690,7 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client, dns_view_t *toview) {
 	if (cfg_obj_isvoid(obj)) {
 		/*
 		 * "anchortype" is not defined, this must be a static-key
-		 * configured with trust-anchors.
+		 * configured with trusted-keys.
 		 */
 		anchortype = STATIC_KEY;
 	} else {
@@ -781,19 +810,21 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client, dns_view_t *toview) {
 	num_keys++;

 cleanup:
-	if (result == DST_R_UNSUPPORTEDALG) {
-		cfg_obj_log(key, ISC_LOG_WARNING,
+	if (result == DST_R_NOCRYPTO) {
+		cfg_obj_log(key, lctx, ISC_LOG_ERROR, "no crypto support");
+	} else if (result == DST_R_UNSUPPORTEDALG) {
+		cfg_obj_log(key, lctx, ISC_LOG_WARNING,
 			    "skipping trusted key '%s': %s", keynamestr,
 			    isc_result_totext(result));
 		result = ISC_R_SUCCESS;
 	} else if (result != ISC_R_SUCCESS) {
-		cfg_obj_log(key, ISC_LOG_ERROR,
+		cfg_obj_log(key, lctx, ISC_LOG_ERROR,
 			    "failed to add trusted key '%s': %s", keynamestr,
 			    isc_result_totext(result));
 		result = ISC_R_FAILURE;
 	}

-	return result;
+	return (result);
 }

 static isc_result_t
@@ -815,18 +846,23 @@ load_keys(const cfg_obj_t *keys, dns_client_t *client, dns_view_t *toview) {
 	}

 cleanup:
-	return result;
+	if (result == DST_R_NOCRYPTO) {
+		result = ISC_R_SUCCESS;
+	}
+	return (result);
 }

 static isc_result_t
 setup_dnsseckeys(dns_client_t *client, dns_view_t *toview) {
 	isc_result_t result;
 	cfg_parser_t *parser = NULL;
+	const cfg_obj_t *trusted_keys = NULL;
+	const cfg_obj_t *managed_keys = NULL;
 	const cfg_obj_t *trust_anchors = NULL;
 	cfg_obj_t *bindkeys = NULL;

 	if (!root_validation) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	if (trust_anchor == NULL) {
@@ -837,7 +873,7 @@ setup_dnsseckeys(dns_client_t *client, dns_view_t *toview) {
 		CHECK(convert_name(&afn, &anchor_name, trust_anchor));
 	}

-	CHECK(cfg_parser_create(mctx, &parser));
+	CHECK(cfg_parser_create(mctx, dns_lctx, &parser));

 	if (anchorfile != NULL) {
 		if (access(anchorfile, R_OK) != 0) {
@@ -863,7 +899,16 @@ setup_dnsseckeys(dns_client_t *client, dns_view_t *toview) {
 	}

 	INSIST(bindkeys != NULL);
+	cfg_map_get(bindkeys, "trusted-keys", &trusted_keys);
+	cfg_map_get(bindkeys, "managed-keys", &managed_keys);
 	cfg_map_get(bindkeys, "trust-anchors", &trust_anchors);
+
+	if (trusted_keys != NULL) {
+		CHECK(load_keys(trusted_keys, client, toview));
+	}
+	if (managed_keys != NULL) {
+		CHECK(load_keys(managed_keys, client, toview));
+	}
 	if (trust_anchors != NULL) {
 		CHECK(load_keys(trust_anchors, client, toview));
 	}
@@ -884,7 +929,7 @@ cleanup:
 		delv_log(ISC_LOG_ERROR, "setup_dnsseckeys: %s",
 			 isc_result_totext(result));
 	}
-	return result;
+	return (result);
 }

 static isc_result_t
@@ -931,7 +976,7 @@ addserver(dns_client_t *client) {
 		if (gaierror != 0) {
 			delv_log(ISC_LOG_ERROR, "getaddrinfo failed: %s",
 				 gai_strerror(gaierror));
-			return ISC_R_FAILURE;
+			return (ISC_R_FAILURE);
 		}

 		result = ISC_R_SUCCESS;
@@ -967,7 +1012,7 @@ cleanup:
 			 isc_result_totext(result));
 	}

-	return result;
+	return (result);
 }

 static isc_result_t
@@ -1036,7 +1081,7 @@ cleanup:
 	if (resconf != NULL) {
 		irs_resconf_destroy(&resconf);
 	}
-	return result;
+	return (result);
 }

 static isc_result_t
@@ -1049,10 +1094,10 @@ parse_uint(uint32_t *uip, const char *value, uint32_t max, const char *desc) {
 	if (result != ISC_R_SUCCESS) {
 		printf("invalid %s '%s': %s\n", desc, value,
 		       isc_result_totext(result));
-		return result;
+		return (result);
 	}
 	*uip = n;
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static void
@@ -1113,6 +1158,14 @@ plus_option(char *option) {
 		break;
 	case 'd':
 		switch (cmd[1]) {
+		case 'l': /* dlv */
+			FULLCHECK("dlv");
+			if (state) {
+				fprintf(stderr, "Invalid option: "
+						"+dlv is obsolete\n");
+				exit(1);
+			}
+			break;
 		case 'n': /* dnssec */
 			FULLCHECK("dnssec");
 			showdnssec = state;
@@ -1139,47 +1192,6 @@ plus_option(char *option) {
 		break;
 	case 'm':
 		switch (cmd[1]) {
-		case 'a':
-			switch (cmd[3]) {
-			case 'q': /* maxqueries */
-				FULLCHECK("maxqueries");
-				if (value == NULL) {
-					goto need_value;
-				}
-				if (!state) {
-					goto invalid_option;
-				}
-				result = parse_uint(&maxqueries, value,
-						    UINT_MAX, "maxqueries");
-				if (result != ISC_R_SUCCESS) {
-					fatal("Couldn't parse maxqueries");
-				}
-				if (maxqueries == 0) {
-					fatal("maxqueries must be nonzero");
-				}
-				break;
-			case 't': /* maxtotalqueries */
-				FULLCHECK("maxtotalqueries");
-				if (value == NULL) {
-					goto need_value;
-				}
-				if (!state) {
-					goto invalid_option;
-				}
-				result = parse_uint(&maxtotal, value, UINT_MAX,
-						    "maxtotalqueries");
-				if (result != ISC_R_SUCCESS) {
-					fatal("Couldn't parse maxtotalqueries");
-				}
-				if (maxtotal == 0) {
-					fatal("maxtotalqueries must be "
-					      "nonzero");
-				}
-				break;
-			default:
-				goto invalid_option;
-			}
-			break;
 		case 't': /* mtrace */
 			FULLCHECK("mtrace");
 			message_trace = state;
@@ -1232,22 +1244,6 @@ plus_option(char *option) {
 		break;
 	case 'r':
 		switch (cmd[1]) {
-		case 'e': /* restarts */
-			FULLCHECK("restarts");
-			if (value == NULL) {
-				goto need_value;
-			}
-			if (!state) {
-				goto invalid_option;
-			}
-			result = parse_uint(&restarts, value, 255, "restarts");
-			if (result != ISC_R_SUCCESS) {
-				fatal("Couldn't parse restarts");
-			}
-			if (restarts == 0) {
-				fatal("restarts must be between 1..255");
-			}
-			break;
 		case 'o': /* root */
 			FULLCHECK("root");
 			if (state && no_sigs) {
@@ -1375,18 +1371,25 @@ plus_option(char *option) {
 		break;
 	default:
 	invalid_option:
-	need_value:
+		/*
+		 * We can also add a "need_value:" case here if we ever
+		 * add a plus-option that requires a specified value
+		 */
 		fprintf(stderr, "Invalid option: +%s\n", option);
 		usage();
 	}
+
+	if (qmin && !fulltrace) {
+		fatal("'+qmin' cannot be used without '+ns'");
+	}
 	return;
 }

 /*
 * options: "46a:b:c:d:himp:q:t:vx:";
 */
-static const char *single_dash_opts = "46Fhimv";
-static const char *dash_opts = "46abcdFhimpqtvx";
+static const char *single_dash_opts = "46himv";
+static const char *dash_opts = "46abcdhimpqtvx";

 static bool
 dash_option(char *option, char *next, bool *open_type_class) {
@@ -1429,12 +1432,9 @@ dash_option(char *option, char *next, bool *open_type_class) {
 				use_ipv4 = false;
 			}
 			break;
-		case 'F': /* FIPS */
-			/* handled in preparse_args() */
-			break;
 		case 'h':
 			usage();
-			exit(EXIT_SUCCESS);
+			exit(0);
 		case 'i':
 			no_sigs = true;
 			root_validation = false;
@@ -1444,14 +1444,14 @@ dash_option(char *option, char *next, bool *open_type_class) {
 			break;
 		case 'v':
 			printf("delv %s\n", PACKAGE_VERSION);
-			exit(EXIT_SUCCESS);
+			exit(0);
 		default:
 			UNREACHABLE();
 		}
 		if (strlen(option) > 1U) {
 			option = &option[1];
 		} else {
-			return false;
+			return (false);
 		}
 	}
 	opt = option[0];
@@ -1468,7 +1468,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
 	switch (opt) {
 	case 'a':
 		anchorfile = isc_mem_strdup(mctx, value);
-		return value_from_next;
+		return (value_from_next);
 	case 'b':
 		hash = strchr(value, '#');
 		if (hash != NULL) {
@@ -1505,7 +1505,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
 		if (hash != NULL) {
 			*hash = '#';
 		}
-		return value_from_next;
+		return (value_from_next);
 	case 'c':
 		if (classset) {
 			warn("extra query class");
@@ -1523,28 +1523,28 @@ dash_option(char *option, char *next, bool *open_type_class) {
 		} else {
 			warn("ignoring invalid class");
 		}
-		return value_from_next;
+		return (value_from_next);
 	case 'd':
 		result = parse_uint(&num, value, 99, "debug level");
 		if (result != ISC_R_SUCCESS) {
 			fatal("Couldn't parse debug level");
 		}
 		loglevel = num;
-		return value_from_next;
+		return (value_from_next);
 	case 'p':
 		port = value;
 		result = parse_uint(&destport, port, 0xffff, "port");
 		if (result != ISC_R_SUCCESS) {
 			fatal("Couldn't parse port number");
 		}
-		return value_from_next;
+		return (value_from_next);
 	case 'q':
 		if (curqname != NULL) {
 			warn("extra query name");
 			isc_mem_free(mctx, curqname);
 		}
 		curqname = isc_mem_strdup(mctx, value);
-		return value_from_next;
+		return (value_from_next);
 	case 't':
 		*open_type_class = false;
 		tr.base = value;
@@ -1565,7 +1565,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
 		} else {
 			warn("ignoring invalid type");
 		}
-		return value_from_next;
+		return (value_from_next);
 	case 'x':
 		result = get_reverse(textname, sizeof(textname), value, false);
 		if (result == ISC_R_SUCCESS) {
@@ -1581,16 +1581,16 @@ dash_option(char *option, char *next, bool *open_type_class) {
 			typeset = true;
 		} else {
 			fprintf(stderr, "Invalid IP address %s\n", value);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
-		return value_from_next;
+		return (value_from_next);
 	invalid_option:
 	default:
 		fprintf(stderr, "Invalid option: -%s\n", option);
 		usage();
 	}
 	UNREACHABLE();
-	return false;
+	return (false);
 }

 /*
@@ -1610,11 +1610,6 @@ preparse_args(int argc, char **argv) {
 		option = &argv[0][1];
 		while (strpbrk(option, single_dash_opts) == &option[0]) {
 			switch (option[0]) {
-			case 'F':
-				if (isc_crypto_fips_enable() != ISC_R_SUCCESS) {
-					fatal("setting FIPS mode failed");
-				}
-				break;
 			case 'm':
 				isc_mem_debugging = ISC_MEM_DEBUGTRACE |
 						    ISC_MEM_DEBUGRECORD;
@@ -1735,11 +1730,6 @@ parse_args(int argc, char **argv) {
 		}
 	}

-	/* check consistency */
-	if (qmin && !fulltrace) {
-		fatal("'+qmin' cannot be used without '+ns'");
-	}
-
 	/*
 	 * If no qname or qtype specified, search for root/NS
 	 * If no qtype specified, use A
@@ -1762,11 +1752,11 @@ parse_args(int argc, char **argv) {
 static isc_result_t
 append_str(const char *text, int len, char **p, char *end) {
 	if (len > end - *p) {
-		return ISC_R_NOSPACE;
+		return (ISC_R_NOSPACE);
 	}
 	memmove(*p, text, len);
 	*p += len;
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
@@ -1777,17 +1767,17 @@ reverse_octets(const char *in, char **p, char *end) {
 		isc_result_t result;
 		result = reverse_octets(dot + 1, p, end);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 		result = append_str(".", 1, p, end);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 		len = (int)(dot - in);
 	} else {
 		len = strlen(in);
 	}
-	return append_str(in, len, p, end);
+	return (append_str(in, len, p, end));
 }

 static isc_result_t
@@ -1806,10 +1796,10 @@ get_reverse(char *reverse, size_t len, char *value, bool strict) {
 		name = dns_fixedname_initname(&fname);
 		result = dns_byaddr_createptrname(&addr, name);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 		dns_name_format(name, reverse, (unsigned int)len);
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	} else {
 		/*
 		 * Not a valid IPv6 address.  Assume IPv4.
@@ -1822,17 +1812,17 @@ get_reverse(char *reverse, size_t len, char *value, bool strict) {
 		char *p = reverse;
 		char *end = reverse + len;
 		if (strict && inet_pton(AF_INET, value, &addr.type.in) != 1) {
-			return DNS_R_BADDOTTEDQUAD;
+			return (DNS_R_BADDOTTEDQUAD);
 		}
 		result = reverse_octets(value, &p, end);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 		result = append_str(".in-addr.arpa.", 15, &p, end);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}
 }

@@ -1908,8 +1898,6 @@ run_resolve(void *arg) {
 	/* Create client */
 	CHECK(dns_client_create(mctx, loopmgr, netmgr, 0, tlsctx_client_cache,
 				&client, srcaddr4, srcaddr6));
-	dns_client_setmaxrestarts(client, restarts);
-	dns_client_setmaxqueries(client, maxtotal);

 	/* Set the nameserver */
 	if (server != NULL) {
@@ -2070,7 +2058,7 @@ accept_cb(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 	UNUSED(handle);
 	UNUSED(arg);

-	return result;
+	return (result);
 }

 static void
@@ -2114,14 +2102,9 @@ sendquery(void *arg) {
 				    &requestmgr));

 	dns_view_attach(view, &(dns_view_t *){ NULL });
-
-	uint32_t initial;
-	isc_nm_gettimeouts(netmgr, &initial, NULL, NULL, NULL);
-	const unsigned int connect_timeout = initial, timeout = initial;
-
 	CHECK(dns_request_create(requestmgr, message, NULL, &peer, NULL, NULL,
-				 DNS_REQUESTOPT_TCP, NULL, connect_timeout,
-				 timeout, 0, 0, isc_loop(), recvresponse,
+				 DNS_REQUESTOPT_TCP, NULL, 1, 0, 0,
+				 isc_loop_current(loopmgr), recvresponse,
 				 message, &request));
 	return;

@@ -2135,23 +2118,16 @@ cleanup:

 static isc_result_t
 matchview(isc_netaddr_t *srcaddr, isc_netaddr_t *destaddr,
-	  dns_message_t *message, dns_aclenv_t *env, ns_server_t *lsctx,
-	  isc_loop_t *loop, isc_job_cb cb, void *cbarg,
-	  isc_result_t *sigresultp, isc_result_t *viewpatchresultp,
+	  dns_message_t *message, dns_aclenv_t *env, isc_result_t *sigresultp,
 	  dns_view_t **viewp) {
 	UNUSED(srcaddr);
 	UNUSED(destaddr);
 	UNUSED(message);
 	UNUSED(env);
-	UNUSED(lsctx);
-	UNUSED(loop);
-	UNUSED(cb);
-	UNUSED(cbarg);
 	UNUSED(sigresultp);

 	*viewp = view;
-	*viewpatchresultp = ISC_R_SUCCESS;
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static void
@@ -2172,16 +2148,14 @@ run_server(void *arg) {
 	isc_sockaddr_any(&any);
 	CHECK(dns_dispatch_createudp(dispatchmgr, &any, &dispatch));
 	CHECK(ns_interfacemgr_create(mctx, sctx, loopmgr, netmgr, dispatchmgr,
-				     NULL, &interfacemgr));
+				     NULL, false, &interfacemgr));

-	dns_view_create(mctx, loopmgr, dispatchmgr, dns_rdataclass_in,
-			"_default", &view);
-	CHECK(dns_cache_create(loopmgr, dns_rdataclass_in, "", mctx, &cache));
+	CHECK(dns_view_create(mctx, dispatchmgr, dns_rdataclass_in, "_default",
+			      &view));
+	CHECK(dns_cache_create(loopmgr, dns_rdataclass_in, "", &cache));
 	dns_view_setcache(view, cache, false);
 	dns_cache_detach(&cache);
 	dns_view_setdstport(view, destport);
-	dns_view_setmaxrestarts(view, restarts);
-	dns_view_setmaxqueries(view, maxtotal);

 	CHECK(dns_rootns_create(mctx, dns_rdataclass_in, hintfile, &roothints));
 	dns_view_sethints(view, roothints);
@@ -2193,9 +2167,8 @@ run_server(void *arg) {
 	dns_view_initsecroots(view);
 	CHECK(setup_dnsseckeys(NULL, view));

-	CHECK(dns_view_createresolver(view, netmgr, 0, tlsctx_client_cache,
-				      dispatch, NULL));
-	dns_resolver_setmaxqueries(view->resolver, maxqueries);
+	CHECK(dns_view_createresolver(view, loopmgr, netmgr, 0,
+				      tlsctx_client_cache, dispatch, NULL));

 	isc_stats_create(mctx, &resstats, dns_resstatscounter_max);
 	dns_resolver_setstats(view->resolver, resstats);
@@ -2211,10 +2184,9 @@ run_server(void *arg) {

 	CHECK(isc_nm_listenstreamdns(netmgr, ISC_NM_LISTEN_ONE, &addr,
 				     ns_client_request, ifp, accept_cb, ifp, 10,
-				     NULL, NULL, ISC_NM_PROXY_NONE,
-				     &ifp->tcplistensocket));
+				     NULL, NULL, &ifp->tcplistensocket));
 	ifp->flags |= NS_INTERFACEFLAG_LISTENING;
-	isc_async_current(sendquery, ifp->tcplistensocket);
+	isc_async_current(loopmgr, sendquery, ifp->tcplistensocket);

 	return;

@@ -2241,6 +2213,11 @@ main(int argc, char *argv[]) {
 	isc_managers_create(&mctx, 1, &loopmgr, &netmgr);
 	loop = isc_loop_main(loopmgr);

+	result = dst_lib_init(mctx, NULL);
+	if (result != ISC_R_SUCCESS) {
+		fatal("dst_lib_init failed: %d", result);
+	}
+
 	parse_args(argc, argv);

 	CHECK(setup_style());
@@ -2282,7 +2259,10 @@ cleanup:
 		dns_master_styledestroy(&style, mctx);
 	}

+	isc_log_destroy(&lctx);
+	dst_lib_destroy();
+
 	isc_managers_destroy(&mctx, &loopmgr, &netmgr);

-	return 0;
+	return (0);
 }
@@ -21,7 +21,7 @@ delv - DNS lookup and validation utility
 Synopsis
 ~~~~~~~~

-:program:`delv` [@server] [ [**-4**] | [**-6**] ] [**-a** anchor-file] [**-b** address] [**-c** class] [**-d** level] [**-F**] [**-i**] [**-m**] [**-p** port#] [**-q** name] [**-t** type] [**-x** addr] [name] [type] [class] [queryopt...]
+:program:`delv` [@server] [ [**-4**] | [**-6**] ] [**-a** anchor-file] [**-b** address] [**-c** class] [**-d** level] [**-i**] [**-m**] [**-p** port#] [**-q** name] [**-t** type] [**-x** addr] [name] [type] [class] [queryopt...]

 :program:`delv` [**-h**]

@@ -138,10 +138,6 @@ Options
   :option:`+mtrace`, :option:`+rtrace`, and :option:`+vtrace` options below for
   additional debugging details.

-.. option:: -F
-
-   This option enables FIPS mode if supported by the cryptographic library in use.
-
 .. option:: -h

   This option displays the :program:`delv` help usage output and exits.
@@ -341,23 +337,6 @@ assign values to options like the timeout interval. They have the form
   they are replaced by the string ``[omitted]`` or, in the DNSKEY case, the
   key ID is displayed as the replacement, e.g. ``[ key id = value ]``.

-.. option:: +restarts
-
-   When name server mode (``delv +ns``) is in use, this option sets the
-   maximum number of CNAME queries to follow before terminating resolution.
-   This prevents ``delv`` from hanging in the event of a CNAME loop.
-   The default is 11.
-
-.. option:: +maxqueries
-
-   This option specifies the maximum number of queries to send to resolve
-   a name before giving up. The default is 50.
-
-.. option:: +maxtotalqueries
-
-   This option specifies the maximum number of queries to send to resolve
-   a client request before giving up. The default is 200.
-
 .. option:: +trust, +notrust

   This option controls whether to display the trust level when printing a record.
@@ -5,16 +5,13 @@ AM_CPPFLAGS +=			\
 	$(LIBDNS_CFLAGS)	\
 	$(LIBISCCFG_CFLAGS)	\
 	$(LIBIDN2_CFLAGS)	\
-	$(OPENSSL_CFLAGS)	\
-	$(LIBUV_CFLAGS)		\
-	$(OPENSSL_CFLAGS)
+	$(LIBUV_CFLAGS)

 LDADD +=			\
 	libdighost.la		\
 	$(LIBISC_LIBS)		\
 	$(LIBDNS_LIBS)		\
 	$(LIBISCCFG_LIBS)	\
-	$(OPENSSL_LIBS)		\
 	$(LIBIDN2_LIBS)

 noinst_LTLIBRARIES = libdighost.la
@@ -20,7 +20,7 @@ dig - DNS lookup utility

 Synopsis
 ~~~~~~~~
-:program:`dig` [@server] [**-b** address] [**-c** class] [**-f** filename] [**-F**] [**-k** filename] [**-m**] [**-p** port#] [**-q** name] [**-t** type] [**-v**] [**-x** addr] [**-y** [hmac:]name:key] [ [**-4**] | [**-6**] ] [name] [type] [class] [queryopt...]
+:program:`dig` [@server] [**-b** address] [**-c** class] [**-f** filename] [**-k** filename] [**-m**] [**-p** port#] [**-q** name] [**-t** type] [**-v**] [**-x** addr] [**-y** [hmac:]name:key] [ [**-4**] | [**-6**] ] [name] [type] [class] [queryopt...]

 :program:`dig` [**-h**]

@@ -126,10 +126,6 @@ Options
   same way it would be presented as a query to :program:`dig` using the
   command-line interface.

-.. option:: -F
-
-   This option enables FIPS mode if supported by the cryptographic library in use.
-
 .. option:: -h

   Print a usage summary.
@@ -511,44 +507,6 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
   mandatory. Responses to padded queries may also be padded, but only
   if the query uses TCP or DNS COOKIE.

-.. option:: +proxy[=src_addr[#src_port]-dst_addr[#dst_port]], +noproxy
-
-   When this option is set, :program:`dig` adds PROXYv2 headers to the
-   queries. When source and destination addresses are specified, the
-   headers contain them and use the ``PROXY`` command. It means for
-   the remote peer that the queries were sent on behalf of another
-   node and that the PROXYv2 header reflects the original connection
-   endpoints. The default source port is ``0`` and destination port is
-   `53`.
-
-   For encrypted DNS transports, to prevent accidental information
-   leakage, encryption is applied to the PROXYv2 headers: the headers
-   are sent right after the handshake process has been completed.
-
-   For plain DNS transports, no encryption is applied to the PROXYv2
-   headers.
-
-   If the addressees are omitted, PROXYv2 headers, that use the
-   ``LOCAL`` command set, are added instead. For the remote peer, that
-   means that the queries were sent on purpose without being relayed,
-   so the real connection endpoint addresses must be used.
-
-.. option:: +proxy-plain[=src_addr[#src_port]-dst_addr[#dst_port], +noproxy-plain
-
-   The same as ``+[no]proxy``, but instructs ``dig`` to send PROXYv2
-   headers ahead of any encryption, before any handshake messages are
-   sent. That makes :program:`dig` behave exactly how it is described
-   in the PROXY protocol specification, but not all software expects
-   such behaviour.
-
-   Please consult the software documentation to find out if you need
-   this option. (for example, ``dnsdist`` expects encrypted PROXYv2
-   headers sent over TLS when encryption is used, while ``HAProxy``
-   and many other software packages expect plain ones).
-
-   For plain DNS transports the option is effectively an alias for the
-   ``+[no]proxy`` described above.
-
 .. option:: +qid=value

   This option specifies the query ID to use when sending queries.
@@ -614,16 +572,15 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
   BADCOOKIE rcode before retrying the request or not. The default
   is to not show the messages.

-.. option:: +showbadvers, +noshowbadvers
-
-   This option toggles whether to show the message containing the
-   BADVERS rcode before retrying the request or not. The default
-   is to not show the messages.
-
 .. option:: +showsearch, +noshowsearch

   This option performs [or does not perform] a search showing intermediate results.

+.. option:: +sigchase, +nosigchase
+
+   This feature is now obsolete and has been removed; use :iscman:`delv`
+   instead.
+
 .. option:: +split=W

   This option splits long hex- or base64-formatted fields in resource records into
@@ -648,14 +605,6 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
   prefix-length of zero, which signals a resolver that the client's
   address information must *not* be used when resolving this query.

-.. option:: +svcparamkeycompat, +nosvcparamkeycompat
-
-   This option sets [or does not set] the backward-compatible representation of
-   the Service Parameter Keys (SvcParamKeys) for SVCB records, in which case
-   the keys, which were not defined initially in :rfc:`9460` are represented
-   in their opaque "keyN"-like format, where "N" is their numerical value. The
-   default is ``+nosvcparamkeycompat``.
-
 .. option:: +tcflag, +notcflag

   This option sets [or does not set] the TC (TrunCation) bit in the query. The default is
@@ -701,23 +650,25 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
   server TLS certificate verification. Otherwise, the DNS server name
   is used. This option has no effect if :option:`+tls-ca` is not specified.

+.. option:: +topdown, +notopdown
+
+   This feature is related to :option:`dig +sigchase`, which is obsolete and
+   has been removed. Use :iscman:`delv` instead.
+
 .. option:: +trace, +notrace

-   This option toggles tracing of the delegation path from the root name
-   servers for the name being looked up. Tracing is disabled by default.
-   When tracing is enabled, :program:`dig` makes iterative queries to
-   resolve the name being looked up. It follows referrals from the root
-   servers, showing the answer from each server that was used to resolve
-   the lookup.
+   This option toggles tracing of the delegation path from the root name servers for
+   the name being looked up. Tracing is disabled by default. When
+   tracing is enabled, :program:`dig` makes iterative queries to resolve the
+   name being looked up. It follows referrals from the root servers,
+   showing the answer from each server that was used to resolve the
+   lookup.

   If ``@server`` is also specified, it affects only the initial query for
   the root zone name servers.

-   :option:`+dnssec` is set when :option:`+trace` is set, to better
-   emulate the default queries from a name server.
-
-   Note that the ``delv +ns`` option can also be used for tracing the
-   resolution of a name from the root (see :iscman:`delv`).
+   :option:`+dnssec` is also set when :option:`+trace` is set, to better emulate the
+   default queries from a name server.

 .. option:: +tries=T

@@ -725,6 +676,11 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
   instead of the default, 3. If ``T`` is less than or equal to zero,
   the number of tries is silently rounded up to 1.

+.. option:: +trusted-key=####
+
+   This option formerly specified trusted keys for use with :option:`dig +sigchase`. This
+   feature is now obsolete and has been removed; use :iscman:`delv` instead.
+
 .. option:: +ttlid, +nottlid

   This option displays [or does not display] the TTL when printing the record.
@@ -21,6 +21,7 @@
 #include <isc/attributes.h>
 #include <isc/buffer.h>
 #include <isc/formatcheck.h>
+#include <isc/lang.h>
 #include <isc/list.h>
 #include <isc/loop.h>
 #include <isc/magic.h>
@@ -84,6 +85,8 @@
 * in a tight loop of constant lookups.  It's value is arbitrary.
 */

+ISC_LANG_BEGINDECLS
+
 typedef struct dig_lookup dig_lookup_t;
 typedef struct dig_query dig_query_t;
 typedef struct dig_server dig_server_t;
@@ -104,8 +107,9 @@ struct dig_lookup {
 	isc_refcount_t references;
 	bool aaonly, adflag, badcookie, besteffort, cdflag, cleared, comments,
 		dns64prefix, dnssec, doing_xfr, done_as_is, ednsneg, expandaaaa,
-		svcparamkeycompat, expire, fuzzing, header_only,
-		identify, /*%< Append an "on server <foo>" message */
+		expire, fuzzing, header_only, identify, /*%< Append an "on
+							   server <foo>" message
+							 */
 		identify_previous_line, /*% Prepend a "Nameserver <foo>:"
 					   message, with newline and tab */
 		idnin, idnout, ignore, multiline, need_search, new_search,
@@ -117,9 +121,9 @@ struct dig_lookup {
 		section_answer, section_authority, section_question,
 		seenbadcookie, sendcookie, servfail_stops,
 		setqid, /*% use a speciied query ID */
-		showbadcookie, showbadvers, stats, tcflag, tcp_keepalive,
-		tcp_mode, tcp_mode_set, tls_mode, /*% connect using TLS */
-		trace,				  /*% dig +trace */
+		showbadcookie, stats, tcflag, tcp_keepalive, tcp_mode,
+		tcp_mode_set, tls_mode, /*% connect using TLS */
+		trace,			/*% dig +trace */
 		trace_root, /*% initial query for either +trace or +nssearch */
 		ttlunits, use_usec, waiting_connect, zflag;
 	char textname[MXNAME]; /*% Name we're going to be looking up */
@@ -131,6 +135,8 @@ struct dig_lookup {
 	bool rdclassset;
 	char name_space[BUFSIZE];
 	char oname_space[BUFSIZE];
+	isc_buffer_t namebuf;
+	isc_buffer_t onamebuf;
 	isc_buffer_t renderbuf;
 	char *sendspace;
 	dns_name_t *name;
@@ -148,7 +154,6 @@ struct dig_lookup {
 	int nsfound;
 	int16_t udpsize;
 	int16_t edns;
-	int16_t original_edns;
 	int16_t padding;
 	uint32_t ixfr_serial;
 	isc_buffer_t rdatabuf;
@@ -182,13 +187,6 @@ struct dig_lookup {
 		char *tls_key_file;
 		isc_tlsctx_cache_t *tls_ctx_cache;
 	};
-	struct {
-		bool proxy_mode;
-		bool proxy_plain;
-		bool proxy_local;
-		isc_sockaddr_t proxy_src_addr;
-		isc_sockaddr_t proxy_dst_addr;
-	};
 	isc_stdtime_t fuzztime;
 };

@@ -261,7 +259,7 @@ extern isc_sockaddr_t localaddr;
 extern char keynametext[MXNAME];
 extern char keyfile[MXNAME];
 extern char keysecret[MXNAME];
-extern dst_algorithm_t hmac_alg;
+extern dst_algorithm_t hmac;
 extern unsigned int digestbits;
 extern dns_tsigkey_t *tsigkey;
 extern bool validated;
@@ -288,13 +286,13 @@ getaddresses(dig_lookup_t *lookup, const char *host, isc_result_t *resultp);
 isc_result_t
 get_reverse(char *reverse, size_t len, char *value, bool strict);

-ISC_NORETURN void
+noreturn void
 fatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);

 void
 warn(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);

-ISC_NORETURN void
+noreturn void
 digexit(void);

 void
@@ -461,3 +459,5 @@ dig_shutdown(void);

 bool
 dig_lookup_is_tls(const dig_lookup_t *lookup);
+
+ISC_LANG_ENDDECLS
@@ -21,7 +21,6 @@

 #include <isc/attributes.h>
 #include <isc/commandline.h>
-#include <isc/lib.h>
 #include <isc/loop.h>
 #include <isc/netaddr.h>
 #include <isc/string.h>
@@ -29,7 +28,6 @@

 #include <dns/byaddr.h>
 #include <dns/fixedname.h>
-#include <dns/lib.h>
 #include <dns/message.h>
 #include <dns/name.h>
 #include <dns/rdata.h>
@@ -82,7 +80,6 @@ struct rtype rtypes[] = { { 1, "has address" },
 			  { 25, "has key" },
 			  { 28, "has IPv6 address" },
 			  { 29, "location" },
-			  { dns_rdatatype_https, "has HTTP service bindings" },
 			  { 0, NULL } };

 static char *
@@ -99,10 +96,10 @@ rcode_totext(dns_rcode_t rcode) {
 	} else {
 		totext.consttext = rcodetext[rcode];
 	}
-	return totext.deconsttext;
+	return (totext.deconsttext);
 }

-ISC_NORETURN static void
+noreturn static void
 show_usage(void);

 static void
@@ -135,7 +132,7 @@ show_usage(void) {
 		"       -W specifies how long to wait for a reply\n"
 		"       -4 use IPv4 query transport only\n"
 		"       -6 use IPv6 query transport only\n");
-	exit(EXIT_FAILURE);
+	exit(1);
 }

 static void
@@ -186,7 +183,6 @@ retry:
 	result = dns_rdata_totext(rdata, NULL, b);
 	if (result == ISC_R_NOSPACE) {
 		isc_buffer_free(&b);
-		INSIST(bufsize <= (UINT_MAX / 2));
 		bufsize *= 2;
 		goto retry;
 	}
@@ -221,13 +217,13 @@ printsection(dns_message_t *msg, dns_section_t sectionid,
 		printf(";; %s SECTION:\n", section_name);
 	}

-	dns_name_init(&empty_name);
+	dns_name_init(&empty_name, NULL);

 	result = dns_message_firstname(msg, sectionid);
 	if (result == ISC_R_NOMORE) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	} else if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}

 	for (;;) {
@@ -246,7 +242,8 @@ printsection(dns_message_t *msg, dns_section_t sectionid,
 			       (list_type == dns_rdatatype_any ||
 				rdataset->type == list_type)) ||
 			      (list_addresses &&
-			       (dns_rdatatype_isaddr(rdataset->type) ||
+			       (rdataset->type == dns_rdatatype_a ||
+				rdataset->type == dns_rdatatype_aaaa ||
 				rdataset->type == dns_rdatatype_ns ||
 				rdataset->type == dns_rdatatype_ptr))))
 			{
@@ -264,7 +261,7 @@ printsection(dns_message_t *msg, dns_section_t sectionid,
 							     print_name, false,
 							     no_rdata, &target);
 				if (result != ISC_R_SUCCESS) {
-					return result;
+					return (result);
 				}
 #ifdef USEINITALWS
 				if (first) {
@@ -319,11 +316,11 @@ printsection(dns_message_t *msg, dns_section_t sectionid,
 		if (result == ISC_R_NOMORE) {
 			break;
 		} else if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 	}

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
@@ -343,12 +340,12 @@ printrdata(dns_message_t *msg, dns_rdataset_t *rdataset,

 	result = dns_rdataset_totext(rdataset, owner, false, false, &target);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}
 	isc_buffer_usedregion(&target, &r);
 	printf("%.*s", (int)r.length, (char *)r.base);

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static void
@@ -425,7 +422,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 				       : query->lookup->textname,
 			       msg->rcode, rcode_totext(msg->rcode));
 		}
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	if (default_lookups && query->lookup->rdtype == dns_rdatatype_a) {
@@ -459,16 +456,6 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 			lookup->retries = tries;
 			ISC_LIST_APPEND(lookup_list, lookup, link);
 		}
-		lookup = clone_lookup(query->lookup, false);
-		if (lookup != NULL) {
-			strlcpy(lookup->textname, namestr,
-				sizeof(lookup->textname));
-			lookup->rdtype = dns_rdatatype_https;
-			lookup->rdtypeset = true;
-			lookup->origin = NULL;
-			lookup->retries = tries;
-			ISC_LIST_APPEND(lookup_list, lookup, link);
-		}
 	}

 	if (!short_form) {
@@ -529,7 +516,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		result = printsection(msg, DNS_SECTION_QUESTION, "QUESTION",
 				      true, query);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 	}
 	if (!ISC_LIST_EMPTY(msg->sections[DNS_SECTION_ANSWER])) {
@@ -539,7 +526,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		result = printsection(msg, DNS_SECTION_ANSWER, "ANSWER",
 				      !short_form, query);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 	}

@@ -550,7 +537,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		result = printsection(msg, DNS_SECTION_AUTHORITY, "AUTHORITY",
 				      true, query);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 	}
 	if (!ISC_LIST_EMPTY(msg->sections[DNS_SECTION_ADDITIONAL]) &&
@@ -560,7 +547,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		result = printsection(msg, DNS_SECTION_ADDITIONAL, "ADDITIONAL",
 				      true, query);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 	}
 	if ((tsig != NULL) && !short_form) {
@@ -568,7 +555,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		result = printrdata(msg, tsig, tsigname, "PSEUDOSECTION TSIG",
 				    true);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 	}
 	if (!short_form) {
@@ -586,7 +573,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		printf("%s has no %s record\n", namestr, typestr);
 	}
 	seen_error = force_error;
-	return result;
+	return (result);
 }

 static const char *optstring = "46aAc:dilnm:p:rst:vVwCDN:R:TUW:";
@@ -667,7 +654,7 @@ pre_parse_args(int argc, char **argv) {
 			break;
 		case 'V':
 			printf("host %s\n", PACKAGE_VERSION);
-			exit(EXIT_SUCCESS);
+			exit(0);
 			break;
 		case 'w':
 			break;
@@ -929,5 +916,5 @@ main(int argc, char **argv) {
 	cancel_all();
 	destroy_libs();

-	return (seen_error == 0) ? 0 : 1;
+	return ((seen_error == 0) ? 0 : 1);
 }
@@ -122,7 +122,7 @@ Options
   CNAME, NS, SOA, TXT, DNSKEY, AXFR, etc.

   When no query type is specified, :program:`host` automatically selects an
-   appropriate query type. By default, it looks for A, AAAA, MX, and HTTPS
+   appropriate query type. By default, it looks for A, AAAA, and MX
   records. If the :option:`-C` option is given, queries are made for SOA
   records. If ``name`` is a dotted-decimal IPv4 address or
   colon-delimited IPv6 address, :program:`host` queries for PTR records.
@@ -20,7 +20,7 @@
 #include <isc/attributes.h>
 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/lib.h>
+#include <isc/condition.h>
 #include <isc/loop.h>
 #include <isc/netaddr.h>
 #include <isc/parseint.h>
@@ -30,7 +30,6 @@

 #include <dns/byaddr.h>
 #include <dns/fixedname.h>
-#include <dns/lib.h>
 #include <dns/message.h>
 #include <dns/name.h>
 #include <dns/rdata.h>
@@ -129,7 +128,7 @@ rcode_totext(dns_rcode_t rcode) {
 	} else {
 		totext.consttext = rcodetext[rcode];
 	}
-	return totext.deconsttext;
+	return (totext.deconsttext);
 }

 static void
@@ -190,7 +189,6 @@ printrdata(dns_rdata_t *rdata) {
 			check_result(result, "dns_rdata_totext");
 		}
 		isc_buffer_free(&b);
-		INSIST(size <= (UINT_MAX / 2));
 		size *= 2;
 	}
 }
@@ -211,9 +209,9 @@ printsection(dig_query_t *query, dns_message_t *msg, bool headers,

 	result = dns_message_firstname(msg, section);
 	if (result == ISC_R_NOMORE) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	} else if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}
 	for (;;) {
 		name = NULL;
@@ -257,10 +255,10 @@ printsection(dig_query_t *query, dns_message_t *msg, bool headers,
 		if (result == ISC_R_NOMORE) {
 			break;
 		} else if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 	}
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
@@ -295,9 +293,9 @@ detailsection(dig_query_t *query, dns_message_t *msg, bool headers,

 	result = dns_message_firstname(msg, section);
 	if (result == ISC_R_NOMORE) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	} else if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}
 	for (;;) {
 		name = NULL;
@@ -339,10 +337,10 @@ detailsection(dig_query_t *query, dns_message_t *msg, bool headers,
 		if (result == ISC_R_NOMORE) {
 			break;
 		} else if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 	}
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static void
@@ -425,7 +423,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,

 		/* the lookup failed */
 		print_error |= 1;
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	if (default_lookups && query->lookup->rdtype == dns_rdatatype_a) {
@@ -479,7 +477,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		printsection(query, msg, headers, DNS_SECTION_AUTHORITY);
 		printsection(query, msg, headers, DNS_SECTION_ADDITIONAL);
 	}
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static void
@@ -538,10 +536,10 @@ testtype(char *typetext) {
 	tr.length = strlen(typetext);
 	result = dns_rdatatype_fromtext(&rdtype, &tr);
 	if (result == ISC_R_SUCCESS) {
-		return true;
+		return (true);
 	} else {
 		printf("unknown query type: %s\n", typetext);
-		return false;
+		return (false);
 	}
 }

@@ -555,10 +553,10 @@ testclass(char *typetext) {
 	tr.length = strlen(typetext);
 	result = dns_rdataclass_fromtext(&rdclass, &tr);
 	if (result == ISC_R_SUCCESS) {
-		return true;
+		return (true);
 	} else {
 		printf("unknown query class: %s\n", typetext);
-		return false;
+		return (false);
 	}
 }

@@ -837,7 +835,7 @@ fgets_next_command(void *arg) {
 	cmdline = fgets(cmdlinebuf, COMMSIZE, stdin);
 }

-ISC_NORETURN static void
+noreturn static void
 usage(void);

 static void
@@ -851,7 +849,7 @@ usage(void) {
 			"'host' using default server\n");
 	fprintf(stderr, "   nslookup [-opt ...] host server # just look up "
 			"'host' using 'server'\n");
-	exit(EXIT_FAILURE);
+	exit(1);
 }

 static void
@@ -864,7 +862,7 @@ parse_args(int argc, char **argv) {
 		if (argv[0][0] == '-') {
 			if (strncasecmp(argv[0], "-ver", 4) == 0) {
 				printf("nslookup %s\n", PACKAGE_VERSION);
-				exit(EXIT_SUCCESS);
+				exit(0);
 			} else if (argv[0][1] != 0) {
 				setoption(&argv[0][1]);
 			} else {
@@ -976,5 +974,5 @@ main(int argc, char **argv) {
 	cancel_all();
 	destroy_libs();

-	return query_error | print_error;
+	return (query_error | print_error);
 }
@@ -48,10 +48,10 @@ readline(const char *prompt) {
 	line = fgets(buf, RL_MAXCMD, stdin);
 	if (line == NULL) {
 		free(buf);
-		return NULL;
+		return (NULL);
 	}
-	return buf;
-}
+	return (buf);
+};

 #define add_history(line)

@@ -2,7 +2,6 @@ dnssec-cds
 dnssec-dsfromkey
 dnssec-keyfromlabel
 dnssec-keygen
-dnssec-ksr
 dnssec-makekeyset
 dnssec-revoke
 dnssec-settime
@@ -2,7 +2,6 @@ include $(top_srcdir)/Makefile.top

 AM_CPPFLAGS +=			\
 	$(LIBISC_CFLAGS)	\
-	$(LIBISCCFG_CFLAGS)	\
 	$(LIBDNS_CFLAGS)

 AM_CPPFLAGS +=			\
@@ -13,7 +12,6 @@ noinst_LTLIBRARIES = libdnssectool.la
 LDADD +=			\
 	libdnssectool.la	\
 	$(LIBISC_LIBS)		\
-	$(LIBISCCFG_LIBS)	\
 	$(LIBDNS_LIBS)		\
 	$(OPENSSL_LIBS)

@@ -23,7 +21,6 @@ bin_PROGRAMS = \
 	dnssec-importkey	\
 	dnssec-keyfromlabel	\
 	dnssec-keygen		\
-	dnssec-ksr		\
 	dnssec-revoke		\
 	dnssec-settime		\
 	dnssec-signzone		\
@@ -35,24 +32,20 @@ libdnssectool_la_SOURCES =	\

 dnssec_keygen_CPPFLAGS =	\
 	$(AM_CPPFLAGS)		\
+	$(LIBISCCFG_CFLAGS)	\
 	$(OPENSSL_CFLAGS)

 dnssec_keygen_LDADD =		\
 	$(LDADD)		\
-	$(OPENSSL_LIBS)
-
-dnssec_ksr_CPPFLAGS=		\
-	$(AM_CPPFLAGS)		\
-	$(OPENSSL_CFLAGS)
-
-dnssec_ksr_LDADD =		\
-	$(LDADD)		\
+	$(LIBISCCFG_LIBS)	\
 	$(OPENSSL_LIBS)

 dnssec_signzone_CPPFLAGS =	\
 	$(AM_CPPFLAGS)		\
+	$(LIBISCCFG_CFLAGS)	\
 	$(OPENSSL_CFLAGS)

 dnssec_signzone_LDADD =		\
 	$(LDADD)		\
+	$(LIBISCCFG_LIBS)	\
 	$(OPENSSL_LIBS)
@@ -29,8 +29,6 @@
 #include <isc/dir.h>
 #include <isc/file.h>
 #include <isc/hash.h>
-#include <isc/lib.h>
-#include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
 #include <isc/serial.h>
@@ -45,7 +43,7 @@
 #include <dns/ds.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
-#include <dns/lib.h>
+#include <dns/log.h>
 #include <dns/master.h>
 #include <dns/name.h>
 #include <dns/rdata.h>
@@ -65,6 +63,7 @@ const char *program = "dnssec-cds";
 /*
 * Infrastructure
 */
+static isc_log_t *lctx = NULL;
 static isc_mem_t *mctx = NULL;

 /*
@@ -145,6 +144,7 @@ static dns_dbnode_t *parent_node = NULL;
 static dns_db_t *update_db = NULL;
 static dns_dbnode_t *update_node = NULL;
 static dns_dbversion_t *update_version = NULL;
+static bool cleanup_dst = false;
 static bool print_mem_stats = false;

 static void
@@ -178,7 +178,7 @@ initname(char *setname) {

 	isc_buffer_init(&buf, setname, strlen(setname));
 	isc_buffer_add(&buf, strlen(setname));
-	result = dns_name_fromtext(name, &buf, dns_rootname, 0);
+	result = dns_name_fromtext(name, &buf, dns_rootname, 0, NULL);
 	if (result != ISC_R_SUCCESS) {
 		fatal("could not initialize name %s", setname);
 	}
@@ -247,8 +247,8 @@ static void
 load_db(const char *filename, dns_db_t **dbp, dns_dbnode_t **nodep) {
 	isc_result_t result;

-	result = dns_db_create(mctx, ZONEDB_DEFAULT, name, dns_dbtype_zone,
-			       rdclass, 0, NULL, dbp);
+	result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone, rdclass, 0,
+			       NULL, dbp);
 	check_result(result, "dns_db_create()");

 	result = dns_db_load(*dbp, filename, dns_masterformat_text,
@@ -395,7 +395,7 @@ formatset(dns_rdataset_t *rdataset) {
 	}

 	isc_buffer_putuint8(buf, 0);
-	return buf;
+	return (buf);
 }

 static void
@@ -505,14 +505,14 @@ match_key_dsset(keyinfo_t *ki, dns_rdataset_t *dsset, strictness_t strictness) {
 			vbprintf(1, "found matching %s %d %d %d\n",
 				 c ? "CDS" : "DS", ds.key_tag, ds.algorithm,
 				 ds.digest_type);
-			return true;
+			return (true);
 		} else if (strictness == TIGHT) {
 			vbprintf(0,
 				 "key does not match %s %d %d %d "
 				 "when it looks like it should\n",
 				 c ? "CDS" : "DS", ds.key_tag, ds.algorithm,
 				 ds.digest_type);
-			return false;
+			return (false);
 		}
 	}

@@ -521,7 +521,7 @@ match_key_dsset(keyinfo_t *ki, dns_rdataset_t *dsset, strictness_t strictness) {
 		 ki->rdata.type == dns_rdatatype_cdnskey ? "CDNSKEY" : "DNSKEY",
 		 ki->tag, ki->algo);

-	return false;
+	return (false);
 }

 /*
@@ -575,7 +575,7 @@ match_keyset_dsset(dns_rdataset_t *keyset, dns_rdataset_t *dsset,
 		}
 	}

-	return keytable;
+	return (keytable);
 }

 static void
@@ -681,7 +681,7 @@ matching_sigs(keyinfo_t *keytbl, dns_rdataset_t *rdataset,
 		}
 	}

-	return algo;
+	return (algo);
 }

 /*
@@ -698,7 +698,7 @@ signed_loose(dns_secalg_t *algo) {
 		}
 	}
 	isc_mem_cput(mctx, algo, nkey, sizeof(algo[0]));
-	return ok;
+	return (ok);
 }

 /*
@@ -740,7 +740,7 @@ signed_strict(dns_rdataset_t *dsset, dns_secalg_t *algo) {
 	}

 	isc_mem_cput(mctx, algo, nkey, sizeof(algo[0]));
-	return all_ok;
+	return (all_ok);
 }

 /*
@@ -761,10 +761,10 @@ ds_from_cds(isc_buffer_t *buf, dns_rdata_t *rds, dns_dsdigest_t dt,
 	ds.common.rdtype = dns_rdatatype_ds;

 	if (ds.digest_type != dt) {
-		return ISC_R_IGNORE;
+		return (ISC_R_IGNORE);
 	}

-	return dns_rdata_fromstruct(rds, rdclass, dns_rdatatype_ds, &ds, buf);
+	return (dns_rdata_fromstruct(rds, rdclass, dns_rdatatype_ds, &ds, buf));
 }

 static isc_result_t
@@ -777,7 +777,7 @@ ds_from_cdnskey(isc_buffer_t *buf, dns_rdata_t *ds, dns_dsdigest_t dt,

 	isc_buffer_availableregion(buf, &r);
 	if (r.length < DNS_DS_BUFFERSIZE) {
-		return ISC_R_NOSPACE;
+		return (ISC_R_NOSPACE);
 	}

 	result = dns_ds_buildrdata(name, cdnskey, dt, r.base, ds);
@@ -785,7 +785,7 @@ ds_from_cdnskey(isc_buffer_t *buf, dns_rdata_t *ds, dns_dsdigest_t dt,
 		isc_buffer_add(buf, DNS_DS_BUFFERSIZE);
 	}

-	return result;
+	return (result);
 }

 static isc_result_t
@@ -816,14 +816,14 @@ append_new_ds_set(ds_maker_func_t *ds_from_rdata, isc_buffer_t *buf,
 			continue;
 		case ISC_R_NOSPACE:
 			isc_mem_put(mctx, ds, sizeof(*ds));
-			return result;
+			return (result);
 		default:
 			isc_mem_put(mctx, ds, sizeof(*ds));
 			check_result(result, "ds_from_rdata()");
 		}
 	}

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static void
@@ -868,8 +868,8 @@ make_new_ds_set(ds_maker_func_t *ds_from_rdata, uint32_t ttl,

 static int
 rdata_cmp(const void *rdata1, const void *rdata2) {
-	return dns_rdata_compare((const dns_rdata_t *)rdata1,
-				 (const dns_rdata_t *)rdata2);
+	return (dns_rdata_compare((const dns_rdata_t *)rdata1,
+				  (const dns_rdata_t *)rdata2));
 }

 /*
@@ -950,7 +950,7 @@ consistent_digests(dns_rdataset_t *dsset) {
 	isc_mem_cput(mctx, ds, n, sizeof(dns_rdata_ds_t));
 	isc_mem_cput(mctx, arrdata, n, sizeof(dns_rdata_t));

-	return match;
+	return (match);
 }

 static void
@@ -979,8 +979,8 @@ update_diff(const char *cmd, uint32_t ttl, dns_rdataset_t *addset,
 	dns_rdataset_t diffset;
 	uint32_t save;

-	result = dns_db_create(mctx, ZONEDB_DEFAULT, name, dns_dbtype_zone,
-			       rdclass, 0, NULL, &update_db);
+	result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone, rdclass, 0,
+			       NULL, &update_db);
 	check_result(result, "dns_db_create()");

 	result = dns_db_newversion(update_db, &update_version);
@@ -1029,7 +1029,7 @@ nsdiff(uint32_t ttl, dns_rdataset_t *oldset, dns_rdataset_t *newset) {
 	}
 }

-ISC_NORETURN static void
+noreturn static void
 usage(void);

 static void
@@ -1056,7 +1056,7 @@ usage(void) {
 			"    -T <ttl>           TTL of DS records\n"
 			"    -V                 print version\n"
 			"    -v <verbosity>\n");
-	exit(EXIT_FAILURE);
+	exit(1);
 }

 static void
@@ -1071,11 +1071,17 @@ cleanup(void) {
 		free_keytable(&new_key_tbl);
 	}
 	free_all_sets();
+	if (lctx != NULL) {
+		cleanup_logging(&lctx);
+	}
+	if (cleanup_dst) {
+		dst_lib_destroy();
+	}
 	if (mctx != NULL) {
 		if (print_mem_stats && verbose > 10) {
 			isc_mem_stats(mctx, stdout);
 		}
-		isc_mem_detach(&mctx);
+		isc_mem_destroy(&mctx);
 	}
 }

@@ -1084,6 +1090,7 @@ main(int argc, char *argv[]) {
 	const char *child_path = NULL;
 	const char *ds_path = NULL;
 	const char *inplace = NULL;
+	isc_result_t result;
 	bool prefer_cdnskey = false;
 	bool nsupdate = false;
 	uint32_t ttl = 0;
@@ -1171,7 +1178,14 @@ main(int argc, char *argv[]) {
 		dtype[0] = DNS_DSDIGEST_SHA256;
 	}

-	setup_logging();
+	setup_logging(mctx, &lctx);
+
+	result = dst_lib_init(mctx, NULL);
+	if (result != ISC_R_SUCCESS) {
+		fatal("could not initialize dst: %s",
+		      isc_result_totext(result));
+	}
+	cleanup_dst = true;

 	if (ds_path == NULL) {
 		fatal("missing -d DS pathname");
@@ -1340,6 +1354,5 @@ main(int argc, char *argv[]) {
 cleanup:
 	print_mem_stats = true;
 	cleanup();
-
-	return 0;
+	exit(0);
 }
@@ -22,8 +22,6 @@
 #include <isc/commandline.h>
 #include <isc/dir.h>
 #include <isc/hash.h>
-#include <isc/lib.h>
-#include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
 #include <isc/string.h>
@@ -35,7 +33,7 @@
 #include <dns/ds.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
-#include <dns/lib.h>
+#include <dns/log.h>
 #include <dns/master.h>
 #include <dns/name.h>
 #include <dns/rdata.h>
@@ -56,7 +54,6 @@ static dns_name_t *name = NULL;
 static isc_mem_t *mctx = NULL;
 static uint32_t ttl;
 static bool emitttl = false;
-static unsigned int split_width = 0;

 static isc_result_t
 initname(char *setname) {
@@ -67,8 +64,8 @@ initname(char *setname) {

 	isc_buffer_init(&buf, setname, strlen(setname));
 	isc_buffer_add(&buf, strlen(setname));
-	result = dns_name_fromtext(name, &buf, dns_rootname, 0);
-	return result;
+	result = dns_name_fromtext(name, &buf, dns_rootname, 0, NULL);
+	return (result);
 }

 static void
@@ -103,8 +100,8 @@ loadset(const char *filename, dns_rdataset_t *rdataset) {

 	dns_name_format(name, setname, sizeof(setname));

-	result = dns_db_create(mctx, ZONEDB_DEFAULT, name, dns_dbtype_zone,
-			       rdclass, 0, NULL, &db);
+	result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone, rdclass, 0,
+			       NULL, &db);
 	if (result != ISC_R_SUCCESS) {
 		fatal("can't create database");
 	}
@@ -140,7 +137,7 @@ loadset(const char *filename, dns_rdataset_t *rdataset) {
 	if (db != NULL) {
 		dns_db_detach(&db);
 	}
-	return result;
+	return (result);
 }

 static isc_result_t
@@ -155,7 +152,7 @@ loadkeyset(char *dirname, dns_rdataset_t *rdataset) {
 	if (dirname != NULL) {
 		/* allow room for a trailing slash */
 		if (strlen(dirname) >= isc_buffer_availablelength(&buf)) {
-			return ISC_R_NOSPACE;
+			return (ISC_R_NOSPACE);
 		}
 		isc_buffer_putstr(&buf, dirname);
 		if (dirname[strlen(dirname) - 1] != '/') {
@@ -164,18 +161,18 @@ loadkeyset(char *dirname, dns_rdataset_t *rdataset) {
 	}

 	if (isc_buffer_availablelength(&buf) < 7) {
-		return ISC_R_NOSPACE;
+		return (ISC_R_NOSPACE);
 	}
 	isc_buffer_putstr(&buf, "keyset-");

 	result = dns_name_tofilenametext(name, false, &buf);
 	check_result(result, "dns_name_tofilenametext()");
 	if (isc_buffer_availablelength(&buf) == 0) {
-		return ISC_R_NOSPACE;
+		return (ISC_R_NOSPACE);
 	}
 	isc_buffer_putuint8(&buf, 0);

-	return loadset(filename, rdataset);
+	return (loadset(filename, rdataset));
 }

 static void
@@ -282,8 +279,8 @@ emit(dns_dsdigest_t dt, bool showall, bool cds, dns_rdata_t *rdata) {
 		fatal("can't print name");
 	}

-	result = dns_rdata_tofmttext(&ds, (dns_name_t *)NULL, 0, 0, split_width,
-				     "", &textb);
+	result = dns_rdata_tofmttext(&ds, (dns_name_t *)NULL, 0, 0, 0, "",
+				     &textb);

 	if (result != ISC_R_SUCCESS) {
 		fatal("can't print rdata");
@@ -326,7 +323,7 @@ emits(bool showall, bool cds, dns_rdata_t *rdata) {
 	}
 }

-ISC_NORETURN static void
+noreturn static void
 usage(void);

 static void
@@ -350,14 +347,13 @@ usage(void) {
 			"    -f zonefile: read keys from a zone file\n"
 			"    -h: print help information\n"
 			"    -K directory: where to find key or keyset files\n"
-			"    -w split base64 rdata text into chunks\n"
 			"    -s: read keys from keyset-<dnsname> file\n"
 			"    -T: TTL of output records (omitted by default)\n"
 			"    -v level: verbosity\n"
 			"    -V: print version information\n");
 	fprintf(stderr, "Output: DS or CDS RRs\n");

-	exit(EXIT_FAILURE);
+	exit(-1);
 }

 int
@@ -370,6 +366,7 @@ main(int argc, char **argv) {
 	bool usekeyset = false;
 	bool showall = false;
 	isc_result_t result;
+	isc_log_t *log = NULL;
 	dns_rdataset_t rdataset;
 	dns_rdata_t rdata;

@@ -383,7 +380,7 @@ main(int argc, char **argv) {

 	isc_commandline_errprint = false;

-#define OPTIONS "12Aa:Cc:d:Ff:K:sT:v:whV"
+#define OPTIONS "12Aa:Cc:d:Ff:K:l:sT:v:hV"
 	while ((ch = isc_commandline_parse(argc, argv, OPTIONS)) != -1) {
 		switch (ch) {
 		case '1':
@@ -419,6 +416,9 @@ main(int argc, char **argv) {
 		case 'f':
 			filename = isc_commandline_argument;
 			break;
+		case 'l':
+			fatal("-l option (DLV lookaside) is obsolete");
+			break;
 		case 's':
 			usekeyset = true;
 			break;
@@ -432,9 +432,6 @@ main(int argc, char **argv) {
 				fatal("-v must be followed by a number");
 			}
 			break;
-		case 'w':
-			split_width = UINT_MAX;
-			break;
 		case 'F':
 			/* Reserved for FIPS mode */
 			FALLTHROUGH;
@@ -455,7 +452,7 @@ main(int argc, char **argv) {
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n", program,
 				isc_commandline_option);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}

@@ -487,7 +484,13 @@ main(int argc, char **argv) {
 		fatal("extraneous arguments");
 	}

-	setup_logging();
+	result = dst_lib_init(mctx, NULL);
+	if (result != ISC_R_SUCCESS) {
+		fatal("could not initialize dst: %s",
+		      isc_result_totext(result));
+	}
+
+	setup_logging(mctx, &log);

 	dns_rdataset_init(&rdataset);

@@ -540,16 +543,18 @@ main(int argc, char **argv) {
 	if (dns_rdataset_isassociated(&rdataset)) {
 		dns_rdataset_disassociate(&rdataset);
 	}
+	cleanup_logging(&log);
+	dst_lib_destroy();
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);

 	fflush(stdout);
 	if (ferror(stdout)) {
 		fprintf(stderr, "write error\n");
-		return 1;
+		return (1);
 	} else {
-		return 0;
+		return (0);
 	}
 }
@@ -20,8 +20,6 @@
 #include <isc/buffer.h>
 #include <isc/commandline.h>
 #include <isc/hash.h>
-#include <isc/lib.h>
-#include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
 #include <isc/string.h>
@@ -33,7 +31,7 @@
 #include <dns/ds.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
-#include <dns/lib.h>
+#include <dns/log.h>
 #include <dns/master.h>
 #include <dns/name.h>
 #include <dns/rdata.h>
@@ -69,8 +67,8 @@ initname(char *setname) {

 	isc_buffer_init(&buf, setname, strlen(setname));
 	isc_buffer_add(&buf, strlen(setname));
-	result = dns_name_fromtext(name, &buf, dns_rootname, 0);
-	return result;
+	result = dns_name_fromtext(name, &buf, dns_rootname, 0, NULL);
+	return (result);
 }

 static void
@@ -105,8 +103,8 @@ loadset(const char *filename, dns_rdataset_t *rdataset) {

 	dns_name_format(name, setname, sizeof(setname));

-	result = dns_db_create(mctx, ZONEDB_DEFAULT, name, dns_dbtype_zone,
-			       rdclass, 0, NULL, &db);
+	result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone, rdclass, 0,
+			       NULL, &db);
 	if (result != ISC_R_SUCCESS) {
 		fatal("can't create database");
 	}
@@ -143,7 +141,7 @@ loadset(const char *filename, dns_rdataset_t *rdataset) {
 	if (db != NULL) {
 		dns_db_detach(&db);
 	}
-	return result;
+	return (result);
 }

 static void
@@ -264,7 +262,7 @@ emit(const char *dir, dns_rdata_t *rdata) {
 	dst_key_free(&key);
 }

-ISC_NORETURN static void
+noreturn static void
 usage(void);

 static void
@@ -291,7 +289,7 @@ usage(void) {
 	fprintf(stderr, "    -D sync date/[+-]offset/none: set/unset "
 			"CDS and CDNSKEY deletion date\n");

-	exit(EXIT_FAILURE);
+	exit(-1);
 }

 int
@@ -301,6 +299,7 @@ main(int argc, char **argv) {
 	char *endp;
 	int ch;
 	isc_result_t result;
+	isc_log_t *log = NULL;
 	dns_rdataset_t rdataset;
 	dns_rdata_t rdata;
 	isc_stdtime_t now = isc_stdtime_now();
@@ -396,7 +395,7 @@ main(int argc, char **argv) {
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n", program,
 				isc_commandline_option);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}

@@ -409,7 +408,13 @@ main(int argc, char **argv) {
 		fatal("extraneous arguments");
 	}

-	setup_logging();
+	result = dst_lib_init(mctx, NULL);
+	if (result != ISC_R_SUCCESS) {
+		fatal("could not initialize dst: %s",
+		      isc_result_totext(result));
+	}
+
+	setup_logging(mctx, &log);

 	dns_rdataset_init(&rdataset);

@@ -453,16 +458,18 @@ main(int argc, char **argv) {
 	if (dns_rdataset_isassociated(&rdataset)) {
 		dns_rdataset_disassociate(&rdataset);
 	}
+	cleanup_logging(&log);
+	dst_lib_destroy();
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);

 	fflush(stdout);
 	if (ferror(stdout)) {
 		fprintf(stderr, "write error\n");
-		return 1;
+		return (1);
 	} else {
-		return 0;
+		return (0);
 	}
 }
@@ -21,8 +21,6 @@
 #include <isc/attributes.h>
 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/lib.h>
-#include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/region.h>
 #include <isc/result.h>
@@ -32,7 +30,7 @@
 #include <dns/dnssec.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
-#include <dns/lib.h>
+#include <dns/log.h>
 #include <dns/name.h>
 #include <dns/rdataclass.h>
 #include <dns/secalg.h>
@@ -45,9 +43,7 @@

 const char *program = "dnssec-keyfromlabel";

-static uint16_t tag_min = 0, tag_max = 0xffff;
-
-ISC_NORETURN static void
+noreturn static void
 usage(void);

 static void
@@ -67,12 +63,13 @@ usage(void) {
 			"        ED25519 | ED448\n");
 	fprintf(stderr, "    -3: use NSEC3-capable algorithm\n");
 	fprintf(stderr, "    -c class (default: IN)\n");
+	fprintf(stderr, "    -E <engine>:\n");
+	fprintf(stderr, "        name of an OpenSSL engine to use\n");
 	fprintf(stderr, "    -f keyflag: KSK | REVOKE\n");
 	fprintf(stderr, "    -K directory: directory in which to place "
 			"key files\n");
 	fprintf(stderr, "    -k: generate a TYPE=KEY key\n");
 	fprintf(stderr, "    -L ttl: default key TTL\n");
-	fprintf(stderr, "    -M <min>:<max>: allowed Key ID range\n");
 	fprintf(stderr, "    -n nametype: ZONE | HOST | ENTITY | USER | "
 			"OTHER\n");
 	fprintf(stderr, "        (DNSKEY generation defaults to ZONE\n");
@@ -105,7 +102,7 @@ usage(void) {
 	fprintf(stderr, "     K<name>+<alg>+<id>.key, "
 			"K<name>+<alg>+<id>.private\n");

-	exit(EXIT_FAILURE);
+	exit(-1);
 }

 int
@@ -115,6 +112,7 @@ main(int argc, char **argv) {
 	const char *directory = NULL;
 	const char *predecessor = NULL;
 	dst_key_t *prevkey = NULL;
+	const char *engine = NULL;
 	char *classname = NULL;
 	char *endp;
 	dst_key_t *key = NULL;
@@ -130,6 +128,7 @@ main(int argc, char **argv) {
 	isc_textregion_t r;
 	char filename[255];
 	isc_buffer_t buf;
+	isc_log_t *log = NULL;
 	dns_rdataclass_t rdclass;
 	int options = DST_TYPE_PRIVATE | DST_TYPE_PUBLIC;
 	char *label = NULL;
@@ -161,7 +160,7 @@ main(int argc, char **argv) {

 	isc_commandline_errprint = false;

-#define CMDLINE_FLAGS "3A:a:Cc:D:E:Ff:GhI:i:kK:L:l:M:n:P:p:R:S:t:v:Vy"
+#define CMDLINE_FLAGS "3A:a:Cc:D:E:Ff:GhI:i:kK:L:l:n:P:p:R:S:t:v:Vy"
 	while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (ch) {
 		case '3':
@@ -177,7 +176,7 @@ main(int argc, char **argv) {
 			classname = isc_commandline_argument;
 			break;
 		case 'E':
-			fatal("%s", isc_result_totext(DST_R_NOENGINE));
+			engine = isc_commandline_argument;
 			break;
 		case 'f':
 			c = (unsigned char)(isc_commandline_argument[0]);
@@ -208,20 +207,6 @@ main(int argc, char **argv) {
 		case 'l':
 			label = isc_mem_strdup(mctx, isc_commandline_argument);
 			break;
-		case 'M': {
-			unsigned long ul;
-			tag_min = ul = strtoul(isc_commandline_argument, &endp,
-					       10);
-			if (*endp != ':' || ul > 0xffff) {
-				fatal("-M range invalid");
-			}
-			tag_max = ul = strtoul(endp + 1, &endp, 10);
-			if (*endp != '\0' || ul > 0xffff || tag_max <= tag_min)
-			{
-				fatal("-M range invalid");
-			}
-			break;
-		}
 		case 'n':
 			nametype = isc_commandline_argument;
 			break;
@@ -346,11 +331,16 @@ main(int argc, char **argv) {
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n", program,
 				isc_commandline_option);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}

-	setup_logging();
+	ret = dst_lib_init(mctx, engine);
+	if (ret != ISC_R_SUCCESS) {
+		fatal("could not initialize dst: %s", isc_result_totext(ret));
+	}
+
+	setup_logging(mctx, &log);

 	if (predecessor == NULL) {
 		if (label == NULL) {
@@ -367,7 +357,7 @@ main(int argc, char **argv) {
 		isc_buffer_init(&buf, argv[isc_commandline_index],
 				strlen(argv[isc_commandline_index]));
 		isc_buffer_add(&buf, strlen(argv[isc_commandline_index]));
-		ret = dns_name_fromtext(name, &buf, dns_rootname, 0);
+		ret = dns_name_fromtext(name, &buf, dns_rootname, 0, NULL);
 		if (ret != ISC_R_SUCCESS) {
 			fatal("invalid key name %s: %s",
 			      argv[isc_commandline_index],
@@ -605,8 +595,8 @@ main(int argc, char **argv) {
 	isc_buffer_init(&buf, filename, sizeof(filename) - 1);

 	/* associate the key */
-	ret = dst_key_fromlabel(name, alg, flags, protocol, rdclass, label,
-				NULL, mctx, &key);
+	ret = dst_key_fromlabel(name, alg, flags, protocol, rdclass, engine,
+				label, NULL, mctx, &key);

 	if (ret != ISC_R_SUCCESS) {
 		char namestr[DNS_NAME_FORMATSIZE];
@@ -616,7 +606,7 @@ main(int argc, char **argv) {
 		fatal("failed to get key %s/%s: %s", namestr, algstr,
 		      isc_result_totext(ret));
 		UNREACHABLE();
-		exit(EXIT_FAILURE);
+		exit(-1);
 	}

 	/*
@@ -696,8 +686,7 @@ main(int argc, char **argv) {
 	 * is a risk of ID collision due to this key or another key
 	 * being revoked.
 	 */
-	if (key_collision(key, name, directory, mctx, tag_min, tag_max, &exact))
-	{
+	if (key_collision(key, name, directory, mctx, &exact)) {
 		isc_buffer_clear(&buf);
 		ret = dst_key_buildfilename(key, 0, directory, &buf);
 		if (ret != ISC_R_SUCCESS) {
@@ -742,15 +731,17 @@ main(int argc, char **argv) {
 		dst_key_free(&prevkey);
 	}

+	cleanup_logging(&log);
+	dst_lib_destroy();
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
 	isc_mem_free(mctx, label);
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);

 	if (freeit != NULL) {
 		free(freeit);
 	}

-	return 0;
+	return (0);
 }
@@ -21,7 +21,7 @@ dnssec-keyfromlabel - DNSSEC key generation tool
 Synopsis
 ~~~~~~~~

-:program:`dnssec-keyfromlabel` {**-l** label} [**-3**] [**-a** algorithm] [**-A** date/offset] [**-c** class] [**-D** date/offset] [**-D** sync date/offset] [**-f** flag] [**-G**] [**-I** date/offset] [**-i** interval] [**-k**] [**-K** directory] [**-L** ttl] [**-M** tag_min:tag_max] [**-n** nametype] [**-P** date/offset] [**-P** sync date/offset] [**-p** protocol] [**-R** date/offset] [**-S** key] [**-t** type] [**-v** level] [**-V**] [**-y**] {name}
+:program:`dnssec-keyfromlabel` {**-l** label} [**-3**] [**-a** algorithm] [**-A** date/offset] [**-c** class] [**-D** date/offset] [**-D** sync date/offset] [**-E** engine] [**-f** flag] [**-G**] [**-I** date/offset] [**-i** interval] [**-k**] [**-K** directory] [**-L** ttl] [**-n** nametype] [**-P** date/offset] [**-P** sync date/offset] [**-p** protocol] [**-R** date/offset] [**-S** key] [**-t** type] [**-v** level] [**-V**] [**-y**] {name}

 Description
 ~~~~~~~~~~~
@@ -63,12 +63,22 @@ Options
   versions, then the NSEC3 version is used; for example,
   ``dnssec-keygen -3a RSASHA1`` specifies the NSEC3RSASHA1 algorithm.

+.. option:: -E engine
+
+   This option specifies the cryptographic hardware to use.
+
+   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
+   engine identifier that drives the cryptographic accelerator or
+   hardware service module (usually ``pkcs11``).
+
 .. option:: -l label

   This option specifies the label for a key pair in the crypto hardware.

   When BIND 9 is built with OpenSSL-based PKCS#11 support, the label is
-   an arbitrary string that identifies a particular key.
+   an arbitrary string that identifies a particular key. It may be
+   preceded by an optional OpenSSL engine name, followed by a colon, as
+   in ``pkcs11:keylabel``.

 .. option:: -n nametype

@@ -123,18 +133,6 @@ Options
   place, in which case the existing TTL would take precedence. Setting
   the default TTL to ``0`` or ``none`` removes it.

-.. option:: -M tag_min:tag_max
-
-   This option sets the range of key tag values
-   that ``dnssec-keyfromlabel`` will accept. If the key tag of the new
-   key or the key tag of the revoked version of the new key is
-   outside this range, the new key will be rejected.  This is
-   designed to be used when generating keys in a multi-signer
-   scenario, where each operator is given a range of key tags to
-   prevent collisions among different operators.  The valid
-   values for ``tag_min`` and ``tag_max`` are [0..65535].  The
-   default allows all key tag values to be accepted.
-
 .. option:: -p protocol

   This option sets the protocol value for the key. The protocol is a number between
@@ -38,9 +38,7 @@
 #include <isc/attributes.h>
 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/crypto.h>
-#include <isc/lib.h>
-#include <isc/log.h>
+#include <isc/fips.h>
 #include <isc/mem.h>
 #include <isc/region.h>
 #include <isc/result.h>
@@ -51,15 +49,27 @@
 #include <dns/fixedname.h>
 #include <dns/kasp.h>
 #include <dns/keyvalues.h>
-#include <dns/lib.h>
+#include <dns/log.h>
 #include <dns/name.h>
 #include <dns/rdataclass.h>
 #include <dns/secalg.h>

 #include <dst/dst.h>

+#include <isccfg/cfg.h>
+#include <isccfg/grammar.h>
+#include <isccfg/kaspconf.h>
+#include <isccfg/namedconf.h>
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+#include <openssl/err.h>
+#include <openssl/provider.h>
+#endif
+
 #include "dnssectool.h"

+#define MAX_RSA 4096 /* should be long enough... */
+#define MAX_DH	4096 /* should be long enough... */
+
 const char *program = "dnssec-keygen";

 /*
@@ -69,7 +79,9 @@ const char *program = "dnssec-keygen";
 static int min_rsa = 1024;
 static int min_dh = 128;

-ISC_NORETURN static void
+isc_log_t *lctx = NULL;
+
+noreturn static void
 usage(void);

 static void
@@ -80,22 +92,18 @@ struct keygen_ctx {
 	const char *policy;
 	const char *configfile;
 	const char *directory;
-	dns_keystore_t *keystore;
 	char *algname;
 	char *nametype;
 	char *type;
 	int protocol;
 	int size;
-	uint16_t tag_min;
-	uint16_t tag_max;
 	int signatory;
 	dns_rdataclass_t rdclass;
 	int options;
 	int dbits;
 	dns_ttl_t ttl;
-	bool wantzsk;
-	bool wantksk;
-	bool wantrev;
+	uint16_t kskflag;
+	uint16_t revflag;
 	dns_secalg_t alg;
 	/* timing data */
 	int prepub;
@@ -146,7 +154,7 @@ usage(void) {
 	fprintf(stderr, "    -l <file>: configuration file with dnssec-policy "
 			"statement\n");
 	fprintf(stderr, "    -a <algorithm>:\n");
-	if (!isc_crypto_fips_mode()) {
+	if (!isc_fips_mode()) {
 		fprintf(stderr, "        RSASHA1 | NSEC3RSASHA1 |\n");
 	}
 	fprintf(stderr, "        RSASHA256 | RSASHA512 |\n");
@@ -154,7 +162,7 @@ usage(void) {
 	fprintf(stderr, "        ED25519 | ED448\n");
 	fprintf(stderr, "    -3: use NSEC3-capable algorithm\n");
 	fprintf(stderr, "    -b <key size in bits>:\n");
-	if (!isc_crypto_fips_mode()) {
+	if (!isc_fips_mode()) {
 		fprintf(stderr, "        RSASHA1:\t[%d..%d]\n", min_rsa,
 			MAX_RSA);
 		fprintf(stderr, "        NSEC3RSASHA1:\t[%d..%d]\n", min_rsa,
@@ -173,10 +181,11 @@ usage(void) {
 	fprintf(stderr, "        (DNSKEY generation defaults to ZONE)\n");
 	fprintf(stderr, "    -c <class>: (default: IN)\n");
 	fprintf(stderr, "    -d <digest bits> (0 => max, default)\n");
-	fprintf(stderr, "    -f <keyflag>: ZSK | KSK | REVOKE\n");
+	fprintf(stderr, "    -E <engine>:\n");
+	fprintf(stderr, "        name of an OpenSSL engine to use\n");
+	fprintf(stderr, "    -f <keyflag>: KSK | REVOKE\n");
 	fprintf(stderr, "    -F: FIPS mode\n");
 	fprintf(stderr, "    -L <ttl>: default key TTL\n");
-	fprintf(stderr, "    -M <min>:<max>: allowed Key ID range\n");
 	fprintf(stderr, "    -p <protocol>: (default: 3 [dnssec])\n");
 	fprintf(stderr, "    -s <strength>: strength value this key signs DNS "
 			"records with (default: 0)\n");
@@ -187,7 +196,7 @@ usage(void) {
 			"(default: AUTHCONF)\n");
 	fprintf(stderr, "    -h: print usage and exit\n");
 	fprintf(stderr, "    -m <memory debugging mode>:\n");
-	fprintf(stderr, "       usage | trace | record\n");
+	fprintf(stderr, "       usage | trace | record | size | mctx\n");
 	fprintf(stderr, "    -v <level>: set verbosity level (0 - 10)\n");
 	fprintf(stderr, "    -V: print version information\n");
 	fprintf(stderr, "Timing options:\n");
@@ -217,7 +226,7 @@ usage(void) {
 	fprintf(stderr, "     K<name>+<alg>+<id>.key, "
 			"K<name>+<alg>+<id>.private\n");

-	exit(EXIT_FAILURE);
+	exit(-1);
 }

 static void
@@ -244,11 +253,59 @@ progress(int p) {
 	(void)fflush(stderr);
 }

+static void
+kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
+	       dns_kasp_t **kaspp) {
+	const cfg_listelt_t *element;
+	const cfg_obj_t *kasps = NULL;
+	dns_kasp_t *kasp = NULL, *kasp_next;
+	isc_result_t result = ISC_R_NOTFOUND;
+	dns_kasplist_t kasplist;
+
+	ISC_LIST_INIT(kasplist);
+
+	(void)cfg_map_get(config, "dnssec-policy", &kasps);
+	for (element = cfg_list_first(kasps); element != NULL;
+	     element = cfg_list_next(element))
+	{
+		cfg_obj_t *kconfig = cfg_listelt_value(element);
+		kasp = NULL;
+		if (strcmp(cfg_obj_asstring(cfg_tuple_get(kconfig, "name")),
+			   name) != 0)
+		{
+			continue;
+		}
+
+		result = cfg_kasp_fromconfig(kconfig, NULL, true, mctx, lctx,
+					     &kasplist, &kasp);
+		if (result != ISC_R_SUCCESS) {
+			fatal("failed to configure dnssec-policy '%s': %s",
+			      cfg_obj_asstring(cfg_tuple_get(kconfig, "name")),
+			      isc_result_totext(result));
+		}
+		INSIST(kasp != NULL);
+		dns_kasp_freeze(kasp);
+		break;
+	}
+
+	*kaspp = kasp;
+
+	/*
+	 * Cleanup kasp list.
+	 */
+	for (kasp = ISC_LIST_HEAD(kasplist); kasp != NULL; kasp = kasp_next) {
+		kasp_next = ISC_LIST_NEXT(kasp, link);
+		ISC_LIST_UNLINK(kasplist, kasp, link);
+		dns_kasp_detach(&kasp);
+	}
+}
+
 static void
 keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 	char filename[255];
 	char algstr[DNS_SECALG_FORMATSIZE];
 	uint16_t flags = 0;
+	int param = 0;
 	bool null_key = false;
 	bool conflict = false;
 	bool show_progress = false;
@@ -272,7 +329,7 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 		isc_buffer_init(&buf, argv[isc_commandline_index],
 				strlen(argv[isc_commandline_index]));
 		isc_buffer_add(&buf, strlen(argv[isc_commandline_index]));
-		ret = dns_name_fromtext(name, &buf, dns_rootname, 0);
+		ret = dns_name_fromtext(name, &buf, dns_rootname, 0, NULL);
 		if (ret != ISC_R_SUCCESS) {
 			fatal("invalid key name %s: %s",
 			      argv[isc_commandline_index],
@@ -283,7 +340,7 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 			fatal("unsupported algorithm: %s", algstr);
 		}

-		if (isc_crypto_fips_mode()) {
+		if (isc_fips_mode()) {
 			/* verify only in FIPS mode */
 			switch (ctx->alg) {
 			case DST_ALG_RSASHA1:
@@ -336,7 +393,7 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 			switch (ctx->alg) {
 			case DST_ALG_RSASHA1:
 			case DST_ALG_NSEC3RSASHA1:
-				if (isc_crypto_fips_mode()) {
+				if (isc_fips_mode()) {
 					fatal("key size not specified (-b "
 					      "option)");
 				}
@@ -496,7 +553,7 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 	switch (ctx->alg) {
 	case DNS_KEYALG_RSASHA1:
 	case DNS_KEYALG_NSEC3RSASHA1:
-		if (isc_crypto_fips_mode()) {
+		if (isc_fips_mode()) {
 			fatal("SHA1 based keys not supported in FIPS mode");
 		}
 		FALLTHROUGH;
@@ -550,12 +607,8 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 	if ((ctx->options & DST_TYPE_KEY) != 0) { /* KEY */
 		flags |= ctx->signatory;
 	} else if ((flags & DNS_KEYOWNER_ZONE) != 0) { /* DNSKEY */
-		if (ctx->ksk || ctx->wantksk) {
-			flags |= DNS_KEYFLAG_KSK;
-		}
-		if (ctx->wantrev) {
-			flags |= DNS_KEYFLAG_REVOKE;
-		}
+		flags |= ctx->kskflag;
+		flags |= ctx->revflag;
 	}

 	if (ctx->protocol == -1) {
@@ -602,27 +655,16 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {

 		if (!ctx->quiet && show_progress) {
 			fprintf(stderr, "Generating key pair.");
-		}
-
-		if (ctx->keystore != NULL && ctx->policy != NULL) {
-			ret = dns_keystore_keygen(
-				ctx->keystore, name, ctx->policy, ctx->rdclass,
-				mctx, ctx->alg, ctx->size, flags, &key);
-		} else if (!ctx->quiet && show_progress) {
-			ret = dst_key_generate(name, ctx->alg, ctx->size, 0,
+			ret = dst_key_generate(name, ctx->alg, ctx->size, param,
 					       flags, ctx->protocol,
-					       ctx->rdclass, NULL, mctx, &key,
+					       ctx->rdclass, mctx, &key,
 					       &progress);
-		} else {
-			ret = dst_key_generate(name, ctx->alg, ctx->size, 0,
-					       flags, ctx->protocol,
-					       ctx->rdclass, NULL, mctx, &key,
-					       NULL);
-		}
-
-		if (!ctx->quiet && show_progress) {
 			putc('\n', stderr);
 			fflush(stderr);
+		} else {
+			ret = dst_key_generate(name, ctx->alg, ctx->size, param,
+					       flags, ctx->protocol,
+					       ctx->rdclass, mctx, &key, NULL);
 		}

 		if (ret != ISC_R_SUCCESS) {
@@ -678,7 +720,7 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 			}

 			if (ctx->setrev) {
-				if (!ctx->wantksk) {
+				if (ctx->kskflag == 0) {
 					fprintf(stderr,
 						"%s: warning: Key is "
 						"not flagged as a KSK, but -R "
@@ -753,9 +795,7 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 		 * if there is a risk of ID collision due to this key
 		 * or another key being revoked.
 		 */
-		if (key_collision(key, name, ctx->directory, mctx, ctx->tag_min,
-				  ctx->tag_max, NULL))
-		{
+		if (key_collision(key, name, ctx->directory, mctx, NULL)) {
 			conflict = true;
 			if (null_key) {
 				dst_key_free(&key);
@@ -820,18 +860,6 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 	}
 }

-static void
-check_keystore_options(keygen_ctx_t *ctx) {
-	ctx->directory = dns_keystore_directory(ctx->keystore, NULL);
-	if (ctx->directory != NULL) {
-		isc_result_t ret = try_dir(ctx->directory);
-		if (ret != ISC_R_SUCCESS) {
-			fatal("cannot open directory %s: %s", ctx->directory,
-			      isc_result_totext(ret));
-		}
-	}
-}
-
 int
 main(int argc, char **argv) {
 	char *algname = NULL, *freeit = NULL;
@@ -840,8 +868,13 @@ main(int argc, char **argv) {
 	isc_mem_t *mctx = NULL;
 	isc_result_t ret;
 	isc_textregion_t r;
+	const char *engine = NULL;
 	unsigned char c;
 	int ch;
+	bool set_fips_mode = false;
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+	OSSL_PROVIDER *fips = NULL, *base = NULL;
+#endif

 	keygen_ctx_t ctx = {
 		.options = DST_TYPE_PRIVATE | DST_TYPE_PUBLIC,
@@ -860,8 +893,8 @@ main(int argc, char **argv) {
 	/*
 	 * Process memory debugging argument first.
 	 */
-#define CMDLINE_FLAGS                                          \
-	"3A:a:b:Cc:D:d:E:Ff:GhI:i:K:k:L:l:M:m:n:P:p:qR:r:S:s:" \
+#define CMDLINE_FLAGS                                        \
+	"3A:a:b:Cc:D:d:E:Ff:GhI:i:K:k:L:l:m:n:P:p:qR:r:S:s:" \
 	"T:t:v:V"
 	while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (ch) {
@@ -914,16 +947,14 @@ main(int argc, char **argv) {
 			}
 			break;
 		case 'E':
-			fatal("%s", isc_result_totext(DST_R_NOENGINE));
+			engine = isc_commandline_argument;
 			break;
 		case 'f':
 			c = (unsigned char)(isc_commandline_argument[0]);
 			if (toupper(c) == 'K') {
-				ctx.wantksk = true;
-			} else if (toupper(c) == 'Z') {
-				ctx.wantzsk = true;
+				ctx.kskflag = DNS_KEYFLAG_KSK;
 			} else if (toupper(c) == 'R') {
-				ctx.wantrev = true;
+				ctx.revflag = DNS_KEYFLAG_REVOKE;
 			} else {
 				fatal("unknown flag '%s'",
 				      isc_commandline_argument);
@@ -950,21 +981,6 @@ main(int argc, char **argv) {
 		case 'n':
 			ctx.nametype = isc_commandline_argument;
 			break;
-		case 'M': {
-			unsigned long ul;
-			ctx.tag_min = ul = strtoul(isc_commandline_argument,
-						   &endp, 10);
-			if (*endp != ':' || ul > 0xffff) {
-				fatal("-M range invalid");
-			}
-			ctx.tag_max = ul = strtoul(endp + 1, &endp, 10);
-			if (*endp != '\0' || ul > 0xffff ||
-			    ctx.tag_max <= ctx.tag_min)
-			{
-				fatal("-M range invalid");
-			}
-			break;
-		}
 		case 'm':
 			break;
 		case 'p':
@@ -1100,9 +1116,7 @@ main(int argc, char **argv) {
 			ctx.prepub = strtottl(isc_commandline_argument);
 			break;
 		case 'F':
-			if (isc_crypto_fips_enable() != ISC_R_SUCCESS) {
-				fatal("setting FIPS mode failed");
-			}
+			set_fips_mode = true;
 			break;
 		case '?':
 			if (isc_commandline_option != '?') {
@@ -1121,7 +1135,7 @@ main(int argc, char **argv) {
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n", program,
 				isc_commandline_option);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}

@@ -1129,15 +1143,41 @@ main(int argc, char **argv) {
 		ctx.quiet = true;
 	}

+	if (set_fips_mode) {
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+		fips = OSSL_PROVIDER_load(NULL, "fips");
+		if (fips == NULL) {
+			ERR_clear_error();
+			fatal("Failed to load FIPS provider");
+		}
+		base = OSSL_PROVIDER_load(NULL, "base");
+		if (base == NULL) {
+			OSSL_PROVIDER_unload(fips);
+			ERR_clear_error();
+			fatal("Failed to load base provider");
+		}
+#endif
+		if (!isc_fips_mode()) {
+			if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
+				fatal("setting FIPS mode failed");
+			}
+		}
+	}
+
+	ret = dst_lib_init(mctx, engine);
+	if (ret != ISC_R_SUCCESS) {
+		fatal("could not initialize dst: %s", isc_result_totext(ret));
+	}
+
 	/*
-	 * The DST subsystem will set FIPS mode if requested at build time.
-	 * The minimum sizes are both raised to 2048.
+	 * After dst_lib_init which will set FIPS mode if requested
+	 * at build time.  The minumums are both raised to 2048.
 	 */
-	if (isc_crypto_fips_mode()) {
+	if (isc_fips_mode()) {
 		min_rsa = min_dh = 2048;
 	}

-	setup_logging();
+	setup_logging(mctx, &lctx);

 	ctx.rdclass = strtoclass(classname);

@@ -1188,8 +1228,8 @@ main(int argc, char **argv) {
 		if (ctx.size != -1) {
 			fatal("-k and -b cannot be used together");
 		}
-		if (ctx.wantrev) {
-			fatal("-k and -fR cannot be used together");
+		if (ctx.kskflag || ctx.revflag) {
+			fatal("-k and -f cannot be used together");
 		}
 		if (ctx.options & DST_TYPE_KEY) {
 			fatal("-k and -T KEY cannot be used together");
@@ -1204,13 +1244,12 @@ main(int argc, char **argv) {
 			ctx.use_nsec3 = false;
 			ctx.alg = DST_ALG_ECDSA256;
 			ctx.size = 0;
+			ctx.kskflag = DNS_KEYFLAG_KSK;
 			ctx.ttl = 3600;
 			ctx.setttl = true;
 			ctx.ksk = true;
 			ctx.zsk = true;
 			ctx.lifetime = 0;
-			ctx.tag_min = 0;
-			ctx.tag_max = 0xffff;

 			keygen(&ctx, mctx, argc, argv);
 		} else {
@@ -1219,7 +1258,7 @@ main(int argc, char **argv) {
 			dns_kasp_t *kasp = NULL;
 			dns_kasp_key_t *kaspkey = NULL;

-			RUNTIME_CHECK(cfg_parser_create(mctx, &parser) ==
+			RUNTIME_CHECK(cfg_parser_create(mctx, lctx, &parser) ==
 				      ISC_R_SUCCESS);
 			if (cfg_parse_file(parser, ctx.configfile,
 					   &cfg_type_namedconf,
@@ -1230,8 +1269,7 @@ main(int argc, char **argv) {
 				      ctx.policy, ctx.configfile);
 			}

-			kasp_from_conf(config, mctx, ctx.policy, ctx.directory,
-				       &kasp);
+			kasp_from_conf(config, mctx, ctx.policy, &kasp);
 			if (kasp == NULL) {
 				fatal("failed to load dnssec-policy '%s'",
 				      ctx.policy);
@@ -1245,28 +1283,22 @@ main(int argc, char **argv) {
 			ctx.ttl = dns_kasp_dnskeyttl(kasp);
 			ctx.setttl = true;

-			for (kaspkey = ISC_LIST_HEAD(dns_kasp_keys(kasp));
-			     kaspkey != NULL;
-			     kaspkey = ISC_LIST_NEXT(kaspkey, link))
-			{
+			kaspkey = ISC_LIST_HEAD(dns_kasp_keys(kasp));
+
+			while (kaspkey != NULL) {
 				ctx.use_nsec3 = false;
 				ctx.alg = dns_kasp_key_algorithm(kaspkey);
 				ctx.size = dns_kasp_key_size(kaspkey);
+				ctx.kskflag = dns_kasp_key_ksk(kaspkey)
+						      ? DNS_KEYFLAG_KSK
+						      : 0;
 				ctx.ksk = dns_kasp_key_ksk(kaspkey);
 				ctx.zsk = dns_kasp_key_zsk(kaspkey);
 				ctx.lifetime = dns_kasp_key_lifetime(kaspkey);
-				ctx.keystore = dns_kasp_key_keystore(kaspkey);
-				if (ctx.keystore != NULL) {
-					check_keystore_options(&ctx);
-				}
-				ctx.tag_min = dns_kasp_key_tagmin(kaspkey);
-				ctx.tag_max = dns_kasp_key_tagmax(kaspkey);
-				if ((ctx.ksk && !ctx.wantksk && ctx.wantzsk) ||
-				    (ctx.zsk && !ctx.wantzsk && ctx.wantksk))
-				{
-					continue;
-				}
+
 				keygen(&ctx, mctx, argc, argv);
+
+				kaspkey = ISC_LIST_NEXT(kaspkey, link);
 			}

 			dns_kasp_detach(&kasp);
@@ -1277,14 +1309,24 @@ main(int argc, char **argv) {
 		keygen(&ctx, mctx, argc, argv);
 	}

+	cleanup_logging(&lctx);
+	dst_lib_destroy();
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);

+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+	if (base != NULL) {
+		OSSL_PROVIDER_unload(base);
+	}
+	if (fips != NULL) {
+		OSSL_PROVIDER_unload(fips);
+	}
+#endif
 	if (freeit != NULL) {
 		free(freeit);
 	}

-	return 0;
+	return (0);
 }
@@ -21,13 +21,15 @@ dnssec-keygen: DNSSEC key generation tool
 Synopsis
 ~~~~~~~~

-:program:`dnssec-keygen` [**-3**] [**-A** date/offset] [**-a** algorithm] [**-b** keysize] [**-C**] [**-c** class] [**-D** date/offset] [**-d** bits] [**-D** sync date/offset] [**-f** flag] [**-F**] [**-G**] [**-h**] [**-I** date/offset] [**-i** interval] [**-K** directory] [**-k** policy] [**-L** ttl] [**-l** file] [**-M** tag_min:tag_max] [**-n** nametype] [**-P** date/offset] [**-P** sync date/offset] [**-p** protocol] [**-q**] [**-R** date/offset] [**-S** key] [**-s** strength] [**-T** rrtype] [**-t** type] [**-V**] [**-v** level] {name}
+:program:`dnssec-keygen` [**-3**] [**-A** date/offset] [**-a** algorithm] [**-b** keysize] [**-C**] [**-c** class] [**-D** date/offset] [**-d** bits] [**-D** sync date/offset] [**-E** engine] [**-f** flag] [**-F**] [**-G**] [**-h**] [**-I** date/offset] [**-i** interval] [**-K** directory] [**-k** policy] [**-L** ttl] [**-l** file] [**-n** nametype] [**-P** date/offset] [**-P** sync date/offset] [**-p** protocol] [**-q**] [**-R** date/offset] [**-S** key] [**-s** strength] [**-T** rrtype] [**-t** type] [**-V**] [**-v** level] {name}

 Description
 ~~~~~~~~~~~

 :program:`dnssec-keygen` generates keys for DNSSEC (Secure DNS), as defined in
-:rfc:`2535` and :rfc:`4034`.
+:rfc:`2535` and :rfc:`4034`. It can also generate keys for use with TSIG
+(Transaction Signatures) as defined in :rfc:`2845`, or TKEY (Transaction
+Key) as defined in :rfc:`2930`.

 The ``name`` of the key is specified on the command line. For DNSSEC
 keys, this must match the name of the zone for which the key is being
@@ -94,16 +96,18 @@ Options
   and 4096 bits. This option is ignored for algorithms ECDSAP256SHA256,
   ECDSAP384SHA384, ED25519, and ED448.

+.. option:: -E engine
+
+   This option specifies the cryptographic hardware to use, when applicable.
+
+   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
+   engine identifier that drives the cryptographic accelerator or
+   hardware service module (usually ``pkcs11``).
+
 .. option:: -f flag

   This option sets the specified flag in the flag field of the KEY/DNSKEY record.
-   The only recognized flags are ZSK (Zone-Signing Key), KSK (Key-Signing Key)
-   and REVOKE.
-
-   Note that ZSK is not a physical flag in the DNSKEY record, it is merely used
-   to explicitly tell that you want to create a ZSK. Setting :option:`-f` in
-   conjunction with :option:`-k` will result in generating keys that only
-   match the given role set with this option.
+   The only recognized flags are KSK (Key-Signing Key) and REVOKE.

 .. option:: -F

@@ -150,19 +154,6 @@ Options
   This option provides a configuration file that contains a ``dnssec-policy`` statement
   (matching the policy set with :option:`-k`).

-.. option:: -M tag_min:tag_max
-
-   This option sets the range of acceptable key tag values that ``dnssec-keygen``
-   will produce. If the key tag of the new key or the key tag of
-   the revoked version of the new key is outside this range,
-   the new key will be rejected and another new key will be generated.
-   This is designed to be used when generating keys in a multi-signer
-   scenario, where each operator is given a range of key tags to
-   prevent collisions among different operators.  The valid values
-   for ``tag_min`` and ``tag_max`` are [0..65535].  The default allows all
-   key tag values to be produced.  This option is ignored when ``-k policy``
-   is specified.
-
 .. option:: -n nametype

   This option specifies the owner type of the key. The value of ``nametype`` must
@@ -1,164 +0,0 @@
-.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-..
-.. SPDX-License-Identifier: MPL-2.0
-..
-.. This Source Code Form is subject to the terms of the Mozilla Public
-.. License, v. 2.0.  If a copy of the MPL was not distributed with this
-.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
-..
-.. See the COPYRIGHT file distributed with this work for additional
-.. information regarding copyright ownership.
-
-.. highlight: console
-
-.. iscman:: dnssec-ksr
-.. program:: dnssec-ksr
-.. _man_dnssec-ksr:
-
-dnssec-ksr - Create signed key response (SKR) files for offline KSK setups
--------------------------------------------------------------------------
-
-Synopsis
-~~~~~~~~
-
-:program:`dnssec-ksr` [**-e** date/offset] [**-F**] [**-f** file] [**-h**] [**-i** date/offset] [**-K** directory] [**-k** policy] [**-l** file] [**-o**] [**-V**] [**-v** level] {command} {zone}
-
-Description
-~~~~~~~~~~~
-
-The :program:`dnssec-ksr` can be used to issue several commands that are needed
-to generate presigned RRsets for a zone where the private key file of the Key
-Signing Key (KSK) is typically offline. This requires Zone Signing Keys
-(ZSKs) to be pregenerated, and the DNSKEY, CDNSKEY, and CDS RRsets to be
-already signed in advance.
-
-The latter is done by creating Key Signing Requests (KSRs) that can be imported
-to the environment where the KSK is available. Once there, this program can
-create Signed Key Responses (SKRs) that can be loaded by an authoritative DNS
-server.
-
-Options
-~~~~~~~
-
-.. option:: -e date/offset
-
-   This option sets the end date for which keys or SKRs need to be generated
-   (depending on the command).
-
-.. option:: -F
-
-   This options turns on FIPS (US Federal Information Processing Standards)
-   mode if the underlying crytographic library supports running in FIPS
-   mode.
-
-.. option:: -f
-
-   This option sets the SKR file to be signed when issuing a ``sign`` command.
-
-.. option:: -h
-
-   This option prints a short summary of the options and arguments to
-   :program:`dnssec-ksr`.
-
-.. option:: -i date/offset
-
-   This option sets the start date for which keys or SKRs need to be generated
-   (depending on the command).
-
-.. option:: -K directory
-
-   This option sets the directory in which the key files are to be read or
-   written (depending on the command).
-
-.. option:: -k policy
-
-   This option sets the specific ``dnssec-policy`` for which keys need to
-   be generated, or signed.
-
-.. option:: -l file
-
-   This option provides a configuration file that contains a ``dnssec-policy``
-   statement (matching the policy set with :option:`-k`).
-
-.. option:: -o
-
-   Normally when pregenerating keys, ZSKs are created. When this option is
-   set, create KSKs instead.
-
-.. option:: -V
-
-   This option prints version information.
-
-.. option:: -v level
-
-   This option sets the debugging level. Level 1 is intended to be usefully
-   verbose for general users; higher levels are intended for developers.
-
-``command``
-
-   The KSR command to be executed. See below for the available commands.
-
-``zone``
-
-   The name of the zone for which the KSR command is being executed.
-
-Commands
-~~~~~~~~
-
-.. option:: keygen
-
-  Pregenerate a number of keys, given a DNSSEC policy and an interval. The
-  number of generated keys depends on the interval and the key lifetime.
-
-.. option:: request
-
-  Create a Key Signing Request (KSR), given a DNSSEC policy and an interval.
-  This will generate a file with a number of key bundles, where each bundle
-  contains the currently published ZSKs (according to the timing metadata).
-
-.. option:: sign
-
-  Sign a Key Signing Request (KSR), given a DNSSEC policy and an interval,
-  creating a Signed Key Response (SKR). This will add the corresponding DNSKEY,
-  CDS, and CDNSKEY records for the KSK that is being used for signing.
-
-Exit Status
-~~~~~~~~~~~
-
-The :program:`dnssec-ksr` command exits 0 on success, or non-zero if an error
-occurred.
-
-Examples
-~~~~~~~~
-
-When you need to generate ZSKs for the zone "example.com" for the next year,
-given a ``dnssec-policy`` named "mypolicy":
-
-::
-
-    dnssec-ksr -i now -e +1y -k mypolicy -l named.conf keygen example.com
-
-Creating a KSR for the same zone and period can be done with:
-
-::
-
-    dnssec-ksr -i now -e +1y -k mypolicy -l named.conf request example.com > ksr.txt
-
-Typically you would now transfer the KSR to the system that has access to
-the KSK.
-
-Signing the KSR created above can be done with:
-
-::
-
-    dnssec-ksr -i now -e +1y -k kskpolicy -l named.conf -f ksr.txt sign example.com
-
-Make sure that the DNSSEC parameters in ``kskpolicy`` match those
-in ``mypolicy``.
-
-See Also
-~~~~~~~~
-
-:iscman:`dnssec-keygen(8) <dnssec-keygen>`,
-:iscman:`dnssec-signzone(8) <dnssec-signzone>`,
-BIND 9 Administrator Reference Manual.
@@ -23,14 +23,12 @@
 #include <isc/commandline.h>
 #include <isc/file.h>
 #include <isc/hash.h>
-#include <isc/lib.h>
 #include <isc/mem.h>
 #include <isc/result.h>
 #include <isc/string.h>
 #include <isc/util.h>

 #include <dns/keyvalues.h>
-#include <dns/lib.h>

 #include <dst/dst.h>

@@ -40,7 +38,7 @@ const char *program = "dnssec-revoke";

 static isc_mem_t *mctx = NULL;

-ISC_NORETURN static void
+noreturn static void
 usage(void);

 static void
@@ -48,6 +46,7 @@ usage(void) {
 	fprintf(stderr, "Usage:\n");
 	fprintf(stderr, "    %s [options] keyfile\n\n", program);
 	fprintf(stderr, "Version: %s\n", PACKAGE_VERSION);
+	fprintf(stderr, "    -E engine:    specify OpenSSL engine\n");
 	fprintf(stderr, "    -f:           force overwrite\n");
 	fprintf(stderr, "    -h:           help\n");
 	fprintf(stderr, "    -K directory: use directory for key files\n");
@@ -59,12 +58,13 @@ usage(void) {
 	fprintf(stderr, "     K<name>+<alg>+<new id>.key, "
 			"K<name>+<alg>+<new id>.private\n");

-	exit(EXIT_FAILURE);
+	exit(-1);
 }

 int
 main(int argc, char **argv) {
 	isc_result_t result;
+	const char *engine = NULL;
 	char const *filename = NULL;
 	char *dir = NULL;
 	char newname[1024], oldname[1024];
@@ -89,7 +89,7 @@ main(int argc, char **argv) {
 	while ((ch = isc_commandline_parse(argc, argv, "E:fK:rRhv:V")) != -1) {
 		switch (ch) {
 		case 'E':
-			fatal("%s", isc_result_totext(DST_R_NOENGINE));
+			engine = isc_commandline_argument;
 			break;
 		case 'f':
 			force = true;
@@ -130,7 +130,7 @@ main(int argc, char **argv) {
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n", program,
 				isc_commandline_option);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}

@@ -159,6 +159,12 @@ main(int argc, char **argv) {
 		}
 	}

+	result = dst_lib_init(mctx, engine);
+	if (result != ISC_R_SUCCESS) {
+		fatal("Could not initialize dst: %s",
+		      isc_result_totext(result));
+	}
+
 	result = dst_key_fromnamedfile(
 		filename, dir, DST_TYPE_PUBLIC | DST_TYPE_PRIVATE, mctx, &key);
 	if (result != ISC_R_SUCCESS) {
@@ -242,13 +248,14 @@ main(int argc, char **argv) {

 cleanup:
 	dst_key_free(&key);
+	dst_lib_destroy();
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
 	if (dir != NULL) {
 		isc_mem_free(mctx, dir);
 	}
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);

-	return 0;
+	return (0);
 }
@@ -21,7 +21,7 @@ dnssec-revoke - set the REVOKED bit on a DNSSEC key
 Synopsis
 ~~~~~~~~

-:program:`dnssec-revoke` [**-hr**] [**-v** level] [**-V**] [**-K** directory] [**-f**] [**-R**] {keyfile}
+:program:`dnssec-revoke` [**-hr**] [**-v** level] [**-V**] [**-K** directory] [**-E** engine] [**-f**] [**-R**] {keyfile}

 Description
 ~~~~~~~~~~~
@@ -53,6 +53,14 @@ Options

   This option prints version information.

+.. option:: -E engine
+
+   This option specifies the cryptographic hardware to use, when applicable.
+
+   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
+   engine identifier that drives the cryptographic accelerator or
+   hardware service module (usually ``pkcs11``).
+
 .. option:: -f

   This option indicates a forced overwrite and causes :program:`dnssec-revoke` to write the new key pair,
@@ -25,8 +25,6 @@
 #include <isc/commandline.h>
 #include <isc/file.h>
 #include <isc/hash.h>
-#include <isc/lib.h>
-#include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
 #include <isc/string.h>
@@ -34,7 +32,7 @@
 #include <isc/util.h>

 #include <dns/keyvalues.h>
-#include <dns/lib.h>
+#include <dns/log.h>

 #include <dst/dst.h>

@@ -44,7 +42,7 @@ const char *program = "dnssec-settime";

 static isc_mem_t *mctx = NULL;

-ISC_NORETURN static void
+noreturn static void
 usage(void);

 static void
@@ -53,6 +51,7 @@ usage(void) {
 	fprintf(stderr, "    %s [options] keyfile\n\n", program);
 	fprintf(stderr, "Version: %s\n", PACKAGE_VERSION);
 	fprintf(stderr, "General options:\n");
+	fprintf(stderr, "    -E engine:          specify OpenSSL engine\n");
 	fprintf(stderr, "    -f:                 force update of old-style "
 			"keys\n");
 	fprintf(stderr, "    -K directory:       set key file location\n");
@@ -102,7 +101,7 @@ usage(void) {
 	fprintf(stderr, "     K<name>+<alg>+<new id>.key, "
 			"K<name>+<alg>+<new id>.private\n");

-	exit(EXIT_FAILURE);
+	exit(-1);
 }

 static void
@@ -187,6 +186,7 @@ writekey(dst_key_t *key, const char *directory, bool write_state) {
 int
 main(int argc, char **argv) {
 	isc_result_t result;
+	const char *engine = NULL;
 	const char *filename = NULL;
 	char *directory = NULL;
 	char keystr[DST_KEY_FORMATSIZE];
@@ -228,6 +228,7 @@ main(int argc, char **argv) {
 	bool epoch = false;
 	bool changed = false;
 	bool write_state = false;
+	isc_log_t *log = NULL;
 	isc_stdtime_t syncadd = 0, syncdel = 0;
 	bool unsetsyncadd = false, setsyncadd = false;
 	bool unsetsyncdel = false, setsyncdel = false;
@@ -246,7 +247,7 @@ main(int argc, char **argv) {

 	isc_mem_create(&mctx);

-	setup_logging();
+	setup_logging(mctx, &log);

 	isc_commandline_errprint = false;

@@ -313,7 +314,7 @@ main(int argc, char **argv) {
 					   &setdstime);
 			break;
 		case 'E':
-			fatal("%s", isc_result_totext(DST_R_NOENGINE));
+			engine = isc_commandline_argument;
 			break;
 		case 'f':
 			force = true;
@@ -535,7 +536,7 @@ main(int argc, char **argv) {
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n", program,
 				isc_commandline_option);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}

@@ -554,6 +555,12 @@ main(int argc, char **argv) {
 		fatal("Options -g, -d, -k, -r and -z require -s to be set");
 	}

+	result = dst_lib_init(mctx, engine);
+	if (result != ISC_R_SUCCESS) {
+		fatal("Could not initialize dst: %s",
+		      isc_result_totext(result));
+	}
+
 	if (predecessor != NULL) {
 		int major, minor;

@@ -945,11 +952,13 @@ main(int argc, char **argv) {
 		dst_key_free(&prevkey);
 	}
 	dst_key_free(&key);
+	dst_lib_destroy();
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
+	cleanup_logging(&log);
 	isc_mem_free(mctx, directory);
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);

-	return 0;
+	return (0);
 }
@@ -21,7 +21,7 @@ dnssec-settime: set the key timing metadata for a DNSSEC key
 Synopsis
 ~~~~~~~~

-:program:`dnssec-settime` [**-f**] [**-K** directory] [**-L** ttl] [**-P** date/offset] [**-P** ds date/offset] [**-P** sync date/offset] [**-A** date/offset] [**-R** date/offset] [**-I** date/offset] [**-D** date/offset] [**-D** ds date/offset] [**-D** sync date/offset] [**-S** key] [**-i** interval] [**-h**] [**-V**] [**-v** level] {keyfile} [**-s**] [**-g** state] [**-d** state date/offset] [**-k** state date/offset] [**-r** state date/offset] [**-z** state date/offset]
+:program:`dnssec-settime` [**-f**] [**-K** directory] [**-L** ttl] [**-P** date/offset] [**-P** ds date/offset] [**-P** sync date/offset] [**-A** date/offset] [**-R** date/offset] [**-I** date/offset] [**-D** date/offset] [**-D** ds date/offset] [**-D** sync date/offset] [**-S** key] [**-i** interval] [**-h**] [**-V**] [**-v** level] [**-E** engine] {keyfile} [**-s**] [**-g** state] [**-d** state date/offset] [**-k** state date/offset] [**-r** state date/offset] [**-z** state date/offset]

 Description
 ~~~~~~~~~~~
@@ -97,6 +97,14 @@ Options

   This option sets the debugging level.

+.. option:: -E engine
+
+   This option specifies the cryptographic hardware to use, when applicable.
+
+   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
+   engine identifier that drives the cryptographic accelerator or
+   hardware service module (usually ``pkcs11``).
+
 Timing Options
 ~~~~~~~~~~~~~~

@@ -42,10 +42,9 @@
 #include <isc/commandline.h>
 #include <isc/dir.h>
 #include <isc/file.h>
+#include <isc/fips.h>
 #include <isc/hash.h>
 #include <isc/hex.h>
-#include <isc/lib.h>
-#include <isc/log.h>
 #include <isc/loop.h>
 #include <isc/managers.h>
 #include <isc/md.h>
@@ -71,7 +70,7 @@
 #include <dns/fixedname.h>
 #include <dns/kasp.h>
 #include <dns/keyvalues.h>
-#include <dns/lib.h>
+#include <dns/log.h>
 #include <dns/master.h>
 #include <dns/masterdump.h>
 #include <dns/nsec.h>
@@ -89,6 +88,10 @@
 #include <dns/zoneverify.h>

 #include <dst/dst.h>
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+#include <openssl/err.h>
+#include <openssl/provider.h>
+#endif

 #include "dnssectool.h"

@@ -137,10 +140,10 @@ static dns_masterformat_t inputformat = dns_masterformat_text;
 static dns_masterformat_t outputformat = dns_masterformat_text;
 static uint32_t rawversion = 1, serialnum = 0;
 static bool snset = false;
-static atomic_uint_fast32_t nsigned = 0, nretained = 0, ndropped = 0;
-static atomic_uint_fast32_t nverified = 0, nverifyfailed = 0;
+static unsigned int nsigned = 0, nretained = 0, ndropped = 0;
+static unsigned int nverified = 0, nverifyfailed = 0;
 static const char *directory = NULL, *dsdir = NULL;
-static isc_mutex_t namelock;
+static isc_mutex_t namelock, statslock;
 static isc_nm_t *netmgr = NULL;
 static isc_loopmgr_t *loopmgr = NULL;
 static dns_db_t *gdb;		  /* The database */
@@ -179,9 +182,11 @@ static dns_ttl_t maxttl = 0;
 static bool no_max_check = false;
 static const char *sync_records = "cdnskey,cds:sha-256";

-#define INCSTAT(counter)                               \
-	if (printstats) {                              \
-		atomic_fetch_add_relaxed(&counter, 1); \
+#define INCSTAT(counter)            \
+	if (printstats) {           \
+		LOCK(&statslock);   \
+		counter++;          \
+		UNLOCK(&statslock); \
 	}

 /*%
@@ -194,7 +199,7 @@ savezonecut(dns_fixedname_t *fzonecut, dns_name_t *name) {
 	result = dns_fixedname_initname(fzonecut);
 	dns_name_copy(name, result);

-	return result;
+	return (result);
 }

 static void
@@ -315,35 +320,36 @@ signwithkey(dns_name_t *name, dns_rdataset_t *rdataset, dst_key_t *key,
 	}

 	tuple = NULL;
-	dns_difftuple_create(mctx, DNS_DIFFOP_ADDRESIGN, name, ttl, &trdata,
-			     &tuple);
+	result = dns_difftuple_create(mctx, DNS_DIFFOP_ADDRESIGN, name, ttl,
+				      &trdata, &tuple);
+	check_result(result, "dns_difftuple_create");
 	dns_diff_append(add, &tuple);
 }

 static bool
 issigningkey(dns_dnsseckey_t *key) {
-	return key->force_sign || key->hint_sign;
+	return (key->force_sign || key->hint_sign);
 }

 static bool
 ispublishedkey(dns_dnsseckey_t *key) {
-	return (key->force_publish || key->hint_publish) && !key->hint_remove;
+	return ((key->force_publish || key->hint_publish) && !key->hint_remove);
 }

 static bool
 iszonekey(dns_dnsseckey_t *key) {
-	return dns_name_equal(dst_key_name(key->key), gorigin) &&
-	       dst_key_iszonekey(key->key);
+	return (dns_name_equal(dst_key_name(key->key), gorigin) &&
+		dst_key_iszonekey(key->key));
 }

 static bool
 isksk(dns_dnsseckey_t *key) {
-	return key->ksk;
+	return (key->ksk);
 }

 static bool
 iszsk(dns_dnsseckey_t *key) {
-	return ignore_kskflag || !key->ksk;
+	return (ignore_kskflag || !key->ksk);
 }

 /*%
@@ -363,10 +369,10 @@ keythatsigned_unlocked(dns_rdata_rrsig_t *rrsig) {
 		    rrsig->algorithm == dst_key_alg(key->key) &&
 		    dns_name_equal(&rrsig->signer, dst_key_name(key->key)))
 		{
-			return key;
+			return (key);
 		}
 	}
-	return NULL;
+	return (NULL);
 }

 /*%
@@ -383,7 +389,7 @@ keythatsigned(dns_rdata_rrsig_t *rrsig) {
 	key = keythatsigned_unlocked(rrsig);
 	RWUNLOCK(&keylist_lock, isc_rwlocktype_read);
 	if (key != NULL) {
-		return key;
+		return (key);
 	}

 	/*
@@ -397,7 +403,7 @@ keythatsigned(dns_rdata_rrsig_t *rrsig) {
 	key = keythatsigned_unlocked(rrsig);
 	if (key != NULL) {
 		isc_rwlock_unlock(&keylist_lock, isc_rwlocktype_write);
-		return key;
+		return (key);
 	}

 	result = dst_key_fromfile(&rrsig->signer, rrsig->keyid,
@@ -405,7 +411,7 @@ keythatsigned(dns_rdata_rrsig_t *rrsig) {
 				  mctx, &pubkey);
 	if (result != ISC_R_SUCCESS) {
 		isc_rwlock_unlock(&keylist_lock, isc_rwlocktype_write);
-		return NULL;
+		return (NULL);
 	}

 	result = dst_key_fromfile(
@@ -416,14 +422,15 @@ keythatsigned(dns_rdata_rrsig_t *rrsig) {
 		dns_dnsseckey_create(mctx, &privkey, &key);
 	} else {
 		dns_dnsseckey_create(mctx, &pubkey, &key);
-		key->pubkey = true;
 	}

+	key->force_publish = false;
+	key->force_sign = false;
 	key->index = keycount++;
 	ISC_LIST_APPEND(keylist, key, link);

 	isc_rwlock_unlock(&keylist_lock, isc_rwlocktype_write);
-	return key;
+	return (key);
 }

 /*%
@@ -445,11 +452,11 @@ expecttofindkey(dns_name_t *name) {
 	case ISC_R_SUCCESS:
 	case DNS_R_NXDOMAIN:
 	case DNS_R_NXRRSET:
-		return true;
+		return (true);
 	case DNS_R_DELEGATION:
 	case DNS_R_CNAME:
 	case DNS_R_DNAME:
-		return false;
+		return (false);
 	default:
 		break;
 	}
@@ -457,7 +464,7 @@ expecttofindkey(dns_name_t *name) {
 	fatal("failure looking for '%s DNSKEY' in database: %s", namestr,
 	      isc_result_totext(result));
 	UNREACHABLE();
-	return false; /* removes a warning */
+	return (false); /* removes a warning */
 }

 static bool
@@ -467,10 +474,10 @@ setverifies(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
 	result = dns_dnssec_verify(name, set, key, false, 0, mctx, rrsig, NULL);
 	if (result == ISC_R_SUCCESS || result == DNS_R_FROMWILDCARD) {
 		INCSTAT(nverified);
-		return true;
+		return (true);
 	} else {
 		INCSTAT(nverifyfailed);
-		return false;
+		return (false);
 	}
 }

@@ -536,7 +543,7 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 	}

 	while (result == ISC_R_SUCCESS) {
-		bool expired, refresh, future, offline;
+		bool expired, future;
 		bool keep = false, resign = false;

 		dns_rdataset_current(&sigset, &sigrdata);
@@ -547,10 +554,8 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 		future = isc_serial_lt(now, rrsig.timesigned);

 		key = keythatsigned(&rrsig);
-		offline = (key != NULL) ? key->pubkey : false;
 		sig_format(&rrsig, sigstr, sizeof(sigstr));
-		expired = isc_serial_gt(now, rrsig.timeexpire);
-		refresh = isc_serial_gt(now + cycle, rrsig.timeexpire);
+		expired = isc_serial_gt(now + cycle, rrsig.timeexpire);

 		if (isc_serial_gt(rrsig.timesigned, rrsig.timeexpire)) {
 			/* rrsig is dropped and not replaced */
@@ -579,21 +584,15 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 		} else if (issigningkey(key)) {
 			wassignedby[key->index] = true;

-			if (!refresh && rrsig.originalttl == set->ttl &&
+			if (!expired && rrsig.originalttl == set->ttl &&
 			    setverifies(name, set, key->key, &sigrdata))
 			{
 				vbprintf(2, "\trrsig by %s retained\n", sigstr);
 				keep = true;
-			} else if (offline) {
-				vbprintf(2,
-					 "\trrsig by %s retained - private key "
-					 "missing\n",
-					 sigstr);
-				keep = true;
 			} else {
 				vbprintf(2, "\trrsig by %s dropped - %s\n",
 					 sigstr,
-					 refresh ? "refresh"
+					 expired ? "expired"
 					 : rrsig.originalttl != set->ttl
 						 ? "ttl change"
 						 : "failed to "
@@ -606,32 +605,25 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 		} else if (iszonekey(key)) {
 			wassignedby[key->index] = true;

-			if (!refresh && rrsig.originalttl == set->ttl &&
+			if (!expired && rrsig.originalttl == set->ttl &&
 			    setverifies(name, set, key->key, &sigrdata))
 			{
 				vbprintf(2, "\trrsig by %s retained\n", sigstr);
 				keep = true;
-			} else if (offline) {
-				vbprintf(2,
-					 "\trrsig by %s retained - private key "
-					 "missing\n",
-					 sigstr);
-				keep = true;
 			} else {
 				vbprintf(2, "\trrsig by %s dropped - %s\n",
 					 sigstr,
-					 refresh ? "refresh"
+					 expired ? "expired"
 					 : rrsig.originalttl != set->ttl
 						 ? "ttl change"
 						 : "failed to "
 						   "verify");
 			}
-		} else if (!refresh) {
+		} else if (!expired) {
 			vbprintf(2, "\trrsig by %s retained\n", sigstr);
 			keep = true;
 		} else {
-			vbprintf(2, "\trrsig by %s %s\n", sigstr,
-				 expired ? "expired" : "needs refresh");
+			vbprintf(2, "\trrsig by %s expired\n", sigstr);
 		}

 		if (keep) {
@@ -642,20 +634,24 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 			if (sigset.ttl != ttl) {
 				vbprintf(2, "\tfixing ttl %s\n", sigstr);
 				tuple = NULL;
-				dns_difftuple_create(mctx, DNS_DIFFOP_DELRESIGN,
-						     name, sigset.ttl,
-						     &sigrdata, &tuple);
+				result = dns_difftuple_create(
+					mctx, DNS_DIFFOP_DELRESIGN, name,
+					sigset.ttl, &sigrdata, &tuple);
+				check_result(result, "dns_difftuple_create");
 				dns_diff_append(del, &tuple);
-				dns_difftuple_create(mctx, DNS_DIFFOP_ADDRESIGN,
-						     name, ttl, &sigrdata,
-						     &tuple);
+				result = dns_difftuple_create(
+					mctx, DNS_DIFFOP_ADDRESIGN, name, ttl,
+					&sigrdata, &tuple);
+				check_result(result, "dns_difftuple_create");
 				dns_diff_append(add, &tuple);
 			}
 		} else {
 			tuple = NULL;
 			vbprintf(2, "\tremoving signature by %s\n", sigstr);
-			dns_difftuple_create(mctx, DNS_DIFFOP_DELRESIGN, name,
-					     sigset.ttl, &sigrdata, &tuple);
+			result = dns_difftuple_create(
+				mctx, DNS_DIFFOP_DELRESIGN, name, sigset.ttl,
+				&sigrdata, &tuple);
+			check_result(result, "dns_difftuple_create");
 			dns_diff_append(del, &tuple);
 			INCSTAT(ndropped);
 		}
@@ -684,10 +680,6 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 	for (key = ISC_LIST_HEAD(keylist); key != NULL;
 	     key = ISC_LIST_NEXT(key, link))
 	{
-		if (REVOKE(key->key) && set->type != dns_rdatatype_dnskey) {
-			continue;
-		}
-
 		if (nowsignedby[key->index]) {
 			continue;
 		}
@@ -870,7 +862,7 @@ hashlist_add_dns_name(hashlist_t *l,

 static int
 hashlist_comp(const void *a, const void *b) {
-	return memcmp(a, b, hash_length + 1);
+	return (memcmp(a, b, hash_length + 1));
 }

 static void
@@ -902,11 +894,11 @@ hashlist_hasdup(hashlist_t *l) {
 			continue;
 		}
 		if (isc_safe_memequal(current, next, l->length - 1)) {
-			return true;
+			return (true);
 		}
 		current = next;
 	}
-	return false;
+	return (false);
 }

 static const unsigned char *
@@ -928,16 +920,16 @@ hashlist_findnext(const hashlist_t *l,
 		}
 	} while (entries-- > 1U);
 	INSIST(entries != 0U);
-	return next;
+	return (next);
 }

 static bool
 hashlist_exists(const hashlist_t *l,
 		const unsigned char hash[NSEC3_MAX_HASH_LENGTH]) {
 	if (bsearch(hash, l->hashbuf, l->entries, l->length, hashlist_comp)) {
-		return true;
+		return (true);
 	} else {
-		return false;
+		return (false);
 	}
 }

@@ -954,7 +946,7 @@ addnowildcardhash(hashlist_t *l,

 	wild = dns_fixedname_initname(&fixed);

-	result = dns_name_concatenate(dns_wildcardname, name, wild);
+	result = dns_name_concatenate(dns_wildcardname, name, wild, NULL);
 	if (result == ISC_R_NOSPACE) {
 		return;
 	}
@@ -1006,8 +998,8 @@ opendb(const char *prefix, dns_name_t *name, dns_rdataclass_t rdclass,
 	}
 	isc_buffer_putuint8(&b, 0);

-	result = dns_db_create(mctx, ZONEDB_DEFAULT, dns_rootname,
-			       dns_dbtype_zone, rdclass, 0, NULL, dbp);
+	result = dns_db_create(mctx, "rbt", dns_rootname, dns_dbtype_zone,
+			       rdclass, 0, NULL, dbp);
 	check_result(result, "dns_db_create()");

 	result = dns_db_load(*dbp, filename, inputformat, DNS_MASTER_HINT);
@@ -1046,7 +1038,7 @@ loadds(dns_name_t *name, uint32_t ttl, dns_rdataset_t *dsset) {
 				vbprintf(2, "found DS records\n");
 				dsset->ttl = ttl;
 				dns_db_detach(&db);
-				return result;
+				return (result);
 			}
 		}
 		dns_db_detach(&db);
@@ -1055,13 +1047,13 @@ loadds(dns_name_t *name, uint32_t ttl, dns_rdataset_t *dsset) {
 	/* No DS records found; try again, looking for DNSKEY records */
 	opendb("keyset-", name, gclass, &db);
 	if (db == NULL) {
-		return ISC_R_NOTFOUND;
+		return (ISC_R_NOTFOUND);
 	}

 	result = dns_db_findnode(db, name, false, &node);
 	if (result != ISC_R_SUCCESS) {
 		dns_db_detach(&db);
-		return result;
+		return (result);
 	}

 	dns_rdataset_init(&keyset);
@@ -1070,7 +1062,7 @@ loadds(dns_name_t *name, uint32_t ttl, dns_rdataset_t *dsset) {
 	if (result != ISC_R_SUCCESS) {
 		dns_db_detachnode(db, &node);
 		dns_db_detach(&db);
-		return result;
+		return (result);
 	}
 	vbprintf(2, "found DNSKEY records\n");

@@ -1088,8 +1080,9 @@ loadds(dns_name_t *name, uint32_t ttl, dns_rdataset_t *dsset) {
 					   dsbuf, &ds);
 		check_result(result, "dns_ds_buildrdata");

-		dns_difftuple_create(mctx, DNS_DIFFOP_ADDRESIGN, name, ttl, &ds,
-				     &tuple);
+		result = dns_difftuple_create(mctx, DNS_DIFFOP_ADDRESIGN, name,
+					      ttl, &ds, &tuple);
+		check_result(result, "dns_difftuple_create");
 		dns_diff_append(&diff, &tuple);
 	}

@@ -1106,7 +1099,7 @@ loadds(dns_name_t *name, uint32_t ttl, dns_rdataset_t *dsset) {
 	dns_rdataset_disassociate(&keyset);
 	dns_db_detachnode(db, &node);
 	dns_db_detach(&db);
-	return result;
+	return (result);
 }

 static bool
@@ -1115,7 +1108,7 @@ secure(dns_name_t *name, dns_dbnode_t *node) {
 	isc_result_t result;

 	if (dns_name_equal(name, gorigin)) {
-		return false;
+		return (false);
 	}

 	dns_rdataset_init(&dsset);
@@ -1125,7 +1118,7 @@ secure(dns_name_t *name, dns_dbnode_t *node) {
 		dns_rdataset_disassociate(&dsset);
 	}

-	return result == ISC_R_SUCCESS;
+	return (result == ISC_R_SUCCESS);
 }

 static bool
@@ -1135,7 +1128,7 @@ is_delegation(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *origin,
 	isc_result_t result;

 	if (dns_name_equal(name, origin)) {
-		return false;
+		return (false);
 	}

 	dns_rdataset_init(&nsset);
@@ -1148,7 +1141,7 @@ is_delegation(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *origin,
 		dns_rdataset_disassociate(&nsset);
 	}

-	return result == ISC_R_SUCCESS;
+	return ((result == ISC_R_SUCCESS));
 }

 /*%
@@ -1167,14 +1160,14 @@ has_dname(dns_db_t *db, dns_dbversion_t *ver, dns_dbnode_t *node) {
 		dns_rdataset_disassociate(&dnameset);
 	}

-	return result == ISC_R_SUCCESS;
+	return ((result == ISC_R_SUCCESS));
 }

 /*%
 * Signs all records at a name.
 */
 static void
-signname(dns_dbnode_t *node, bool apex, dns_name_t *name) {
+signname(dns_dbnode_t *node, dns_name_t *name) {
 	isc_result_t result;
 	dns_rdataset_t rdataset;
 	dns_rdatasetiter_t *rdsiter;
@@ -1225,10 +1218,6 @@ signname(dns_dbnode_t *node, bool apex, dns_name_t *name) {
 			dns_name_format(name, namebuf, sizeof(namebuf));
 			fatal("'%s': found DS RRset without NS RRset\n",
 			      namebuf);
-		} else if (rdataset.type == dns_rdatatype_dnskey && !apex) {
-			char namebuf[DNS_NAME_FORMATSIZE];
-			dns_name_format(name, namebuf, sizeof(namebuf));
-			fatal("'%s': Non-apex DNSKEY RRset\n", namebuf);
 		}

 		signset(&del, &add, node, name, &rdataset);
@@ -1385,7 +1374,7 @@ active_node(dns_dbnode_t *node) {
 	}
 	dns_rdatasetiter_destroy(&rdsiter);

-	return active;
+	return (active);
 }

 /*%
@@ -1434,7 +1423,7 @@ setsoaserial(uint32_t serial, dns_updatemethod_t method) {

 	result = dns_db_getoriginnode(gdb, &node);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}

 	dns_rdataset_init(&rdataset);
@@ -1508,7 +1497,7 @@ cleanup:
 	}
 	dns_rdata_reset(&rdata);

-	return result;
+	return (result);
 }

 /*%
@@ -1548,7 +1537,7 @@ signapex(void) {
 	check_result(result, "dns_dbiterator_seek()");
 	result = dns_dbiterator_current(gdbiter, &node, name);
 	check_dns_dbiterator_current(result);
-	signname(node, true, name);
+	signname(node, name);
 	dumpnode(name, node);
 	dns_db_detachnode(gdb, &node);
 	result = dns_dbiterator_first(gdbiter);
@@ -1677,7 +1666,7 @@ assignwork(void *arg) {

 	UNLOCK(&namelock);

-	signname(node, false, dns_fixedname_name(&fname));
+	signname(node, dns_fixedname_name(&fname));

 	/*%
 	 * Write a node to the output file, and restart the worker task.
@@ -1685,7 +1674,7 @@ assignwork(void *arg) {
 	lock_and_dumpnode(dns_fixedname_name(&fname), node);
 	dns_db_detachnode(gdb, &node);

-	isc_async_current(assignwork, NULL);
+	isc_async_current(loopmgr, assignwork, NULL);
 }

 /*%
@@ -2029,7 +2018,7 @@ addnsec3(dns_name_t *name, dns_dbnode_t *node, const unsigned char *salt,
 	dns_fixedname_init(&hashname);
 	dns_rdataset_init(&rdataset);

-	dns_name_downcase(name, name);
+	dns_name_downcase(name, name, NULL);
 	result = dns_nsec3_hashname(&hashname, hash, &hash_len, name, gorigin,
 				    dns_hash_sha1, iterations, salt, salt_len);
 	check_result(result, "addnsec3: dns_nsec3_hashname()");
@@ -2208,9 +2197,10 @@ rrset_cleanup(dns_name_t *name, dns_rdataset_t *rdataset, dns_diff_t *add,
 			{
 				vbprintf(2, "removing duplicate at %s/%s\n",
 					 namestr, typestr);
-				dns_difftuple_create(mctx, DNS_DIFFOP_DELRESIGN,
-						     name, rdataset->ttl,
-						     &rdata2, &tuple);
+				result = dns_difftuple_create(
+					mctx, DNS_DIFFOP_DELRESIGN, name,
+					rdataset->ttl, &rdata2, &tuple);
+				check_result(result, "dns_difftuple_create");
 				dns_diff_append(del, &tuple);
 			} else if (set_maxttl && rdataset->ttl > maxttl) {
 				vbprintf(2,
@@ -2218,14 +2208,16 @@ rrset_cleanup(dns_name_t *name, dns_rdataset_t *rdataset, dns_diff_t *add,
 					 "from %d to %d\n",
 					 namestr, typestr, rdataset->ttl,
 					 maxttl);
-				dns_difftuple_create(mctx, DNS_DIFFOP_DELRESIGN,
-						     name, rdataset->ttl,
-						     &rdata2, &tuple);
+				result = dns_difftuple_create(
+					mctx, DNS_DIFFOP_DELRESIGN, name,
+					rdataset->ttl, &rdata2, &tuple);
+				check_result(result, "dns_difftuple_create");
 				dns_diff_append(del, &tuple);
 				tuple = NULL;
-				dns_difftuple_create(mctx, DNS_DIFFOP_ADDRESIGN,
-						     name, maxttl, &rdata2,
-						     &tuple);
+				result = dns_difftuple_create(
+					mctx, DNS_DIFFOP_ADDRESIGN, name,
+					maxttl, &rdata2, &tuple);
+				check_result(result, "dns_difftuple_create");
 				dns_diff_append(add, &tuple);
 			}
 		}
@@ -2397,7 +2389,7 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 			fatal("iterating through the database failed: %s",
 			      isc_result_totext(result));
 		}
-		dns_name_downcase(name, name);
+		dns_name_downcase(name, name, NULL);
 		hashlist_add_dns_name(hashlist, name, hashalg, iterations, salt,
 				      salt_len, false);
 		dns_db_detachnode(gdb, &node);
@@ -2407,7 +2399,7 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 		 * node for another <name,nextname> span so we don't add
 		 * it here.  Empty labels on nextname are within the span.
 		 */
-		dns_name_downcase(nextname, nextname);
+		dns_name_downcase(nextname, nextname, NULL);
 		dns_name_fullcompare(name, nextname, &order, &nlabels);
 		addnowildcardhash(hashlist, name, hashalg, iterations, salt,
 				  salt_len);
@@ -2574,14 +2566,14 @@ loadzone(char *file, char *origin, dns_rdataclass_t rdclass, dns_db_t **db) {
 	isc_buffer_add(&b, len);

 	name = dns_fixedname_initname(&fname);
-	result = dns_name_fromtext(name, &b, dns_rootname, 0);
+	result = dns_name_fromtext(name, &b, dns_rootname, 0, NULL);
 	if (result != ISC_R_SUCCESS) {
 		fatal("failed converting name '%s' to dns format: %s", origin,
 		      isc_result_totext(result));
 	}

-	result = dns_db_create(mctx, ZONEDB_DEFAULT, name, dns_dbtype_zone,
-			       rdclass, 0, NULL, db);
+	result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone, rdclass, 0,
+			       NULL, db);
 	check_result(result, "dns_db_create()");

 	result = dns_db_load(*db, file, inputformat, 0);
@@ -2647,7 +2639,7 @@ loadzonekeys(bool preserve_keys, bool load_public) {

 	/* Load keys corresponding to the existing DNSKEY RRset. */
 	result = dns_dnssec_keylistfromrdataset(
-		gorigin, NULL, directory, mctx, &rdataset, &keysigs, &soasigs,
+		gorigin, directory, mctx, &rdataset, &keysigs, &soasigs,
 		preserve_keys, load_public, &keylist);
 	if (result != ISC_R_SUCCESS) {
 		fatal("failed to load the zone keys: %s",
@@ -2838,8 +2830,8 @@ findkeys:
 	/*
 	 * Find keys that match this zone in the key repository.
 	 */
-	result = dns_dnssec_findmatchingkeys(gorigin, NULL, directory, NULL,
-					     now, mctx, &matchkeys);
+	result = dns_dnssec_findmatchingkeys(gorigin, directory, now, mctx,
+					     &matchkeys);
 	if (result == ISC_R_NOTFOUND) {
 		result = ISC_R_SUCCESS;
 	}
@@ -3158,18 +3150,20 @@ writeset(const char *prefix, dns_rdatatype_t type) {
 						   DNS_DSDIGEST_SHA256, dsbuf,
 						   &ds);
 			check_result(result, "dns_ds_buildrdata");
-			dns_difftuple_create(mctx, DNS_DIFFOP_ADDRESIGN, name,
-					     0, &ds, &tuple);
+			result = dns_difftuple_create(mctx,
+						      DNS_DIFFOP_ADDRESIGN,
+						      name, 0, &ds, &tuple);
 		} else {
-			dns_difftuple_create(mctx, DNS_DIFFOP_ADDRESIGN,
-					     gorigin, zone_soa_min_ttl, &rdata,
-					     &tuple);
+			result = dns_difftuple_create(
+				mctx, DNS_DIFFOP_ADDRESIGN, gorigin,
+				zone_soa_min_ttl, &rdata, &tuple);
 		}
+		check_result(result, "dns_difftuple_create");
 		dns_diff_append(&diff, &tuple);
 	}

-	result = dns_db_create(mctx, ZONEDB_DEFAULT, dns_rootname,
-			       dns_dbtype_zone, gclass, 0, NULL, &db);
+	result = dns_db_create(mctx, "rbt", dns_rootname, dns_dbtype_zone,
+			       gclass, 0, NULL, &db);
 	check_result(result, "dns_db_create");

 	result = dns_db_newversion(db, &dbversion);
@@ -3214,7 +3208,7 @@ print_version(FILE *fp) {
 	fprintf(fp, "; %s version %s\n", program, PACKAGE_VERSION);
 }

-ISC_NORETURN static void
+noreturn static void
 usage(void);

 static void
@@ -3276,6 +3270,8 @@ usage(void) {
 	fprintf(stderr, "\t-a:\t");
 	fprintf(stderr, "verify generated signatures\n");
 	fprintf(stderr, "\t-c class (IN)\n");
+	fprintf(stderr, "\t-E engine:\n");
+	fprintf(stderr, "\t\tname of an OpenSSL engine to use\n");
 	fprintf(stderr, "\t-P:\t");
 	fprintf(stderr, "disable post-sign verification\n");
 	fprintf(stderr, "\t-Q:\t");
@@ -3304,7 +3300,7 @@ usage(void) {
 	fprintf(stderr, "(default: all zone keys that have private keys)\n");
 	fprintf(stderr, "\tkeyfile (Kname+alg+tag)\n");

-	exit(EXIT_FAILURE);
+	exit(0);
 }

 static void
@@ -3322,24 +3318,21 @@ print_stats(isc_time_t *timer_start, isc_time_t *timer_finish,
 	uint64_t sig_ms;  /* Signatures per millisecond */
 	FILE *out = output_stdout ? stderr : stdout;

-	fprintf(out, "Signatures generated:               %10" PRIuFAST32 "\n",
-		atomic_load(&nsigned));
-	fprintf(out, "Signatures retained:                %10" PRIuFAST32 "\n",
-		atomic_load(&nretained));
-	fprintf(out, "Signatures dropped:                 %10" PRIuFAST32 "\n",
-		atomic_load(&ndropped));
-	fprintf(out, "Signatures successfully verified:   %10" PRIuFAST32 "\n",
-		atomic_load(&nverified));
-	fprintf(out, "Signatures unsuccessfully verified: %10" PRIuFAST32 "\n",
-		atomic_load(&nverifyfailed));
+	fprintf(out, "Signatures generated:               %10u\n", nsigned);
+	fprintf(out, "Signatures retained:                %10u\n", nretained);
+	fprintf(out, "Signatures dropped:                 %10u\n", ndropped);
+	fprintf(out, "Signatures successfully verified:   %10u\n", nverified);
+	fprintf(out,
+		"Signatures unsuccessfully "
+		"verified: %10u\n",
+		nverifyfailed);

 	time_us = isc_time_microdiff(sign_finish, sign_start);
 	time_ms = time_us / 1000;
 	fprintf(out, "Signing time in seconds:           %7u.%03u\n",
 		(unsigned int)(time_ms / 1000), (unsigned int)(time_ms % 1000));
 	if (time_us > 0) {
-		sig_ms = ((uint64_t)atomic_load(&nsigned) * 1000000000) /
-			 time_us;
+		sig_ms = ((uint64_t)nsigned * 1000000000) / time_us;
 		fprintf(out, "Signatures per second:             %7u.%03u\n",
 			(unsigned int)sig_ms / 1000,
 			(unsigned int)sig_ms % 1000);
@@ -3366,6 +3359,8 @@ main(int argc, char *argv[]) {
 	isc_time_t sign_start, sign_finish;
 	dns_dnsseckey_t *key;
 	isc_result_t result, vresult;
+	isc_log_t *log = NULL;
+	const char *engine = NULL;
 	bool free_output = false;
 	int tempfilelen = 0;
 	dns_rdataclass_t rdclass;
@@ -3375,16 +3370,17 @@ main(int argc, char *argv[]) {
 	bool set_optout = false;
 	bool set_iter = false;
 	bool nonsecify = false;
+	bool set_fips_mode = false;
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+	OSSL_PROVIDER *fips = NULL, *base = NULL;
+#endif

 	atomic_init(&shuttingdown, false);
 	atomic_init(&finished, false);

-	/*
-	 * Unused letters: Bb G J l q Yy (and F is reserved).
-	 * l was previously used for DLV lookaside.
-	 */
-#define CMDLINE_FLAGS                                                        \
-	"3:AaCc:Dd:E:e:f:FgG:hH:i:I:j:J:K:k:L:m:M:n:N:o:O:PpQqRr:s:ST:tuUv:" \
+	/* Unused letters: Bb G J q Yy (and F is reserved). */
+#define CMDLINE_FLAGS                                                          \
+	"3:AaCc:Dd:E:e:f:FgG:hH:i:I:j:J:K:k:L:l:m:M:n:N:o:O:PpQqRr:s:ST:tuUv:" \
 	"VX:xzZ:"

 	/*
@@ -3472,7 +3468,7 @@ main(int argc, char *argv[]) {
 			break;

 		case 'E':
-			fatal("%s", isc_result_totext(DST_R_NOENGINE));
+			engine = isc_commandline_argument;
 			break;

 		case 'e':
@@ -3498,7 +3494,7 @@ main(int argc, char *argv[]) {
 			set_iter = true;
 			/* too-many is NOT DOCUMENTED */
 			if (strcmp(isc_commandline_argument, "too-many") == 0) {
-				nsec3iter = 51;
+				nsec3iter = 151;
 				no_max_check = true;
 				break;
 			}
@@ -3554,10 +3550,14 @@ main(int argc, char *argv[]) {
 			if (*endp != '\0') {
 				fprintf(stderr, "source serial number "
 						"must be numeric");
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;

+		case 'l':
+			fatal("-l option (DLV lookaside) is obsolete");
+			break;
+
 		case 'M':
 			endp = NULL;
 			set_maxttl = true;
@@ -3565,7 +3565,7 @@ main(int argc, char *argv[]) {
 			if (*endp != '\0') {
 				fprintf(stderr, "maximum TTL "
 						"must be numeric");
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;

@@ -3663,9 +3663,7 @@ main(int argc, char *argv[]) {
 			break;

 		case 'F':
-			if (isc_crypto_fips_enable() != ISC_R_SUCCESS) {
-				fatal("setting FIPS mode failed");
-			}
+			set_fips_mode = true;
 			break;

 		case '?':
@@ -3691,7 +3689,7 @@ main(int argc, char *argv[]) {
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n", program,
 				isc_commandline_option);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}

@@ -3736,7 +3734,34 @@ main(int argc, char *argv[]) {

 	isc_managers_create(&mctx, nloops, &loopmgr, &netmgr);

-	setup_logging();
+	if (set_fips_mode) {
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+		fips = OSSL_PROVIDER_load(NULL, "fips");
+		if (fips == NULL) {
+			ERR_clear_error();
+			fatal("Failed to load FIPS provider");
+		}
+		base = OSSL_PROVIDER_load(NULL, "base");
+		if (base == NULL) {
+			OSSL_PROVIDER_unload(fips);
+			ERR_clear_error();
+			fatal("Failed to load base provider");
+		}
+#endif
+		if (!isc_fips_mode()) {
+			if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
+				fatal("setting FIPS mode failed");
+			}
+		}
+	}
+
+	result = dst_lib_init(mctx, engine);
+	if (result != ISC_R_SUCCESS) {
+		fatal("could not initialize dst: %s",
+		      isc_result_totext(result));
+	}
+
+	setup_logging(mctx, &log);

 	argc -= isc_commandline_index;
 	argv += isc_commandline_index;
@@ -3793,7 +3818,7 @@ main(int argc, char *argv[]) {
 			    rawversion > 1U)
 			{
 				fprintf(stderr, "unknown raw format version\n");
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 		} else {
 			fatal("unknown file format: %s", outputformatstr);
@@ -4018,6 +4043,10 @@ main(int argc, char *argv[]) {

 	isc_mutex_init(&namelock);

+	if (printstats) {
+		isc_mutex_init(&statslock);
+	}
+
 	presign();
 	sign_start = isc_time_now();
 	signapex();
@@ -4103,18 +4132,30 @@ main(int argc, char *argv[]) {

 	dns_master_styledestroy(&dsstyle, mctx);

+	cleanup_logging(&log);
+	dst_lib_destroy();
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}

+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+	if (base != NULL) {
+		OSSL_PROVIDER_unload(base);
+	}
+	if (fips != NULL) {
+		OSSL_PROVIDER_unload(fips);
+	}
+#endif
+
 	isc_managers_destroy(&mctx, &loopmgr, &netmgr);

 	if (printstats) {
 		timer_finish = isc_time_now();
 		print_stats(&timer_start, &timer_finish, &sign_start,
 			    &sign_finish);
+		isc_mutex_destroy(&statslock);
 	}
 	isc_mutex_destroy(&namelock);

-	return vresult == ISC_R_SUCCESS ? 0 : 1;
+	return (vresult == ISC_R_SUCCESS ? 0 : 1);
 }
@@ -21,7 +21,7 @@ dnssec-signzone - DNSSEC zone signing tool
 Synopsis
 ~~~~~~~~

-:program:`dnssec-signzone` [**-a**] [**-c** class] [**-d** directory] [**-D**] [**-e** end-time] [**-f** output-file] [**-F**] [**-g**] [**-G sync-records**] [**-h**] [**-i** interval] [**-I** input-format] [**-j** jitter] [**-J** filename] [**-K** directory] [**-k** key] [**-L** serial] [**-M** maxttl] [**-N** soa-serial-format] [**-o** origin] [**-O** output-format] [**-P**] [**-Q**] [**-q**] [**-R**] [**-S**] [**-s** start-time] [**-T** ttl] [**-t**] [**-u**] [**-v** level] [**-V**] [**-X** extended end-time] [**-x**] [**-z**] [**-3** salt] [**-H** iterations] [**-A**] {zonefile} [key...]
+:program:`dnssec-signzone` [**-a**] [**-c** class] [**-d** directory] [**-D**] [**-E** engine] [**-e** end-time] [**-f** output-file] [**-F**] [**-g**] [**-G sync-records**] [**-h**] [**-i** interval] [**-I** input-format] [**-j** jitter] [**-K** directory] [**-k** key] [**-L** serial] [**-M** maxttl] [**-N** soa-serial-format] [**-o** origin] [**-O** output-format] [**-P**] [**-Q**] [**-q**] [**-R**] [**-S**] [**-s** start-time] [**-T** ttl] [**-t**] [**-u**] [**-v** level] [**-V**] [**-X** extended end-time] [**-x**] [**-z**] [**-3** salt] [**-H** iterations] [**-A**] {zonefile} [key...]

 Description
 ~~~~~~~~~~~
@@ -62,6 +62,15 @@ Options
   ``$INCLUDE``. This option cannot be combined with :option:`-O raw <-O>`
   or serial-number updating.

+.. option:: -E engine
+
+   This option specifies the hardware to use for cryptographic
+   operations, such as a secure key store used for signing, when applicable.
+
+   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
+   engine identifier that drives the cryptographic accelerator or
+   hardware service module (usually ``pkcs11``).
+
 .. option:: -F

   This options turns on FIPS (US Federal Information Processing Standards)
@@ -80,11 +89,6 @@ Options
   where ``digest-type`` is an allowed algorithm such as SHA-256 (2), or SHA-384 (4).
   Only works in combination with smart signing (``-S``).

-.. option:: -J filename
-
-   This option tells :program:`dnssec-signzone` to read the journal from the given file
-   when loading the zone file.
-
 .. option:: -K directory

   This option specifies the directory to search for DNSSEC keys. If not
@@ -174,11 +178,6 @@ Options
   days. Therefore, if any existing RRSIG records are due to expire in
   less than 7.5 days, they are replaced.

-   Note that the calculation of cycle interval is based upon the validity
-   period of the replacement signatures that would be generated by
-   ``dnssec-signzone``, not on the valid lifetimes of the input RRSIGs being
-   considered for pre-expiry replacement.
-
 .. option:: -I input-format

   This option sets the format of the input zone file. Possible formats are
@@ -274,7 +273,7 @@ Options
   with cached copies of the old DNSKEY RRset. The :option:`-Q` option forces
   :program:`dnssec-signzone` to remove signatures from keys that are no longer
   active. This enables ZSK rollover using the procedure described in
-   :rfc:`6781#section-4.1.1.1` ("Pre-Publish Zone Signing Key Rollover").
+   :rfc:`4641#4.2.1.1` ("Pre-Publish Key Rollover").

 .. option:: -q

@@ -291,7 +290,7 @@ Options
   This option is similar to :option:`-Q`, except it forces
   :program:`dnssec-signzone` to remove signatures from keys that are no longer
   published. This enables ZSK rollover using the procedure described in
-   :rfc:`6781#section-4.1.1.2` ("Double Signature Zone Signing Key
+   :rfc:`4641#4.2.1.2` ("Double Signature Zone Signing Key
   Rollover").

 .. option:: -S
@@ -375,7 +374,6 @@ Options

   .. note::
      ``-3 -`` is the recommended configuration. Adding salt provides no practical benefits.
-      See :rfc:`9276`.

 .. option:: -H iterations

@@ -384,7 +382,6 @@ Options

   .. warning::
      Values greater than 0 cause interoperability issues and also increase the risk of CPU-exhausting DoS attacks.
-      See :rfc:`9276`.

 .. option:: -A

@@ -393,7 +390,6 @@ Options

   .. warning::
      Do not use this option unless all its implications are fully understood. This option is intended only for extremely large zones (comparable to ``com.``) with sparse secure delegations.
-      See :rfc:`9276`.

 .. option:: -AA

@@ -447,4 +443,4 @@ See Also
 ~~~~~~~~

 :iscman:`dnssec-keygen(8) <dnssec-keygen>`, BIND 9 Administrator Reference Manual, :rfc:`4033`,
-:rfc:`6781`.
+:rfc:`4641`.
@@ -23,8 +23,6 @@
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/hex.h>
-#include <isc/lib.h>
-#include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/mutex.h>
 #include <isc/os.h>
@@ -44,7 +42,7 @@
 #include <dns/ds.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
-#include <dns/lib.h>
+#include <dns/log.h>
 #include <dns/master.h>
 #include <dns/masterdump.h>
 #include <dns/nsec.h>
@@ -105,14 +103,14 @@ loadzone(char *file, char *origin, dns_rdataclass_t rdclass, dns_db_t **db) {
 	isc_buffer_add(&b, len);

 	name = dns_fixedname_initname(&fname);
-	result = dns_name_fromtext(name, &b, dns_rootname, 0);
+	result = dns_name_fromtext(name, &b, dns_rootname, 0, NULL);
 	if (result != ISC_R_SUCCESS) {
 		fatal("failed converting name '%s' to dns format: %s", origin,
 		      isc_result_totext(result));
 	}

-	result = dns_db_create(mctx, ZONEDB_DEFAULT, name, dns_dbtype_zone,
-			       rdclass, 0, NULL, db);
+	result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone, rdclass, 0,
+			       NULL, db);
 	check_result(result, "dns_db_create()");

 	result = dns_db_load(*db, file, inputformat, 0);
@@ -138,7 +136,7 @@ loadzone(char *file, char *origin, dns_rdataclass_t rdclass, dns_db_t **db) {
 	}
 }

-ISC_NORETURN static void
+noreturn static void
 usage(void);

 static void
@@ -159,10 +157,12 @@ usage(void) {
 	fprintf(stderr, "\t-I format:\n");
 	fprintf(stderr, "\t\tfile format of input zonefile (text)\n");
 	fprintf(stderr, "\t-c class (IN)\n");
+	fprintf(stderr, "\t-E engine:\n");
+	fprintf(stderr, "\t\tname of an OpenSSL engine to use\n");
 	fprintf(stderr, "\t-x:\tDNSKEY record signed with KSKs only, "
 			"not ZSKs\n");
 	fprintf(stderr, "\t-z:\tAll records signed with KSKs\n");
-	exit(EXIT_SUCCESS);
+	exit(0);
 }

 int
@@ -170,6 +170,8 @@ main(int argc, char *argv[]) {
 	char *origin = NULL, *file = NULL;
 	char *inputformatstr = NULL;
 	isc_result_t result;
+	isc_log_t *log = NULL;
+	const char *engine = NULL;
 	char *classname = NULL;
 	dns_rdataclass_t rdclass;
 	char *endp;
@@ -213,7 +215,7 @@ main(int argc, char *argv[]) {
 			break;

 		case 'E':
-			fatal("%s", isc_result_totext(DST_R_NOENGINE));
+			engine = isc_commandline_argument;
 			break;

 		case 'I':
@@ -269,15 +271,21 @@ main(int argc, char *argv[]) {
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n", program,
 				isc_commandline_option);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}

+	result = dst_lib_init(mctx, engine);
+	if (result != ISC_R_SUCCESS) {
+		fatal("could not initialize dst: %s",
+		      isc_result_totext(result));
+	}
+
 	now = isc_stdtime_now();

 	rdclass = strtoclass(classname);

-	setup_logging();
+	setup_logging(mctx, &log);

 	argc -= isc_commandline_index;
 	argv += isc_commandline_index;
@@ -327,10 +335,12 @@ main(int argc, char *argv[]) {
 	dns_db_closeversion(gdb, &gversion, false);
 	dns_db_detach(&gdb);

+	cleanup_logging(&log);
+	dst_lib_destroy();
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);

-	return result == ISC_R_SUCCESS ? 0 : 1;
+	return (result == ISC_R_SUCCESS ? 0 : 1);
 }
@@ -21,7 +21,7 @@ dnssec-verify - DNSSEC zone verification tool
 Synopsis
 ~~~~~~~~

-:program:`dnssec-verify` [**-c** class] [**-I** input-format] [**-J** filename] [**-o** origin] [**-q**] [**-v** level] [**-V**] [**-x**] [**-z**] {zonefile}
+:program:`dnssec-verify` [**-c** class] [**-E** engine] [**-I** input-format] [**-o** origin] [**-q**] [**-v** level] [**-V**] [**-x**] [**-z**] {zonefile}

 Description
 ~~~~~~~~~~~
@@ -37,6 +37,14 @@ Options

   This option specifies the DNS class of the zone.

+.. option:: -E engine
+
+   This option specifies the cryptographic hardware to use, when applicable.
+
+   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
+   engine identifier that drives the cryptographic accelerator or
+   hardware service module (usually ``pkcs11``).
+
 .. option:: -I input-format

   This option sets the format of the input zone file. Possible formats are ``text``
@@ -45,11 +53,6 @@ Options
   format containing updates can be verified independently.
   This option is not useful for non-dynamic zones.

-.. option:: -J filename
-
-   This option tells :program:`dnssec-verify` to read the journal from the given file
-   when loading the zone file.
-
 .. option:: -o origin

   This option indicates the zone origin. If not specified, the name of the zone file is
@@ -20,7 +20,6 @@
 #include <inttypes.h>
 #include <stdbool.h>
 #include <stdlib.h>
-#include <unistd.h>

 #include <isc/base32.h>
 #include <isc/buffer.h>
@@ -29,7 +28,6 @@
 #include <isc/file.h>
 #include <isc/heap.h>
 #include <isc/list.h>
-#include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
 #include <isc/string.h>
@@ -44,6 +42,7 @@
 #include <dns/fixedname.h>
 #include <dns/journal.h>
 #include <dns/keyvalues.h>
+#include <dns/log.h>
 #include <dns/name.h>
 #include <dns/nsec.h>
 #include <dns/nsec3.h>
@@ -84,7 +83,8 @@ fatal(const char *format, ...) {
 	if (fatalcallback != NULL) {
 		(*fatalcallback)();
 	}
-	_exit(EXIT_FAILURE);
+	isc__tls_setfatalmode();
+	exit(1);
 }

 void
@@ -114,7 +114,7 @@ vbprintf(int level, const char *fmt, ...) {
 void
 version(const char *name) {
 	printf("%s %s\n", name, PACKAGE_VERSION);
-	exit(EXIT_SUCCESS);
+	exit(0);
 }

 void
@@ -128,8 +128,10 @@ sig_format(dns_rdata_rrsig_t *sig, char *cp, unsigned int size) {
 }

 void
-setup_logging(void) {
+setup_logging(isc_mem_t *mctx, isc_log_t **logp) {
+	isc_logdestination_t destination;
 	isc_logconfig_t *logconfig = NULL;
+	isc_log_t *log = NULL;
 	int level;

 	if (verbose < 0) {
@@ -151,8 +153,10 @@ setup_logging(void) {
 		break;
 	}

-	logconfig = isc_logconfig_get();
-
+	isc_log_create(mctx, &log, &logconfig);
+	isc_log_setcontext(log);
+	dns_log_init(log);
+	dns_log_setcontext(log);
 	isc_log_settag(logconfig, program);

 	/*
@@ -161,11 +165,36 @@ setup_logging(void) {
 	 *  - the program name and logging level are printed
 	 *  - no time stamp is printed
 	 */
-	isc_log_createandusechannel(
-		logconfig, "default_stderr", ISC_LOG_TOFILEDESC, level,
-		ISC_LOGDESTINATION_STDERR,
-		ISC_LOG_PRINTTAG | ISC_LOG_PRINTLEVEL, ISC_LOGCATEGORY_DEFAULT,
-		ISC_LOGMODULE_DEFAULT);
+	destination.file.stream = stderr;
+	destination.file.name = NULL;
+	destination.file.versions = ISC_LOG_ROLLNEVER;
+	destination.file.maximum_size = 0;
+	isc_log_createchannel(logconfig, "stderr", ISC_LOG_TOFILEDESC, level,
+			      &destination,
+			      ISC_LOG_PRINTTAG | ISC_LOG_PRINTLEVEL);
+
+	RUNTIME_CHECK(isc_log_usechannel(logconfig, "stderr", NULL, NULL) ==
+		      ISC_R_SUCCESS);
+
+	*logp = log;
+}
+
+void
+cleanup_logging(isc_log_t **logp) {
+	isc_log_t *log;
+
+	REQUIRE(logp != NULL);
+
+	log = *logp;
+	*logp = NULL;
+
+	if (log == NULL) {
+		return;
+	}
+
+	isc_log_destroy(&log);
+	isc_log_setcontext(NULL);
+	dns_log_setcontext(NULL);
 }

 static isc_stdtime_t
@@ -173,16 +202,16 @@ time_units(isc_stdtime_t offset, char *suffix, const char *str) {
 	switch (suffix[0]) {
 	case 'Y':
 	case 'y':
-		return offset * (365 * 24 * 3600);
+		return (offset * (365 * 24 * 3600));
 	case 'M':
 	case 'm':
 		switch (suffix[1]) {
 		case 'O':
 		case 'o':
-			return offset * (30 * 24 * 3600);
+			return (offset * (30 * 24 * 3600));
 		case 'I':
 		case 'i':
-			return offset * 60;
+			return (offset * 60);
 		case '\0':
 			fatal("'%s' ambiguous: use 'mi' for minutes "
 			      "or 'mo' for months",
@@ -194,29 +223,29 @@ time_units(isc_stdtime_t offset, char *suffix, const char *str) {
 		break;
 	case 'W':
 	case 'w':
-		return offset * (7 * 24 * 3600);
+		return (offset * (7 * 24 * 3600));
 	case 'D':
 	case 'd':
-		return offset * (24 * 3600);
+		return (offset * (24 * 3600));
 	case 'H':
 	case 'h':
-		return offset * 3600;
+		return (offset * 3600);
 	case 'S':
 	case 's':
 	case '\0':
-		return offset;
+		return (offset);
 	default:
 		fatal("time value %s is invalid", str);
 	}
 	UNREACHABLE();
-	return 0; /* silence compiler warning */
+	return (0); /* silence compiler warning */
 }

 static bool
 isnone(const char *str) {
-	return (strcasecmp(str, "none") == 0) ||
-	       (strcasecmp(str, "never") == 0) ||
-	       (strcasecmp(str, "unset") == 0);
+	return ((strcasecmp(str, "none") == 0) ||
+		(strcasecmp(str, "never") == 0) ||
+		(strcasecmp(str, "unset") == 0));
 }

 dns_ttl_t
@@ -226,7 +255,7 @@ strtottl(const char *str) {
 	char *endp;

 	if (isnone(str)) {
-		return (dns_ttl_t)0;
+		return ((dns_ttl_t)0);
 	}

 	ttl = strtol(str, &endp, 0);
@@ -234,19 +263,19 @@ strtottl(const char *str) {
 		fatal("TTL must be numeric");
 	}
 	ttl = time_units(ttl, endp, orig);
-	return ttl;
+	return (ttl);
 }

 dst_key_state_t
 strtokeystate(const char *str) {
 	if (isnone(str)) {
-		return DST_KEY_STATE_NA;
+		return (DST_KEY_STATE_NA);
 	}

 	for (int i = 0; i < KEYSTATES_NVALUES; i++) {
 		if (keystates[i] != NULL && strcasecmp(str, keystates[i]) == 0)
 		{
-			return (dst_key_state_t)i;
+			return ((dst_key_state_t)i);
 		}
 	}
 	fatal("unknown key state %s", str);
@@ -263,13 +292,13 @@ strtotime(const char *str, int64_t now, int64_t base, bool *setp) {

 	if (isnone(str)) {
 		SET_IF_NOT_NULL(setp, false);
-		return (isc_stdtime_t)0;
+		return ((isc_stdtime_t)0);
 	}

 	SET_IF_NOT_NULL(setp, true);

 	if ((str[0] == '0' || str[0] == '-') && str[1] == '\0') {
-		return (isc_stdtime_t)0;
+		return ((isc_stdtime_t)0);
 	}

 	/*
@@ -318,7 +347,7 @@ strtotime(const char *str, int64_t now, int64_t base, bool *setp) {
 	}

 	if (str[0] == '\0') {
-		return (isc_stdtime_t)base;
+		return ((isc_stdtime_t)base);
 	} else if (str[0] == '+') {
 		offset = strtol(str + 1, &endp, 0);
 		offset = time_units((isc_stdtime_t)offset, endp, orig);
@@ -331,7 +360,7 @@ strtotime(const char *str, int64_t now, int64_t base, bool *setp) {
 		fatal("time value %s is invalid", orig);
 	}

-	return (isc_stdtime_t)val;
+	return ((isc_stdtime_t)val);
 }

 dns_rdataclass_t
@@ -341,7 +370,7 @@ strtoclass(const char *str) {
 	isc_result_t result;

 	if (str == NULL) {
-		return dns_rdataclass_in;
+		return (dns_rdataclass_in);
 	}
 	r.base = UNCONST(str);
 	r.length = strlen(str);
@@ -349,7 +378,7 @@ strtoclass(const char *str) {
 	if (result != ISC_R_SUCCESS) {
 		fatal("unknown class %s", str);
 	}
-	return rdclass;
+	return (rdclass);
 }

 unsigned int
@@ -364,14 +393,14 @@ strtodsdigest(const char *str) {
 	if (result != ISC_R_SUCCESS) {
 		fatal("unknown DS algorithm %s", str);
 	}
-	return alg;
+	return (alg);
 }

 static int
 cmp_dtype(const void *ap, const void *bp) {
 	int a = *(const uint8_t *)ap;
 	int b = *(const uint8_t *)bp;
-	return a - b;
+	return (a - b);
 }

 void
@@ -403,7 +432,7 @@ try_dir(const char *dirname) {
 	if (result == ISC_R_SUCCESS) {
 		isc_dir_close(&d);
 	}
-	return result;
+	return (result);
 }

 /*
@@ -450,7 +479,7 @@ set_keyversion(dst_key_t *key) {

 bool
 key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
-	      isc_mem_t *mctx, uint16_t min, uint16_t max, bool *exact) {
+	      isc_mem_t *mctx, bool *exact) {
 	isc_result_t result;
 	bool conflict = false;
 	dns_dnsseckeylist_t matchkeys;
@@ -460,32 +489,18 @@ key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
 	dns_secalg_t alg;
 	isc_stdtime_t now = isc_stdtime_now();

-	SET_IF_NOT_NULL(exact, false);
+	if (exact != NULL) {
+		*exact = false;
+	}

 	id = dst_key_id(dstkey);
 	rid = dst_key_rid(dstkey);
 	alg = dst_key_alg(dstkey);

-	if (min != max) {
-		if (id < min || id > max) {
-			fprintf(stderr, "Key ID %d outside of [%u..%u]\n", id,
-				min, max);
-			return true;
-		}
-		if (rid < min || rid > max) {
-			fprintf(stderr,
-				"Revoked Key ID %d (for tag %d) outside of "
-				"[%u..%u]\n",
-				rid, id, min, max);
-			return true;
-		}
-	}
-
 	ISC_LIST_INIT(matchkeys);
-	result = dns_dnssec_findmatchingkeys(name, NULL, dir, NULL, now, mctx,
-					     &matchkeys);
+	result = dns_dnssec_findmatchingkeys(name, dir, now, mctx, &matchkeys);
 	if (result == ISC_R_NOTFOUND) {
-		return false;
+		return (false);
 	}

 	while (!ISC_LIST_EMPTY(matchkeys) && !conflict) {
@@ -529,7 +544,7 @@ key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
 		dns_dnsseckey_destroy(mctx, &key);
 	}

-	return conflict;
+	return (conflict);
 }

 bool
@@ -544,9 +559,9 @@ isoptarg(const char *arg, char **argv, void (*usage)(void)) {
 		isc_commandline_argument = argv[isc_commandline_index];
 		/* skip to next argument */
 		isc_commandline_index++;
-		return true;
+		return (true);
 	}
-	return false;
+	return (false);
 }

 void
@@ -586,86 +601,3 @@ loadjournal(isc_mem_t *mctx, dns_db_t *db, const char *file) {
 cleanup:
 	dns_journal_destroy(&jnl);
 }
-
-void
-kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
-	       const char *keydir, dns_kasp_t **kaspp) {
-	isc_result_t result = ISC_R_NOTFOUND;
-	const cfg_listelt_t *element;
-	const cfg_obj_t *kasps = NULL;
-	dns_kasp_t *kasp = NULL, *kasp_next;
-	dns_kasplist_t kasplist;
-	const cfg_obj_t *keystores = NULL;
-	dns_keystore_t *ks = NULL, *ks_next;
-	dns_keystorelist_t kslist;
-
-	ISC_LIST_INIT(kasplist);
-	ISC_LIST_INIT(kslist);
-
-	(void)cfg_map_get(config, "key-store", &keystores);
-	for (element = cfg_list_first(keystores); element != NULL;
-	     element = cfg_list_next(element))
-	{
-		cfg_obj_t *kconfig = cfg_listelt_value(element);
-		ks = NULL;
-		result = cfg_keystore_fromconfig(kconfig, mctx, &kslist, NULL);
-		if (result != ISC_R_SUCCESS) {
-			fatal("failed to configure key-store '%s': %s",
-			      cfg_obj_asstring(cfg_tuple_get(kconfig, "name")),
-			      isc_result_totext(result));
-		}
-	}
-	/* Default key-directory key store. */
-	ks = NULL;
-	(void)cfg_keystore_fromconfig(NULL, mctx, &kslist, &ks);
-	INSIST(ks != NULL);
-	if (keydir != NULL) {
-		/* '-K keydir' takes priority */
-		dns_keystore_setdirectory(ks, keydir);
-	}
-	dns_keystore_detach(&ks);
-
-	(void)cfg_map_get(config, "dnssec-policy", &kasps);
-	for (element = cfg_list_first(kasps); element != NULL;
-	     element = cfg_list_next(element))
-	{
-		cfg_obj_t *kconfig = cfg_listelt_value(element);
-		kasp = NULL;
-		if (strcmp(cfg_obj_asstring(cfg_tuple_get(kconfig, "name")),
-			   name) != 0)
-		{
-			continue;
-		}
-
-		result = cfg_kasp_fromconfig(kconfig, NULL, true, mctx, &kslist,
-					     &kasplist, &kasp);
-		if (result != ISC_R_SUCCESS) {
-			fatal("failed to configure dnssec-policy '%s': %s",
-			      cfg_obj_asstring(cfg_tuple_get(kconfig, "name")),
-			      isc_result_totext(result));
-		}
-		INSIST(kasp != NULL);
-		dns_kasp_freeze(kasp);
-		break;
-	}
-
-	*kaspp = kasp;
-
-	/*
-	 * Cleanup kasp list.
-	 */
-	for (kasp = ISC_LIST_HEAD(kasplist); kasp != NULL; kasp = kasp_next) {
-		kasp_next = ISC_LIST_NEXT(kasp, link);
-		ISC_LIST_UNLINK(kasplist, kasp, link);
-		dns_kasp_detach(&kasp);
-	}
-
-	/*
-	 * Cleanup keystore list.
-	 */
-	for (ks = ISC_LIST_HEAD(kslist); ks != NULL; ks = ks_next) {
-		ks_next = ISC_LIST_NEXT(ks, link);
-		ISC_LIST_UNLINK(kslist, ks, link);
-		dns_keystore_detach(&ks);
-	}
-}
@@ -20,18 +20,10 @@
 #include <isc/log.h>
 #include <isc/stdtime.h>

-#include <dns/kasp.h>
 #include <dns/rdatastruct.h>

 #include <dst/dst.h>

-#include <isccfg/cfg.h>
-#include <isccfg/kaspconf.h>
-#include <isccfg/namedconf.h>
-
-#define MAX_RSA 4096 /* should be long enough... */
-#define MAX_DH	4096 /* should be long enough... */
-
 /*! verbosity: set by -v and -q option in each program, defined in dnssectool.c
 */
 extern int verbose;
@@ -54,7 +46,7 @@ extern uint8_t dtype[8];

 typedef void(fatalcallback_t)(void);

-ISC_NORETURN void
+noreturn void
 fatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);

 void
@@ -66,7 +58,7 @@ check_result(isc_result_t result, const char *message);
 void
 vbprintf(int level, const char *fmt, ...) ISC_FORMAT_PRINTF(2, 3);

-ISC_NORETURN void
+noreturn void
 version(const char *program);

 void
@@ -75,7 +67,10 @@ sig_format(dns_rdata_rrsig_t *sig, char *cp, unsigned int size);
 	(DNS_NAME_FORMATSIZE + DNS_SECALG_FORMATSIZE + sizeof("65535"))

 void
-setup_logging(void);
+setup_logging(isc_mem_t *mctx, isc_log_t **logp);
+
+void
+cleanup_logging(isc_log_t **logp);

 dns_ttl_t
 strtottl(const char *str);
@@ -106,14 +101,10 @@ set_keyversion(dst_key_t *key);

 bool
 key_collision(dst_key_t *key, dns_name_t *name, const char *dir,
-	      isc_mem_t *mctx, uint16_t min, uint16_t max, bool *exact);
+	      isc_mem_t *mctx, bool *exact);

 bool
 isoptarg(const char *arg, char **argv, void (*usage)(void));

 void
 loadjournal(isc_mem_t *mctx, dns_db_t *db, const char *journal);
-
-void
-kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
-	       const char *keydir, dns_kasp_t **kaspp);
@@ -919,7 +919,6 @@
                  <th>Local Serial</th>
                  <th>Remote Serial</th>
                  <th>IXFR</th>
-                  <th>First Refresh</th>
                  <th>State</th>
                  <th>Additional Refresh Queued</th>
                  <th>Local Address</th>
@@ -931,7 +930,6 @@
                  <th>Messages Received</th>
                  <th>Records Received</th>
                  <th>Bytes Received</th>
-                  <th>Transfer Rate (B/s)</th>
                </tr>
              </thead>
              <tbody>
@@ -948,7 +946,6 @@
                    <td><xsl:value-of select="serial"/></td>
                    <td><xsl:value-of select="remoteserial"/></td>
                    <td><xsl:value-of select="ixfr"/></td>
-                    <td><xsl:value-of select="firstrefresh"/></td>
                    <td><xsl:value-of select="state"/></td>
                    <td><xsl:value-of select="refreshqueued"/></td>
                    <td><xsl:value-of select="localaddr"/></td>
@@ -960,7 +957,6 @@
                    <td><xsl:value-of select="nmsg"/></td>
                    <td><xsl:value-of select="nrecs"/></td>
                    <td><xsl:value-of select="nbytes"/></td>
-                    <td><xsl:value-of select="rate"/></td>
                  </tr>
                </xsl:for-each>
              </tbody>
@@ -120,7 +120,7 @@ putrdata(bdbnode_t *node, dns_rdatatype_t typeval, dns_ttl_t ttl,
 		rdatalist->ttl = ttl;
 		ISC_LIST_APPEND(node->lists, rdatalist, link);
 	} else if (rdatalist->ttl != ttl) {
-		return DNS_R_BADTTL;
+		return (DNS_R_BADTTL);
 	}

 	rdata = isc_mem_get(mctx, sizeof(dns_rdata_t));
@@ -136,7 +136,7 @@ putrdata(bdbnode_t *node, dns_rdatatype_t typeval, dns_ttl_t ttl,
 	ISC_LIST_APPEND(rdatalist->rdata, rdata, link);
 	ISC_LIST_APPEND(node->buffers, rdatabuf, link);

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
@@ -159,7 +159,7 @@ putrr(bdbnode_t *node, const char *type, dns_ttl_t ttl, const char *data) {
 	isc_constregion_t r = { .base = type, .length = strlen(type) };
 	result = dns_rdatatype_fromtext(&typeval, (isc_textregion_t *)&r);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}

 	isc_lex_create(mctx, 64, &lex);
@@ -170,7 +170,7 @@ putrr(bdbnode_t *node, const char *type, dns_ttl_t ttl, const char *data) {

 	result = isc_lex_openbuffer(lex, &b);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}

 	isc_buffer_allocate(mctx, &rb, DNS_RDATA_MAXLENGTH);
@@ -185,7 +185,7 @@ putrr(bdbnode_t *node, const char *type, dns_ttl_t ttl, const char *data) {

 	isc_buffer_free(&rb);

-	return result;
+	return (result);
 }

 /* Reasonable default SOA values */
@@ -207,9 +207,9 @@ putsoa(bdbnode_t *node, const char *mname, const char *rname, uint32_t serial) {
 		     serial, DEFAULT_REFRESH, DEFAULT_RETRY, DEFAULT_EXPIRE,
 		     DEFAULT_MINIMUM);
 	if (n >= (int)sizeof(str) || n < 0) {
-		return ISC_R_NOSPACE;
+		return (ISC_R_NOSPACE);
 	}
-	return putrr(node, "SOA", DEFAULT_TTL, str);
+	return (putrr(node, "SOA", DEFAULT_TTL, str));
 }

 static isc_result_t
@@ -222,7 +222,7 @@ puttxt(bdbnode_t *node, const char *text) {
 	}
 	buf[0] = len;
 	memmove(&buf[1], text, len);
-	return putrdata(node, dns_rdatatype_txt, 0, buf, len + 1);
+	return (putrdata(node, dns_rdatatype_txt, 0, buf, len + 1));
 }

 /*
@@ -279,7 +279,7 @@ dns64_rdata(unsigned char *v, size_t start, unsigned char *rdata) {
 		}
 	}
 	memmove(&rdata[j], "\07in-addr\04arpa", 14);
-	return j + 14;
+	return (j + 14);
 }

 static isc_result_t
@@ -301,7 +301,7 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 	zlen = zone->length;
 	nlen = name->length;
 	if ((zlen + nlen) > 74U || zlen < 10U || (nlen % 2) != 0U) {
-		return ISC_R_NOTFOUND;
+		return (ISC_R_NOTFOUND);
 	}

 	/*
@@ -320,11 +320,11 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 	while (j != 0U) {
 		INSIST((i / 2) < sizeof(v));
 		if (ndata[0] != 1) {
-			return ISC_R_NOTFOUND;
+			return (ISC_R_NOTFOUND);
 		}
 		n = hex16[ndata[1] & 0xff];
 		if (n == 1) {
-			return ISC_R_NOTFOUND;
+			return (ISC_R_NOTFOUND);
 		}
 		v[i / 2] = n | (v[i / 2] >> 4);
 		j -= 2;
@@ -346,14 +346,14 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 		 * to exist in the zone.
 		 */
 		if (nlen > 16U && v[(nlen - 1) / 4 - 4] != 0) {
-			return ISC_R_NOTFOUND;
+			return (ISC_R_NOTFOUND);
 		}
 		/*
 		 * If the total length is not 74 then this is a empty node
 		 * so return success.
 		 */
 		if (nlen + zlen != 74U) {
-			return ISC_R_SUCCESS;
+			return (ISC_R_SUCCESS);
 		}
 		len = dns64_rdata(v, 8, rdata);
 		break;
@@ -363,14 +363,14 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 		 * to exist in the zone.
 		 */
 		if (nlen > 12U && v[(nlen - 1) / 4 - 3] != 0) {
-			return ISC_R_NOTFOUND;
+			return (ISC_R_NOTFOUND);
 		}
 		/*
 		 * If the total length is not 74 then this is a empty node
 		 * so return success.
 		 */
 		if (nlen + zlen != 74U) {
-			return ISC_R_SUCCESS;
+			return (ISC_R_SUCCESS);
 		}
 		len = dns64_rdata(v, 6, rdata);
 		break;
@@ -380,14 +380,14 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 		 * to exist in the zone.
 		 */
 		if (nlen > 8U && v[(nlen - 1) / 4 - 2] != 0) {
-			return ISC_R_NOTFOUND;
+			return (ISC_R_NOTFOUND);
 		}
 		/*
 		 * If the total length is not 74 then this is a empty node
 		 * so return success.
 		 */
 		if (nlen + zlen != 74U) {
-			return ISC_R_SUCCESS;
+			return (ISC_R_SUCCESS);
 		}
 		len = dns64_rdata(v, 5, rdata);
 		break;
@@ -397,14 +397,14 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 		 * to exist in the zone.
 		 */
 		if (nlen > 4U && v[(nlen - 1) / 4 - 1] != 0) {
-			return ISC_R_NOTFOUND;
+			return (ISC_R_NOTFOUND);
 		}
 		/*
 		 * If the total length is not 74 then this is a empty node
 		 * so return success.
 		 */
 		if (nlen + zlen != 74U) {
-			return ISC_R_SUCCESS;
+			return (ISC_R_SUCCESS);
 		}
 		len = dns64_rdata(v, 4, rdata);
 		break;
@@ -414,14 +414,14 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 		 * to exist in the zone.
 		 */
 		if (v[(nlen - 1) / 4] != 0) {
-			return ISC_R_NOTFOUND;
+			return (ISC_R_NOTFOUND);
 		}
 		/*
 		 * If the total length is not 74 then this is a empty node
 		 * so return success.
 		 */
 		if (nlen + zlen != 74U) {
-			return ISC_R_SUCCESS;
+			return (ISC_R_SUCCESS);
 		}
 		len = dns64_rdata(v, 3, rdata);
 		break;
@@ -431,7 +431,7 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 		 * so return success.
 		 */
 		if (nlen + zlen != 74U) {
-			return ISC_R_SUCCESS;
+			return (ISC_R_SUCCESS);
 		}
 		len = dns64_rdata(v, 0, rdata);
 		break;
@@ -440,7 +440,7 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 		 * This should never be reached unless someone adds a
 		 * zone declaration with this internal type to named.conf.
 		 */
-		return ISC_R_NOTFOUND;
+		return (ISC_R_NOTFOUND);
 	}

 	/*
@@ -449,22 +449,22 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 	if ((v[0] == 170 || v[0] == 171) && v[1] == 0 && v[2] == 0 &&
 	    v[3] == 192)
 	{
-		return putrdata(node, dns_rdatatype_ptr, 3600, ipv4only,
-				sizeof(ipv4only));
+		return (putrdata(node, dns_rdatatype_ptr, 3600, ipv4only,
+				 sizeof(ipv4only)));
 	}

-	return putrdata(node, dns_rdatatype_cname, 600, rdata,
-			(unsigned int)len);
+	return (putrdata(node, dns_rdatatype_cname, 600, rdata,
+			 (unsigned int)len));
 }

 static isc_result_t
 builtin_lookup(bdb_t *bdb, const dns_name_t *name, bdbnode_t *node) {
-	if (name->length == 0) {
-		return bdb->lookup(node);
+	if (name->labels == 0 && name->length == 0) {
+		return (bdb->lookup(node));
 	} else if ((node->bdb->implementation->flags & BDB_DNS64) != 0) {
-		return dns64_cname(&bdb->common.origin, name, node);
+		return (dns64_cname(&bdb->common.origin, name, node));
 	} else {
-		return ISC_R_NOTFOUND;
+		return (ISC_R_NOTFOUND);
 	}
 }

@@ -483,27 +483,27 @@ builtin_authority(bdb_t *bdb, bdbnode_t *node) {

 	result = putsoa(node, server, contact, 0);
 	if (result != ISC_R_SUCCESS) {
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

 	result = putrr(node, "NS", 0, server);
 	if (result != ISC_R_SUCCESS) {
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
 version_lookup(bdbnode_t *node) {
 	if (named_g_server->version_set) {
 		if (named_g_server->version == NULL) {
-			return ISC_R_SUCCESS;
+			return (ISC_R_SUCCESS);
 		} else {
-			return puttxt(node, named_g_server->version);
+			return (puttxt(node, named_g_server->version));
 		}
 	} else {
-		return puttxt(node, PACKAGE_VERSION);
+		return (puttxt(node, PACKAGE_VERSION));
 	}
 }

@@ -511,16 +511,16 @@ static isc_result_t
 hostname_lookup(bdbnode_t *node) {
 	if (named_g_server->hostname_set) {
 		if (named_g_server->hostname == NULL) {
-			return ISC_R_SUCCESS;
+			return (ISC_R_SUCCESS);
 		} else {
-			return puttxt(node, named_g_server->hostname);
+			return (puttxt(node, named_g_server->hostname));
 		}
 	} else {
 		char buf[256];
 		if (gethostname(buf, sizeof(buf)) != 0) {
-			return ISC_R_FAILURE;
+			return (ISC_R_FAILURE);
 		}
-		return puttxt(node, buf);
+		return (puttxt(node, buf));
 	}
 }

@@ -529,33 +529,29 @@ authors_lookup(bdbnode_t *node) {
 	isc_result_t result;
 	const char **p = NULL;
 	static const char *authors[] = {
-		"Mark Andrews",	      "Curtis Blackburn",
-		"James Brister",      "Ben Cottrell",
-		"John H. DuBois III", "Francis Dupont",
-		"Michael Graff",      "Andreas Gustafsson",
-		"Bob Halley",	      "Evan Hunt",
-		"JINMEI Tatuya",      "Witold Krecicki",
-		"David Lawrence",     "Scott Mann",
-		"Danny Mayer",	      "Aydin Mercan",
-		"Damien Neil",	      "Matt Nelson",
-		"Jeremy C. Reed",     "Michael Sawyer",
-		"Brian Wellington",   NULL
+		"Mark Andrews",	  "Curtis Blackburn",	"James Brister",
+		"Ben Cottrell",	  "John H. DuBois III", "Francis Dupont",
+		"Michael Graff",  "Andreas Gustafsson", "Bob Halley",
+		"Evan Hunt",	  "JINMEI Tatuya",	"Witold Krecicki",
+		"David Lawrence", "Scott Mann",		"Danny Mayer",
+		"Damien Neil",	  "Matt Nelson",	"Jeremy C. Reed",
+		"Michael Sawyer", "Brian Wellington",	NULL
 	};

 	/*
 	 * If a version string is specified, disable the authors.bind zone.
 	 */
 	if (named_g_server->version_set) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	for (p = authors; *p != NULL; p++) {
 		result = puttxt(node, *p);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 	}
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
@@ -563,13 +559,13 @@ id_lookup(bdbnode_t *node) {
 	if (named_g_server->sctx->usehostname) {
 		char buf[256];
 		if (gethostname(buf, sizeof(buf)) != 0) {
-			return ISC_R_FAILURE;
+			return (ISC_R_FAILURE);
 		}
-		return puttxt(node, buf);
+		return (puttxt(node, buf));
 	} else if (named_g_server->sctx->server_id != NULL) {
-		return puttxt(node, named_g_server->sctx->server_id);
+		return (puttxt(node, named_g_server->sctx->server_id));
 	} else {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}
 }

@@ -577,7 +573,7 @@ static isc_result_t
 empty_lookup(bdbnode_t *node) {
 	UNUSED(node);

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
@@ -588,10 +584,10 @@ ipv4only_lookup(bdbnode_t *node) {
 	for (int i = 0; i < 2; i++) {
 		result = putrdata(node, dns_rdatatype_a, 3600, data[i], 4);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 	}
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
@@ -600,7 +596,7 @@ ipv4reverse_lookup(bdbnode_t *node) {

 	result = putrdata(node, dns_rdatatype_ptr, 3600, ipv4only,
 			  sizeof(ipv4only));
-	return result;
+	return (result);
 }

 /*
@@ -670,10 +666,10 @@ rdatasetiter_first(dns_rdatasetiter_t *iterator DNS__DB_FLARG) {
 	bdbnode_t *bdbnode = (bdbnode_t *)iterator->node;

 	if (ISC_LIST_EMPTY(bdbnode->lists)) {
-		return ISC_R_NOMORE;
+		return (ISC_R_NOMORE);
 	}
 	bdbiterator->current = ISC_LIST_HEAD(bdbnode->lists);
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
@@ -682,9 +678,9 @@ rdatasetiter_next(dns_rdatasetiter_t *iterator DNS__DB_FLARG) {

 	bdbiterator->current = ISC_LIST_NEXT(bdbiterator->current, link);
 	if (bdbiterator->current == NULL) {
-		return ISC_R_NOMORE;
+		return (ISC_R_NOMORE);
 	} else {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}
 }

@@ -787,7 +783,7 @@ createnode(bdb_t *bdb, bdbnode_t **nodep) {
 	node->magic = BDBNODE_MAGIC;

 	*nodep = node;
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static void
@@ -839,28 +835,28 @@ getoriginnode(dns_db_t *db, dns_dbnode_t **nodep DNS__DB_FLARG) {
 	REQUIRE(VALID_BDB(bdb));
 	REQUIRE(nodep != NULL && *nodep == NULL);

-	dns_name_init(&relname);
+	dns_name_init(&relname, NULL);
 	name = &relname;

 	result = createnode(bdb, &node);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}

 	result = builtin_lookup(bdb, name, node);
 	if (result != ISC_R_SUCCESS && result != ISC_R_NOTFOUND) {
 		destroynode(node);
-		return result;
+		return (result);
 	}

 	result = builtin_authority(bdb, node);
 	if (result != ISC_R_SUCCESS) {
 		destroynode(node);
-		return result;
+		return (result);
 	}

-	*nodep = (dns_dbnode_t *)node;
-	return ISC_R_SUCCESS;
+	*nodep = node;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
@@ -881,32 +877,32 @@ findnode(dns_db_t *db, const dns_name_t *name, bool create,
 	isorigin = dns_name_equal(name, &bdb->common.origin);

 	labels = dns_name_countlabels(name) - dns_name_countlabels(&db->origin);
-	dns_name_init(&relname);
+	dns_name_init(&relname, NULL);
 	dns_name_getlabelsequence(name, 0, labels, &relname);
 	name = &relname;

 	result = createnode(bdb, &node);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}

 	result = builtin_lookup(bdb, name, node);
 	if (result != ISC_R_SUCCESS && (!isorigin || result != ISC_R_NOTFOUND))
 	{
 		destroynode(node);
-		return result;
+		return (result);
 	}

 	if (isorigin) {
 		result = builtin_authority(bdb, node);
 		if (result != ISC_R_SUCCESS) {
 			destroynode(node);
-			return result;
+			return (result);
 		}
 	}

-	*nodep = (dns_dbnode_t *)node;
-	return ISC_R_SUCCESS;
+	*nodep = node;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
@@ -925,10 +921,10 @@ find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,

 	REQUIRE(VALID_BDB(bdb));
 	REQUIRE(nodep == NULL || *nodep == NULL);
-	REQUIRE(version == NULL || version == (dns_dbversion_t *)&dummy);
+	REQUIRE(version == NULL || version == (void *)&dummy);

 	if (!dns_name_issubdomain(name, &db->origin)) {
-		return DNS_R_NXDOMAIN;
+		return (DNS_R_NXDOMAIN);
 	}

 	olabels = dns_name_countlabels(&db->origin);
@@ -954,13 +950,13 @@ find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
 			 * No data at zone apex?
 			 */
 			if (i == olabels) {
-				return DNS_R_BADDB;
+				return (DNS_R_BADDB);
 			}
 			result = DNS_R_NXDOMAIN;
 			continue;
 		}
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}

 		/*
@@ -1015,7 +1011,7 @@ find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
 		 * and try again.
 		 */
 		if (i < nlabels) {
-			destroynode((bdbnode_t *)node);
+			destroynode(node);
 			node = NULL;
 			continue;
 		}
@@ -1069,7 +1065,7 @@ find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
 		detachnode(db, &node DNS__DB_FLARG_PASS);
 	}

-	return result;
+	return (result);
 }

 static void
@@ -1117,7 +1113,7 @@ findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	UNUSED(sigrdataset);

 	if (type == dns_rdatatype_rrsig) {
-		return ISC_R_NOTIMPLEMENTED;
+		return (ISC_R_NOTIMPLEMENTED);
 	}

 	list = ISC_LIST_HEAD(bdbnode->lists);
@@ -1128,12 +1124,12 @@ findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 		list = ISC_LIST_NEXT(list, link);
 	}
 	if (list == NULL) {
-		return ISC_R_NOTFOUND;
+		return (ISC_R_NOTFOUND);
 	}

 	new_rdataset(list, db, node, rdataset);

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
@@ -1142,7 +1138,7 @@ allrdatasets(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	     dns_rdatasetiter_t **iteratorp DNS__DB_FLARG) {
 	bdb_rdatasetiter_t *iterator = NULL;

-	REQUIRE(version == NULL || version == (dns_dbversion_t *)&dummy);
+	REQUIRE(version == NULL || version == &dummy);

 	iterator = isc_mem_get(db->mctx, sizeof(bdb_rdatasetiter_t));
 	*iterator = (bdb_rdatasetiter_t){
@@ -1158,7 +1154,7 @@ allrdatasets(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,

 	*iteratorp = (dns_rdatasetiter_t *)iterator;

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static dns_dbmethods_t bdb_methods = {
@@ -1186,7 +1182,7 @@ create(isc_mem_t *mctx, const dns_name_t *origin, dns_dbtype_t type,
 	REQUIRE(implementation != NULL);

 	if (type != dns_dbtype_zone) {
-		return ISC_R_NOTIMPLEMENTED;
+		return (ISC_R_NOTIMPLEMENTED);
 	}

 	bdb = isc_mem_get(mctx, sizeof(*bdb));
@@ -1197,8 +1193,8 @@ create(isc_mem_t *mctx, const dns_name_t *origin, dns_dbtype_t type,

 	isc_refcount_init(&bdb->common.references, 1);
 	isc_mem_attach(mctx, &bdb->common.mctx);
-	dns_name_init(&bdb->common.origin);
-	dns_name_dup(origin, mctx, &bdb->common.origin);
+	dns_name_init(&bdb->common.origin, NULL);
+	dns_name_dupwithoffsets(origin, mctx, &bdb->common.origin);

 	INSIST(argc >= 1);
 	if (strcmp(argv[0], "authors") == 0) {
@@ -1241,7 +1237,7 @@ create(isc_mem_t *mctx, const dns_name_t *origin, dns_dbtype_t type,

 	*dbp = (dns_db_t *)bdb;

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);

 cleanup:
 	dns_name_free(&bdb->common.origin, mctx);
@@ -1253,7 +1249,7 @@ cleanup:
 	}

 	isc_mem_putanddetach(&bdb->common.mctx, bdb, sizeof(bdb_t));
-	return result;
+	return (result);
 }

 /*
@@ -1269,17 +1265,17 @@ named_builtin_init(void) {
 	result = dns_db_register("_builtin", create, &builtin, named_g_mctx,
 				 &builtin.dbimp);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}

 	result = dns_db_register("_dns64", create, &dns64, named_g_mctx,
 				 &dns64.dbimp);
 	if (result != ISC_R_SUCCESS) {
 		dns_db_unregister(&builtin.dbimp);
-		return result;
+		return (result);
 	}

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 void
@@ -63,6 +63,7 @@ options {\n\
 	geoip-directory \".\";\n"
 #endif /* if defined(HAVE_GEOIP2) */
 			    "\
+	heartbeat-interval 60;\n\
 	interface-interval 60;\n\
 	listen-on {any;};\n\
 	listen-on-v6 {any;};\n\
@@ -95,12 +96,10 @@ options {\n\
 #endif
 			    "\
 	prefetch 2 9;\n\
-#	querylog <boolean>;\n\
 	recursing-file \"named.recursing\";\n\
 	recursive-clients 1000;\n\
 	request-nsid false;\n\
-	resolver-query-timeout 10;\n\
-#	responselog <boolean>;\n\
+	resolver-query-timeout 1500;\n\
 	rrset-order { order random; };\n\
 	secroots-file \"named.secroots\";\n\
 	send-cookie true;\n\
@@ -110,9 +109,6 @@ options {\n\
 #	session-keyfile \"" NAMED_LOCALSTATEDIR "/run/named/session.key\";\n\
 	session-keyname local-ddns;\n\
 	startup-notify-rate 20;\n\
-	sig0checks-quota 1;\n\
-	sig0key-checks-limit 16;\n\
-	sig0message-checks-limit 2;\n\
 	statistics-file \"named.stats\";\n\
 	tcp-advertised-timeout 300;\n\
 	tcp-clients 150;\n\
@@ -136,8 +132,6 @@ options {\n\
 	/* view */\n\
 	allow-new-zones no;\n\
 	allow-notify {none;};\n\
-	allow-proxy {none;};\n\
-	allow-proxy-on {any;};\n\
 	allow-query-cache { localnets; localhost; };\n\
 	allow-query-cache-on { any; };\n\
 	allow-recursion { localnets; localhost; };\n\
@@ -154,6 +148,9 @@ options {\n\
 	clients-per-query 10;\n\
 	dnssec-accept-expired no;\n\
 	dnssec-validation " VALIDATION_DEFAULT "; \n"
+#ifdef USE_DNSRPS
+			    "	dnsrps-library \"" DNSRPS_LIBRPZ_PATH "\";\n"
+#endif /* ifdef USE_DNSRPS */
 #ifdef HAVE_DNSTAP
 			    "	dnstap-identity hostname;\n"
 #endif /* ifdef HAVE_DNSTAP */
@@ -170,9 +167,7 @@ options {\n\
 	max-clients-per-query 100;\n\
 	max-ncache-ttl 10800; /* 3 hours */\n\
 	max-recursion-depth 7;\n\
-	max-recursion-queries 50;\n\
-	max-query-count 200;\n\
-	max-query-restarts 11;\n\
+	max-recursion-queries 100;\n\
 	max-stale-ttl 86400; /* 1 day */\n\
 	message-compression yes;\n\
 	min-ncache-ttl 0; /* 0 hours */\n\
@@ -191,10 +186,12 @@ options {\n\
 	recursion true;\n\
 	request-expire true;\n\
 	request-ixfr true;\n\
-	request-ixfr-max-diffs 0;\n\
 	require-server-cookie no;\n\
+	resolver-nonbackoff-tries 3;\n\
+	resolver-retry-interval 800; /* in milliseconds */\n\
 	root-key-sentinel yes;\n\
 	servfail-ttl 1;\n\
+#	sortlist <none>\n\
 	stale-answer-client-timeout off;\n\
 	stale-answer-enable false;\n\
 	stale-answer-ttl 30; /* 30 seconds */\n\
@@ -210,13 +207,14 @@ options {\n\
 	/* zone */\n\
 	allow-query {any;};\n\
 	allow-query-on {any;};\n\
-	allow-transfer {none;};\n\
+	allow-transfer {any;};\n\
 #	also-notify <none>\n\
 	check-integrity yes;\n\
 	check-mx-cname warn;\n\
 	check-sibling yes;\n\
 	check-srv-cname warn;\n\
 	check-wildcard yes;\n\
+	dialup no;\n\
 	dnssec-loadkeys-interval 60;\n\
 #	forward <none>\n\
 #	forwarders <none>\n\
@@ -224,22 +222,18 @@ options {\n\
 	ixfr-from-differences false;\n\
 	max-journal-size default;\n\
 	max-records 0;\n\
-	max-records-per-type 100;\n\
 	max-refresh-time 2419200; /* 4 weeks */\n\
 	max-retry-time 1209600; /* 2 weeks */\n\
-	max-types-per-name 100;\n\
 	max-transfer-idle-in 60;\n\
 	max-transfer-idle-out 60;\n\
 	max-transfer-time-in 120;\n\
 	max-transfer-time-out 120;\n\
 	min-refresh-time 300;\n\
 	min-retry-time 500;\n\
-	min-transfer-rate-in 10240 5;\n\
 	multi-master no;\n\
 	notify yes;\n\
 	notify-delay 5;\n\
 	notify-to-soa no;\n\
-	send-report-channel .;\n\
 	serial-update-method increment;\n\
 	sig-signing-nodes 100;\n\
 	sig-signing-signatures 10;\n\
@@ -301,11 +295,9 @@ dnssec-policy \"default\" {\n\
 	cds-digest-types { 2; };\n\
 	dnskey-ttl " DNS_KASP_KEY_TTL ";\n\
 	inline-signing yes;\n\
-	offline-ksk no;\n\
 	publish-safety " DNS_KASP_PUBLISH_SAFETY "; \n\
 	retire-safety " DNS_KASP_RETIRE_SAFETY "; \n\
 	purge-keys " DNS_KASP_PURGE_KEYS "; \n\
-	signatures-jitter " DNS_KASP_SIG_JITTER "; \n\
 	signatures-refresh " DNS_KASP_SIG_REFRESH "; \n\
 	signatures-validity " DNS_KASP_SIG_VALIDITY "; \n\
 	signatures-validity-dnskey " DNS_KASP_SIG_VALIDITY_DNSKEY "; \n\
@@ -334,7 +326,7 @@ dnssec-policy \"insecure\" {\n\

 			    "# END TRUST ANCHORS\n\
 \n\
-remote-servers " DEFAULT_IANA_ROOT_ZONE_PRIMARIES " {\n\
+primaries " DEFAULT_IANA_ROOT_ZONE_PRIMARIES " {\n\
 	2801:1b8:10::b;		# b.root-servers.net\n\
 	2001:500:2::c;		# c.root-servers.net\n\
 	2001:500:2f::f;		# f.root-servers.net\n\
@@ -358,15 +350,13 @@ named_config_parsedefaults(cfg_parser_t *parser, cfg_obj_t **conf) {

 	isc_buffer_init(&b, defaultconf, sizeof(defaultconf) - 1);
 	isc_buffer_add(&b, sizeof(defaultconf) - 1);
-	return cfg_parse_buffer(parser, &b, __FILE__, 0, &cfg_type_namedconf,
-				CFG_PCTX_NODEPRECATED | CFG_PCTX_NOOBSOLETE |
-					CFG_PCTX_NOEXPERIMENTAL,
-				conf);
+	return (cfg_parse_buffer(parser, &b, __FILE__, 0, &cfg_type_namedconf,
+				 CFG_PCTX_NODEPRECATED, conf));
 }

 const char *
 named_config_getdefault(void) {
-	return defaultconf;
+	return (defaultconf);
 }

 isc_result_t
@@ -376,10 +366,10 @@ named_config_get(cfg_obj_t const *const *maps, const char *name,

 	for (i = 0; maps[i] != NULL; i++) {
 		if (cfg_map_get(maps[i], name, obj) == ISC_R_SUCCESS) {
-			return ISC_R_SUCCESS;
+			return (ISC_R_SUCCESS);
 		}
 	}
-	return ISC_R_NOTFOUND;
+	return (ISC_R_NOTFOUND);
 }

 isc_result_t
@@ -405,7 +395,7 @@ named_checknames_get(const cfg_obj_t **maps, const char *const names[],
 			 */
 			if (checknames != NULL && !cfg_obj_islist(checknames)) {
 				*obj = checknames;
-				return ISC_R_SUCCESS;
+				return (ISC_R_SUCCESS);
 			}
 			for (element = cfg_list_first(checknames);
 			     element != NULL; element = cfg_list_next(element))
@@ -419,13 +409,13 @@ named_checknames_get(const cfg_obj_t **maps, const char *const names[],
 					{
 						*obj = cfg_tuple_get(value,
 								     "mode");
-						return ISC_R_SUCCESS;
+						return (ISC_R_SUCCESS);
 					}
 				}
 			}
 		}
 	}
-	return ISC_R_NOTFOUND;
+	return (ISC_R_NOTFOUND);
 }

 int
@@ -437,7 +427,7 @@ named_config_listcount(const cfg_obj_t *list) {
 		i++;
 	}

-	return i;
+	return (i);
 }

 isc_result_t
@@ -448,16 +438,16 @@ named_config_getclass(const cfg_obj_t *classobj, dns_rdataclass_t defclass,

 	if (!cfg_obj_isstring(classobj)) {
 		*classp = defclass;
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}
 	r.base = UNCONST(cfg_obj_asstring(classobj));
 	r.length = strlen(r.base);
 	result = dns_rdataclass_fromtext(classp, &r);
 	if (result != ISC_R_SUCCESS) {
-		cfg_obj_log(classobj, ISC_LOG_ERROR, "unknown class '%s'",
-			    r.base);
+		cfg_obj_log(classobj, named_g_lctx, ISC_LOG_ERROR,
+			    "unknown class '%s'", r.base);
 	}
-	return result;
+	return (result);
 }

 isc_result_t
@@ -468,16 +458,16 @@ named_config_gettype(const cfg_obj_t *typeobj, dns_rdatatype_t deftype,

 	if (!cfg_obj_isstring(typeobj)) {
 		*typep = deftype;
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}
 	r.base = UNCONST(cfg_obj_asstring(typeobj));
 	r.length = strlen(r.base);
 	result = dns_rdatatype_fromtext(typep, &r);
 	if (result != ISC_R_SUCCESS) {
-		cfg_obj_log(typeobj, ISC_LOG_ERROR, "unknown type '%s'",
-			    r.base);
+		cfg_obj_log(typeobj, named_g_lctx, ISC_LOG_ERROR,
+			    "unknown type '%s'", r.base);
 	}
-	return result;
+	return (result);
 }

 dns_zonetype_t
@@ -503,12 +493,12 @@ named_config_getzonetype(const cfg_obj_t *zonetypeobj) {
 	} else {
 		UNREACHABLE();
 	}
-	return ztype;
+	return (ztype);
 }

-isc_result_t
-named_config_getremotesdef(const cfg_obj_t *cctx, const char *list,
-			   const char *name, const cfg_obj_t **ret) {
+static isc_result_t
+getremotesdef(const cfg_obj_t *cctx, const char *list, const char *name,
+	      const cfg_obj_t **ret) {
 	isc_result_t result;
 	const cfg_obj_t *obj = NULL;
 	const cfg_listelt_t *elt;
@@ -519,7 +509,7 @@ named_config_getremotesdef(const cfg_obj_t *cctx, const char *list,

 	result = cfg_map_get(cctx, list, &obj);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}
 	elt = cfg_list_first(obj);
 	while (elt != NULL) {
@@ -528,11 +518,28 @@ named_config_getremotesdef(const cfg_obj_t *cctx, const char *list,
 			       name) == 0)
 		{
 			*ret = obj;
-			return ISC_R_SUCCESS;
+			return (ISC_R_SUCCESS);
 		}
 		elt = cfg_list_next(elt);
 	}
-	return ISC_R_NOTFOUND;
+	return (ISC_R_NOTFOUND);
+}
+
+isc_result_t
+named_config_getremotesdef(const cfg_obj_t *cctx, const char *list,
+			   const char *name, const cfg_obj_t **ret) {
+	isc_result_t result;
+
+	if (strcmp(list, "parental-agents") == 0) {
+		return (getremotesdef(cctx, list, name, ret));
+	} else if (strcmp(list, "primaries") == 0) {
+		result = getremotesdef(cctx, list, name, ret);
+		if (result != ISC_R_SUCCESS) {
+			result = getremotesdef(cctx, "masters", name, ret);
+		}
+		return (result);
+	}
+	return (ISC_R_NOTFOUND);
 }

 static isc_result_t
@@ -547,26 +554,26 @@ named_config_getname(isc_mem_t *mctx, const cfg_obj_t *obj,

 	if (!cfg_obj_isstring(obj)) {
 		*namep = NULL;
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	*namep = isc_mem_get(mctx, sizeof(**namep));
-	dns_name_init(*namep);
+	dns_name_init(*namep, NULL);

 	objstr = cfg_obj_asstring(obj);
 	isc_buffer_constinit(&b, objstr, strlen(objstr));
 	isc_buffer_add(&b, strlen(objstr));
 	dns_fixedname_init(&fname);
 	result = dns_name_fromtext(dns_fixedname_name(&fname), &b, dns_rootname,
-				   0);
+				   0, NULL);
 	if (result != ISC_R_SUCCESS) {
 		isc_mem_put(mctx, *namep, sizeof(**namep));
 		*namep = NULL;
-		return result;
+		return (result);
 	}
 	dns_name_dup(dns_fixedname_name(&fname), mctx, *namep);

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 #define grow_array(mctx, array, newlen, oldlen)                          \
@@ -583,12 +590,10 @@ named_config_getname(isc_mem_t *mctx, const cfg_obj_t *obj,
 		oldlen = newlen;                                    \
 	}

-static const char *remotesnames[4] = { "remote-servers", "parental-agents",
-				       "primaries", "masters" };
-
 isc_result_t
-named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
-			     isc_mem_t *mctx, dns_ipkeylist_t *ipkl) {
+named_config_getipandkeylist(const cfg_obj_t *config, const char *listtype,
+			     const cfg_obj_t *list, isc_mem_t *mctx,
+			     dns_ipkeylist_t *ipkl) {
 	uint32_t addrcount = 0, srccount = 0;
 	uint32_t keycount = 0, tlscount = 0;
 	uint32_t listcount = 0, l = 0, i = 0;
@@ -651,7 +656,7 @@ newlist:
 	if (cfg_obj_isuint32(portobj)) {
 		uint32_t val = cfg_obj_asuint32(portobj);
 		if (val > UINT16_MAX) {
-			cfg_obj_log(portobj, ISC_LOG_ERROR,
+			cfg_obj_log(portobj, named_g_lctx, ISC_LOG_ERROR,
 				    "port '%u' out of range", val);
 			result = ISC_R_RANGE;
 			goto cleanup;
@@ -671,6 +676,8 @@ newlist:
 		isc_sockaddr_any6(&src6);
 	}

+	result = ISC_R_NOMEMORY;
+
 	element = cfg_list_first(addrlist);
 resume:
 	for (; element != NULL; element = cfg_list_next(element)) {
@@ -701,22 +708,17 @@ resume:
 				continue;
 			}
 			list = NULL;
-			tresult = ISC_R_NOTFOUND;
-			for (size_t n = 0; n < ARRAY_SIZE(remotesnames); n++) {
-				tresult = named_config_getremotesdef(
-					config, remotesnames[n], listname,
-					&list);
-				if (tresult == ISC_R_SUCCESS) {
-					break;
-				}
-			}
+			tresult = named_config_getremotesdef(config, listtype,
+							     listname, &list);
 			if (tresult == ISC_R_NOTFOUND) {
-				cfg_obj_log(addr, ISC_LOG_ERROR,
-					    "remote-servers \"%s\" not found",
+				cfg_obj_log(addr, named_g_lctx, ISC_LOG_ERROR,
+					    "%s \"%s\" not found", listtype,
 					    listname);
+
+				result = tresult;
+				goto cleanup;
 			}
 			if (tresult != ISC_R_SUCCESS) {
-				result = tresult;
 				goto cleanup;
 			}
 			lists[l++].name = listname;
@@ -819,7 +821,7 @@ resume:
 	ipkl->count = addrcount;
 	ipkl->allocated = addrcount;

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);

 cleanup:
 	if (addrs != NULL) {
@@ -858,7 +860,7 @@ cleanup:
 	if (stack != NULL) {
 		isc_mem_cput(mctx, stack, stackcount, sizeof(stack[0]));
 	}
-	return result;
+	return (result);
 }

 isc_result_t
@@ -881,12 +883,13 @@ named_config_getport(const cfg_obj_t *config, const char *type,
 	result = named_config_get(maps, type, &portobj);
 	INSIST(result == ISC_R_SUCCESS);
 	if (cfg_obj_asuint32(portobj) >= UINT16_MAX) {
-		cfg_obj_log(portobj, ISC_LOG_ERROR, "port '%u' out of range",
+		cfg_obj_log(portobj, named_g_lctx, ISC_LOG_ERROR,
+			    "port '%u' out of range",
 			    cfg_obj_asuint32(portobj));
-		return ISC_R_RANGE;
+		return (ISC_R_RANGE);
 	}
 	*portp = (in_port_t)cfg_obj_asuint32(portobj);
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 struct keyalgorithms {
@@ -930,15 +933,15 @@ named_config_getkeyalgorithm(const char *str, unsigned int *typep,
 		}
 	}
 	if (algorithms[i].str == NULL) {
-		return ISC_R_NOTFOUND;
+		return (ISC_R_NOTFOUND);
 	}
 	if (str[len] == '-') {
 		result = isc_parse_uint16(&bits, str + len + 1, 10);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 		if (bits > algorithms[i].size) {
-			return ISC_R_RANGE;
+			return (ISC_R_RANGE);
 		}
 	} else if (algorithms[i].size == 0) {
 		bits = 128;
@@ -947,5 +950,5 @@ named_config_getkeyalgorithm(const char *str, unsigned int *typep,
 	}
 	SET_IF_NOT_NULL(typep, algorithms[i].type);
 	SET_IF_NOT_NULL(digestbits, bits);
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }
@@ -16,7 +16,6 @@
 #include <stdbool.h>

 #include <isc/lex.h>
-#include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
 #include <isc/string.h>
@@ -44,23 +43,23 @@ getcommand(isc_lex_t *lex, char **cmdp) {

 	result = isc_lex_gettoken(lex, ISC_LEXOPT_EOF, &token);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}

 	isc_lex_ungettoken(lex, &token);

 	if (token.type != isc_tokentype_string) {
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

 	*cmdp = token.value.as_textregion.base;

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static bool
 command_compare(const char *str, const char *command) {
-	return strcasecmp(str, command) == 0;
+	return (strcasecmp(str, command) == 0);
 }

 /*%
@@ -86,7 +85,7 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		/*
 		 * No data section.
 		 */
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

 	result = isccc_cc_lookupstring(data, "type", &cmdline);
@@ -94,7 +93,7 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		/*
 		 * We have no idea what this is.
 		 */
-		return result;
+		return (result);
 	}

 	isc_lex_create(named_g_mctx, strlen(cmdline), &lex);
@@ -135,7 +134,7 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 	    !command_compare(command, NAMED_COMMAND_TESTGEN) &&
 	    !command_compare(command, NAMED_COMMAND_ZONESTATUS))
 	{
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL,
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_CONTROL, log_level,
 			      "rejecting restricted control channel "
 			      "command '%s'",
@@ -144,9 +143,9 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		goto cleanup;
 	}

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_CONTROL,
-		      log_level, "received control channel command '%s'",
-		      cmdline);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_CONTROL, log_level,
+		      "received control channel command '%s'", cmdline);

 	/*
 	 * After the lengthy "halt" and "stop", the commands are
@@ -178,7 +177,6 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		/* Do not flush master files */
 		named_server_flushonshutdown(named_g_server, false);
 		named_os_shutdownmsg(cmdline, *text);
-		isc_loopmgr_shutdown(named_g_loopmgr);
 		result = ISC_R_SHUTTINGDOWN;
 	} else if (command_compare(command, NAMED_COMMAND_STOP)) {
 		/*
@@ -196,15 +194,11 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 #endif /* ifdef HAVE_LIBSCF */
 		named_server_flushonshutdown(named_g_server, true);
 		named_os_shutdownmsg(cmdline, *text);
-		isc_loopmgr_shutdown(named_g_loopmgr);
 		result = ISC_R_SHUTTINGDOWN;
 	} else if (command_compare(command, NAMED_COMMAND_ADDZONE) ||
 		   command_compare(command, NAMED_COMMAND_MODZONE))
 	{
 		result = named_server_changezone(named_g_server, cmdline, text);
-	} else if (command_compare(command, NAMED_COMMAND_CLOSELOGS)) {
-		isc_log_closefilelogs();
-		result = ISC_R_SUCCESS;
 	} else if (command_compare(command, NAMED_COMMAND_DELZONE)) {
 		result = named_server_delzone(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_DNSSEC)) {
@@ -214,7 +208,8 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 	{
 		result = named_server_dnstap(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_DUMPDB)) {
-		result = named_server_dumpdb(named_g_server, lex, text);
+		named_server_dumpdb(named_g_server, lex, text);
+		result = ISC_R_SUCCESS;
 	} else if (command_compare(command, NAMED_COMMAND_DUMPSTATS)) {
 		result = named_server_dumpstats(named_g_server);
 	} else if (command_compare(command, NAMED_COMMAND_FETCHLIMIT)) {
@@ -227,30 +222,24 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		result = named_server_flushnode(named_g_server, lex, true);
 	} else if (command_compare(command, NAMED_COMMAND_FREEZE)) {
 		result = named_server_freeze(named_g_server, true, lex, text);
-	} else if (command_compare(command, NAMED_COMMAND_SKR)) {
-		result = named_server_skr(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_LOADKEYS) ||
 		   command_compare(command, NAMED_COMMAND_SIGN))
 	{
 		result = named_server_rekey(named_g_server, lex, text);
-	} else if (command_compare(command, NAMED_COMMAND_MEMPROF)) {
-		result = named_server_togglememprof(lex);
 	} else if (command_compare(command, NAMED_COMMAND_MKEYS)) {
 		result = named_server_mkeys(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_NOTIFY)) {
 		result = named_server_notifycommand(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_NOTRACE)) {
 		named_g_debuglevel = 0;
-		isc_log_setdebuglevel(named_g_debuglevel);
+		isc_log_setdebuglevel(named_g_lctx, named_g_debuglevel);
 		result = ISC_R_SUCCESS;
 	} else if (command_compare(command, NAMED_COMMAND_NTA)) {
 		result = named_server_nta(named_g_server, lex, readonly, text);
 	} else if (command_compare(command, NAMED_COMMAND_NULL)) {
 		result = ISC_R_SUCCESS;
 	} else if (command_compare(command, NAMED_COMMAND_QUERYLOG)) {
-		result = named_server_setortoggle(named_g_server,
-						  "query logging",
-						  NS_SERVER_LOGQUERIES, lex);
+		result = named_server_togglequerylog(named_g_server, lex);
 	} else if (command_compare(command, NAMED_COMMAND_RECONFIG)) {
 		result = named_server_reconfigcommand(named_g_server);
 	} else if (command_compare(command, NAMED_COMMAND_RECURSING)) {
@@ -259,10 +248,6 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		result = named_server_refreshcommand(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_RELOAD)) {
 		result = named_server_reloadcommand(named_g_server, lex, text);
-	} else if (command_compare(command, NAMED_COMMAND_RESPONSELOG)) {
-		result = named_server_setortoggle(named_g_server,
-						  "response logging",
-						  NS_SERVER_LOGRESPONSES, lex);
 	} else if (command_compare(command, NAMED_COMMAND_RETRANSFER)) {
 		result = named_server_retransfercommand(named_g_server, lex,
 							text);
@@ -296,7 +281,7 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 	} else if (command_compare(command, NAMED_COMMAND_ZONESTATUS)) {
 		result = named_server_zonestatus(named_g_server, lex, text);
 	} else {
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL,
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_CONTROL, ISC_LOG_WARNING,
 			      "unknown control channel command '%s'", command);
 		result = DNS_R_UNKNOWNCOMMAND;
@@ -307,5 +292,5 @@ cleanup:
 		isc_lex_destroy(&lex);
 	}

-	return result;
+	return (result);
 }
@@ -31,13 +31,13 @@
 #include <isc/result.h>
 #include <isc/stdtime.h>
 #include <isc/string.h>
-#include <isc/symtab.h>
 #include <isc/util.h>

 #include <isccc/alist.h>
 #include <isccc/cc.h>
 #include <isccc/ccmsg.h>
 #include <isccc/sexpr.h>
+#include <isccc/symtab.h>
 #include <isccc/util.h>

 #include <isccfg/check.h>
@@ -91,7 +91,7 @@ struct controllistener {
 	isc_sockaddr_t address;
 	isc_nmsocket_t *sock;
 	dns_acl_t *acl;
-	bool shuttingdown;
+	bool exiting;
 	isc_refcount_t references;
 	controlkeylist_t keys;
 	controlconnectionlist_t connections;
@@ -108,7 +108,7 @@ struct named_controls {
 	controllistenerlist_t listeners;
 	bool shuttingdown;
 	isc_mutex_t symtab_lock;
-	isc_symtab_t *symtab;
+	isccc_symtab_t *symtab;
 };

 static isc_result_t
@@ -119,8 +119,6 @@ static void
 conn_cleanup(controlconnection_t *conn);
 static void
 conn_free(controlconnection_t *conn);
-static void
-conn_shutdown(controlconnection_t *conn);

 #if NAMED_CONTROLCONF_TRACE
 #define controllistener_ref(ptr) \
@@ -149,14 +147,6 @@ ISC_REFCOUNT_DECL(controlconnection);

 #define CLOCKSKEW 300

-#define CHECK(x)                               \
-	{                                      \
-		result = (x);                  \
-		if (result != ISC_R_SUCCESS) { \
-			goto cleanup;          \
-		}                              \
-	}
-
 static void
 free_controlkey(controlkey_t *key, isc_mem_t *mctx) {
 	if (key->keyname != NULL) {
@@ -179,7 +169,8 @@ free_controlkeylist(controlkeylist_t *keylist, isc_mem_t *mctx) {

 static void
 free_listener(controllistener_t *listener) {
-	REQUIRE(listener->shuttingdown);
+	REQUIRE(isc_tid() == 0);
+	REQUIRE(listener->exiting);
 	REQUIRE(ISC_LIST_EMPTY(listener->connections));
 	REQUIRE(listener->sock == NULL);

@@ -202,32 +193,28 @@ ISC_REFCOUNT_IMPL(controlconnection, conn_free);

 static void
 shutdown_listener(controllistener_t *listener) {
-	controlconnection_t *conn = NULL;
-	controlconnection_t *next = NULL;
+	REQUIRE(isc_tid() == 0);
+	if (!listener->exiting) {
+		char socktext[ISC_SOCKADDR_FORMATSIZE];

-	/* Don't shutdown the same listener twice */
-	if (listener->shuttingdown) {
-		return;
+		for (controlconnection_t *conn =
+			     ISC_LIST_HEAD(listener->connections);
+		     conn != NULL; conn = ISC_LIST_HEAD(listener->connections))
+		{
+			control_recvmessage(conn->ccmsg.handle,
+					    ISC_R_SHUTTINGDOWN, conn);
+		}
+
+		ISC_LIST_UNLINK(listener->controls->listeners, listener, link);
+
+		isc_sockaddr_format(&listener->address, socktext,
+				    sizeof(socktext));
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_CONTROL, ISC_LOG_NOTICE,
+			      "stopping command channel on %s", socktext);
+
+		listener->exiting = true;
 	}
-	listener->shuttingdown = true;
-
-	for (conn = ISC_LIST_HEAD(listener->connections); conn != NULL;
-	     conn = next)
-	{
-		/*
-		 * 'conn' is likely to be freed by the conn_shutdown() call.
-		 */
-		next = ISC_LIST_NEXT(conn, link);
-		conn_shutdown(conn);
-	}
-
-	ISC_LIST_UNLINK(listener->controls->listeners, listener, link);
-
-	char socktext[ISC_SOCKADDR_FORMATSIZE];
-	isc_sockaddr_format(&listener->address, socktext, sizeof(socktext));
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_CONTROL,
-		      ISC_LOG_NOTICE, "stopping command channel on %s",
-		      socktext);

 	isc_nm_stoplistening(listener->sock);
 	isc_nmsocket_close(&listener->sock);
@@ -246,42 +233,41 @@ address_ok(isc_sockaddr_t *sockaddr, controllistener_t *listener) {

 	result = dns_acl_match(&netaddr, NULL, listener->acl, env, &match,
 			       NULL);
-	return result == ISC_R_SUCCESS && match > 0;
+	return (result == ISC_R_SUCCESS && match > 0);
 }

 static void
 control_senddone(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 	controlconnection_t *conn = (controlconnection_t *)arg;
+	controllistener_t *listener = conn->listener;
+	isc_sockaddr_t peeraddr = isc_nmhandle_peeraddr(handle);

-	if (conn->shuttingdown) {
-		/* The connection is shuttingdown */
-		result = ISC_R_SHUTTINGDOWN;
+	if (conn->result == ISC_R_SHUTTINGDOWN) {
+		isc_loopmgr_shutdown(named_g_loopmgr);
+		goto cleanup_sendhandle;
 	}

-	if (result == ISC_R_SUCCESS) {
-		/* Everything is peachy, continue reading from the socket */
-		isccc_ccmsg_readmessage(&conn->ccmsg, control_recvmessage,
-					conn);
-		/* Detach the sending reference */
-		controlconnection_detach(&conn);
-		return;
-	}
-
-	if (result != ISC_R_SHUTTINGDOWN) {
+	if (listener->controls->shuttingdown || result == ISC_R_SHUTTINGDOWN) {
+		goto cleanup_sendhandle;
+	} else if (result != ISC_R_SUCCESS) {
 		char socktext[ISC_SOCKADDR_FORMATSIZE];
-		isc_sockaddr_t peeraddr = isc_nmhandle_peeraddr(handle);

 		isc_sockaddr_format(&peeraddr, socktext, sizeof(socktext));
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL,
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_CONTROL, ISC_LOG_WARNING,
 			      "error sending command response to %s: %s",
 			      socktext, isc_result_totext(result));
+		goto cleanup_sendhandle;
 	}

-	/* Shutdown the reading */
-	conn_shutdown(conn);
+	isccc_ccmsg_readmessage(&conn->ccmsg, control_recvmessage, conn);

-	/* Detach the sending reference */
+cleanup_sendhandle:
+	if (result != ISC_R_SUCCESS) {
+		control_recvmessage(handle, result, conn);
+	}
+
+	REQUIRE(isc_tid() == 0);
 	controlconnection_detach(&conn);
 }

@@ -291,8 +277,9 @@ log_invalid(isccc_ccmsg_t *ccmsg, isc_result_t result) {
 	isc_sockaddr_t peeraddr = isc_nmhandle_peeraddr(ccmsg->handle);

 	isc_sockaddr_format(&peeraddr, socktext, sizeof(socktext));
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_CONTROL,
-		      ISC_LOG_ERROR, "invalid command from %s: %s", socktext,
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_CONTROL, ISC_LOG_ERROR,
+		      "invalid command from %s: %s", socktext,
 		      isc_result_totext(result));
 }

@@ -387,7 +374,7 @@ control_respond(controlconnection_t *conn) {
 	r.base = conn->buffer->base;
 	r.length = conn->buffer->used;

-	/* Attach the sending reference */
+	REQUIRE(isc_tid() == 0);
 	controlconnection_ref(conn);
 	isccc_ccmsg_sendmessage(&conn->ccmsg, &r, control_senddone, conn);

@@ -398,33 +385,15 @@ cleanup:
 static void
 control_command(void *arg) {
 	controlconnection_t *conn = (controlconnection_t *)arg;
+	controllistener_t *listener = conn->listener;

-	/* Don't run the command if we already started the shutdown */
-	if (!conn->shuttingdown) {
+	if (!listener->controls->shuttingdown) {
 		conn->result = named_control_docommand(
-			conn->request, conn->listener->readonly, &conn->text);
+			conn->request, listener->readonly, &conn->text);
 		control_respond(conn);
 	}

-	/* Detach the control command reference */
-	controlconnection_detach(&conn);
-}
-
-static void
-conn_shutdown(controlconnection_t *conn) {
-	/* Don't shutdown the same controlconnection twice */
-	if (conn->shuttingdown) {
-		return;
-	}
-	conn->shuttingdown = true;
-
-	/*
-	 * Close the TCP connection to make sure that no read callback will be
-	 * called for it ever again.
-	 */
-	isccc_ccmsg_disconnect(&conn->ccmsg);
-
-	/* Detach the reading reference */
+	REQUIRE(isc_tid() == 0);
 	controlconnection_detach(&conn);
 }

@@ -438,7 +407,19 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
 	isccc_time_t exp;
 	uint32_t nonce;

+	INSIST(!conn->shuttingdown);
+
+	/* Is the server shutting down? */
+	if (listener->controls->shuttingdown) {
+		result = ISC_R_SHUTTINGDOWN;
+	}
+
 	if (result != ISC_R_SUCCESS) {
+		if (result == ISC_R_SHUTTINGDOWN) {
+			listener->controls->shuttingdown = true;
+		} else if (result != ISC_R_EOF) {
+			log_invalid(&conn->ccmsg, result);
+		}
 		goto cleanup;
 	}

@@ -464,13 +445,13 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
 	}

 	if (key == NULL) {
-		result = ISCCC_R_BADAUTH;
+		log_invalid(&conn->ccmsg, ISCCC_R_BADAUTH);
 		goto cleanup;
 	}

 	/* We shouldn't be getting a reply. */
 	if (isccc_cc_isreply(conn->request)) {
-		result = ISC_R_FAILURE;
+		log_invalid(&conn->ccmsg, ISC_R_FAILURE);
 		goto cleanup;
 	}

@@ -481,7 +462,7 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
 	 */
 	conn->ctrl = isccc_alist_lookup(conn->request, "_ctrl");
 	if (!isccc_alist_alistp(conn->ctrl)) {
-		result = ISC_R_FAILURE;
+		log_invalid(&conn->ccmsg, ISC_R_FAILURE);
 		goto cleanup;
 	}

@@ -489,11 +470,11 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
 		if ((sent + CLOCKSKEW) < conn->now ||
 		    (sent - CLOCKSKEW) > conn->now)
 		{
-			result = DNS_R_CLOCKSKEW;
+			log_invalid(&conn->ccmsg, ISCCC_R_CLOCKSKEW);
 			goto cleanup;
 		}
 	} else {
-		result = ISC_R_FAILURE;
+		log_invalid(&conn->ccmsg, ISC_R_FAILURE);
 		goto cleanup;
 	}

@@ -503,7 +484,7 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
 	if (isccc_cc_lookupuint32(conn->ctrl, "_exp", &exp) == ISC_R_SUCCESS &&
 	    conn->now > exp)
 	{
-		result = DNS_R_EXPIRED;
+		log_invalid(&conn->ccmsg, ISCCC_R_EXPIRED);
 		goto cleanup;
 	}

@@ -519,6 +500,7 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
 		if (result == ISC_R_EXISTS) {
 			result = ISCCC_R_DUPLICATE;
 		}
+		log_invalid(&conn->ccmsg, result);
 		goto cleanup;
 	}

@@ -527,7 +509,7 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
 		     ISC_R_SUCCESS ||
 	     conn->nonce != nonce))
 	{
-		result = ISCCC_R_BADAUTH;
+		log_invalid(&conn->ccmsg, ISCCC_R_BADAUTH);
 		goto cleanup;
 	}

@@ -545,35 +527,31 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
 		return;
 	}

-	/* Attach the command reference */
+	/*
+	 * Trigger the command.
+	 */
+	REQUIRE(isc_tid() == 0);
 	controlconnection_ref(conn);
-
-	/* Trigger the command asynchronously. */
 	isc_async_run(named_g_mainloop, control_command, conn);

 	return;

 cleanup:
-	switch (result) {
-	case ISC_R_SHUTTINGDOWN:
-	case ISC_R_EOF:
-		break;
-	default:
-		log_invalid(&conn->ccmsg, result);
-	}
+	/* Make sure no read callbacks are called again */
+	isccc_ccmsg_invalidate(&conn->ccmsg);

-	conn_shutdown(conn);
+	conn->shuttingdown = true;
+
+	REQUIRE(isc_tid() == 0);
+	controlconnection_detach(&conn);
 }

 static void
 conn_free(controlconnection_t *conn) {
-	/* Make sure that the connection was shutdown first */
-	REQUIRE(conn->shuttingdown);
+	REQUIRE(isc_tid() == 0);

 	controllistener_t *listener = conn->listener;

-	isccc_ccmsg_invalidate(&conn->ccmsg);
-
 	conn_cleanup(conn);

 	if (conn->buffer != NULL) {
@@ -587,8 +565,9 @@ conn_free(controlconnection_t *conn) {
 	}
 #endif /* ifdef ENABLE_AFL */

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_CONTROL,
-		      ISC_LOG_DEBUG(3), "freeing control connection");
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_CONTROL, ISC_LOG_DEBUG(3),
+		      "freeing control connection");

 	isc_mem_put(listener->mctx, conn, sizeof(*conn));

@@ -597,25 +576,17 @@ conn_free(controlconnection_t *conn) {

 static void
 newconnection(controllistener_t *listener, isc_nmhandle_t *handle) {
-	/* Don't create new connection if we are shutting down */
-	if (listener->shuttingdown) {
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_CONTROL, ISC_LOG_DEBUG(3),
-			      "rejected new control connection: %s",
-			      isc_result_totext(ISC_R_SHUTTINGDOWN));
-		return;
-	}
+	REQUIRE(isc_tid() == 0);

 	controlconnection_t *conn = isc_mem_get(listener->mctx, sizeof(*conn));
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_CONTROL,
-		      ISC_LOG_DEBUG(3), "allocate new control connection");
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_CONTROL, ISC_LOG_DEBUG(3),
+		      "allocate new control connection");

-	*conn = (controlconnection_t){
-		.alg = DST_ALG_UNKNOWN,
-		.references = ISC_REFCOUNT_INITIALIZER(1),
-		.listener = controllistener_ref(listener),
-		.link = ISC_LINK_INITIALIZER,
-	};
+	*conn = (controlconnection_t){ .alg = DST_ALG_UNKNOWN };
+
+	isc_refcount_init(&conn->references, 1);
+	controllistener_attach(listener, &conn->listener);

 	/* isccc_ccmsg_init() attaches to the handle */
 	isccc_ccmsg_init(listener->mctx, handle, &conn->ccmsg);
@@ -623,9 +594,8 @@ newconnection(controllistener_t *listener, isc_nmhandle_t *handle) {
 	/* Set a 32 KiB upper limit on incoming message. */
 	isccc_ccmsg_setmaxsize(&conn->ccmsg, 32768);

-	ISC_LIST_APPEND(listener->connections, conn, link);
+	ISC_LIST_INITANDAPPEND(listener->connections, conn, link);

-	/* The reading reference has been initialized in the initializer */
 	isccc_ccmsg_readmessage(&conn->ccmsg, control_recvmessage, conn);
 }

@@ -638,22 +608,22 @@ control_newconn(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 		if (result == ISC_R_SHUTTINGDOWN) {
 			shutdown_listener(listener);
 		}
-		return result;
+		return (result);
 	}

 	peeraddr = isc_nmhandle_peeraddr(handle);
 	if (!address_ok(&peeraddr, listener)) {
 		char socktext[ISC_SOCKADDR_FORMATSIZE];
 		isc_sockaddr_format(&peeraddr, socktext, sizeof(socktext));
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL,
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_CONTROL, ISC_LOG_WARNING,
 			      "rejected command channel message from %s",
 			      socktext);
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

 	newconnection(listener, handle);
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static void
@@ -665,7 +635,8 @@ controls_shutdown(named_controls_t *controls) {
 	     listener = next)
 	{
 		/*
-		 * As listeners shut down, they will call their callbacks.
+		 * This is asynchronous.  As listeners shut down, they will
+		 * call their callbacks.
 		 */
 		next = ISC_LIST_NEXT(listener, link);
 		shutdown_listener(listener);
@@ -674,20 +645,8 @@ controls_shutdown(named_controls_t *controls) {

 void
 named_controls_shutdown(named_controls_t *controls) {
-	/*
-	 * Don't ever shutdown the controls twice.
-	 *
-	 * NOTE: This functions is called when the server is shutting down, but
-	 * controls_shutdown() can and will be called multiple times - on each
-	 * reconfiguration, the listeners will be torn down and recreated again,
-	 * see named_controls_configure() for details.
-	 */
-	if (controls->shuttingdown) {
-		return;
-	}
-	controls->shuttingdown = true;
-
 	controls_shutdown(controls);
+	controls->shuttingdown = true;
 }

 static isc_result_t
@@ -707,11 +666,11 @@ cfgkeylist_find(const cfg_obj_t *keylist, const char *keyname,
 		}
 	}
 	if (element == NULL) {
-		return ISC_R_NOTFOUND;
+		return (ISC_R_NOTFOUND);
 	}
 	obj = cfg_listelt_value(element);
 	*objp = obj;
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static void
@@ -736,6 +695,7 @@ controlkeylist_fromcfg(const cfg_obj_t *keylist, isc_mem_t *mctx,
 		key->secret.length = 0;
 		ISC_LINK_INIT(key, link);
 		ISC_LIST_APPEND(*keyids, key, link);
+		newstr = NULL;
 	}
 }

@@ -756,7 +716,7 @@ register_keys(const cfg_obj_t *control, const cfg_obj_t *keylist,

 		result = cfgkeylist_find(keylist, keyid->keyname, &keydef);
 		if (result != ISC_R_SUCCESS) {
-			cfg_obj_log(control, ISC_LOG_WARNING,
+			cfg_obj_log(control, named_g_lctx, ISC_LOG_WARNING,
 				    "couldn't find key '%s' for use with "
 				    "command channel %s",
 				    keyid->keyname, socktext);
@@ -779,7 +739,8 @@ register_keys(const cfg_obj_t *control, const cfg_obj_t *keylist,
 			result = named_config_getkeyalgorithm(algstr, &algtype,
 							      NULL);
 			if (result != ISC_R_SUCCESS) {
-				cfg_obj_log(control, ISC_LOG_WARNING,
+				cfg_obj_log(control, named_g_lctx,
+					    ISC_LOG_WARNING,
 					    "unsupported algorithm '%s' in "
 					    "key '%s' for use with command "
 					    "channel %s",
@@ -794,7 +755,8 @@ register_keys(const cfg_obj_t *control, const cfg_obj_t *keylist,
 			result = isc_base64_decodestring(secretstr, &b);

 			if (result != ISC_R_SUCCESS) {
-				cfg_obj_log(keydef, ISC_LOG_WARNING,
+				cfg_obj_log(keydef, named_g_lctx,
+					    ISC_LOG_WARNING,
 					    "secret for key '%s' on "
 					    "command channel %s: %s",
 					    keyid->keyname, socktext,
@@ -813,6 +775,14 @@ register_keys(const cfg_obj_t *control, const cfg_obj_t *keylist,
 	}
 }

+#define CHECK(x)                               \
+	do {                                   \
+		result = (x);                  \
+		if (result != ISC_R_SUCCESS) { \
+			goto cleanup;          \
+		}                              \
+	} while (0)
+
 static isc_result_t
 get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
 	isc_result_t result;
@@ -828,27 +798,30 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
 	unsigned int algtype;
 	isc_buffer_t b;

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_CONTROL,
-		      ISC_LOG_INFO, "configuring command channel from '%s'",
-		      named_g_keyfile);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_CONTROL, ISC_LOG_INFO,
+		      "configuring command channel from '%s'", named_g_keyfile);
 	if (!isc_file_exists(named_g_keyfile)) {
-		return ISC_R_FILENOTFOUND;
+		return (ISC_R_FILENOTFOUND);
 	}

-	CHECK(cfg_parser_create(mctx, &pctx));
+	CHECK(cfg_parser_create(mctx, named_g_lctx, &pctx));
 	CHECK(cfg_parse_file(pctx, named_g_keyfile, &cfg_type_rndckey,
 			     &config));
 	CHECK(cfg_map_get(config, "key", &key));

 	keyid = isc_mem_get(mctx, sizeof(*keyid));
-	*keyid = (controlkey_t){
-		.algorithm = DST_ALG_UNKNOWN,
-		.link = ISC_LINK_INITIALIZER,
-	};
 	keyid->keyname = isc_mem_strdup(mctx,
 					cfg_obj_asstring(cfg_map_getname(key)));
+	keyid->secret.base = NULL;
+	keyid->secret.length = 0;
+	keyid->algorithm = DST_ALG_UNKNOWN;
+	ISC_LINK_INIT(keyid, link);
+	if (keyid->keyname == NULL) {
+		CHECK(ISC_R_NOMEMORY);
+	}

-	CHECK(isccfg_check_key(key));
+	CHECK(isccfg_check_key(key, named_g_lctx));

 	(void)cfg_map_get(key, "algorithm", &algobj);
 	(void)cfg_map_get(key, "secret", &secretobj);
@@ -859,7 +832,7 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {

 	result = named_config_getkeyalgorithm(algstr, &algtype, NULL);
 	if (result != ISC_R_SUCCESS) {
-		cfg_obj_log(key, ISC_LOG_WARNING,
+		cfg_obj_log(key, named_g_lctx, ISC_LOG_WARNING,
 			    "unsupported algorithm '%s' in "
 			    "key '%s' for use with command "
 			    "channel",
@@ -872,7 +845,7 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
 	result = isc_base64_decodestring(secretstr, &b);

 	if (result != ISC_R_SUCCESS) {
-		cfg_obj_log(key, ISC_LOG_WARNING,
+		cfg_obj_log(key, named_g_lctx, ISC_LOG_WARNING,
 			    "secret for key '%s' on command channel: %s",
 			    keyid->keyname, isc_result_totext(result));
 		goto cleanup;
@@ -895,7 +868,7 @@ cleanup:
 	if (pctx != NULL) {
 		cfg_parser_destroy(&pctx);
 	}
-	return result;
+	return (result);
 }

 /*
@@ -1000,12 +973,12 @@ update_listener(named_controls_t *cp, controllistener_t **listenerp,
 		 * sake of avoiding this message would be too much trouble.
 		 */
 		if (control != NULL) {
-			cfg_obj_log(control, ISC_LOG_WARNING,
+			cfg_obj_log(control, named_g_lctx, ISC_LOG_WARNING,
 				    "couldn't install new keys for "
 				    "command channel %s: %s",
 				    socktext, isc_result_totext(result));
 		} else {
-			isc_log_write(NAMED_LOGCATEGORY_GENERAL,
+			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 				      NAMED_LOGMODULE_CONTROL, ISC_LOG_WARNING,
 				      "couldn't install new keys for "
 				      "command channel %s: %s",
@@ -1018,8 +991,9 @@ update_listener(named_controls_t *cp, controllistener_t **listenerp,
 	 */
 	if (control != NULL && type == isc_socktype_tcp) {
 		allow = cfg_tuple_get(control, "allow");
-		result = cfg_acl_fromconfig(allow, config, aclconfctx,
-					    listener->mctx, 0, &new_acl);
+		result = cfg_acl_fromconfig(allow, config, named_g_lctx,
+					    aclconfctx, listener->mctx, 0,
+					    &new_acl);
 	} else {
 		result = dns_acl_any(listener->mctx, &new_acl);
 	}
@@ -1039,12 +1013,12 @@ update_listener(named_controls_t *cp, controllistener_t **listenerp,
 		dns_acl_detach(&new_acl);
 		/* XXXDCL say the old acl is still used? */
 	} else if (control != NULL) {
-		cfg_obj_log(control, ISC_LOG_WARNING,
+		cfg_obj_log(control, named_g_lctx, ISC_LOG_WARNING,
 			    "couldn't install new acl for "
 			    "command channel %s: %s",
 			    socktext, isc_result_totext(result));
 	} else {
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL,
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_CONTROL, ISC_LOG_WARNING,
 			      "couldn't install new acl for "
 			      "command channel %s: %s",
@@ -1068,12 +1042,6 @@ add_listener(named_controls_t *cp, controllistener_t **listenerp,
 	isc_result_t result = ISC_R_SUCCESS;
 	int pf;

-	/* Don't create new listener if we are shutting down */
-	if (cp->shuttingdown) {
-		result = ISC_R_SHUTTINGDOWN;
-		goto shuttingdown;
-	}
-
 	listener = isc_mem_get(mctx, sizeof(*listener));
 	*listener = (controllistener_t){ .controls = cp,
 					 .address = *addr,
@@ -1091,8 +1059,8 @@ add_listener(named_controls_t *cp, controllistener_t **listenerp,
 		const cfg_obj_t *readonly = NULL;

 		allow = cfg_tuple_get(control, "allow");
-		CHECK(cfg_acl_fromconfig(allow, config, aclconfctx, mctx, 0,
-					 &new_acl));
+		CHECK(cfg_acl_fromconfig(allow, config, named_g_lctx,
+					 aclconfctx, mctx, 0, &new_acl));

 		readonly = cfg_tuple_get(control, "read-only");
 		if (!cfg_obj_isvoid(readonly)) {
@@ -1118,7 +1086,7 @@ add_listener(named_controls_t *cp, controllistener_t **listenerp,
 	} else {
 		result = get_rndckey(mctx, &listener->keys);
 		if (result != ISC_R_SUCCESS && control != NULL) {
-			cfg_obj_log(control, ISC_LOG_WARNING,
+			cfg_obj_log(control, named_g_lctx, ISC_LOG_WARNING,
 				    "couldn't install keys for "
 				    "command channel %s: %s",
 				    socktext, isc_result_totext(result));
@@ -1136,24 +1104,23 @@ add_listener(named_controls_t *cp, controllistener_t **listenerp,
 			       &listener->address, control_newconn, listener, 5,
 			       NULL, &listener->sock));

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_CONTROL,
-		      ISC_LOG_NOTICE, "command channel listening on %s",
-		      socktext);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_CONTROL, ISC_LOG_NOTICE,
+		      "command channel listening on %s", socktext);
 	*listenerp = listener;
 	return;

 cleanup:
 	isc_refcount_decrement(&listener->references);
-	listener->shuttingdown = true;
+	listener->exiting = true;
 	free_listener(listener);

-shuttingdown:
 	if (control != NULL) {
-		cfg_obj_log(control, ISC_LOG_WARNING,
+		cfg_obj_log(control, named_g_lctx, ISC_LOG_WARNING,
 			    "couldn't add command channel %s: %s", socktext,
 			    isc_result_totext(result));
 	} else {
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL,
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_CONTROL, ISC_LOG_NOTICE,
 			      "couldn't add command channel %s: %s", socktext,
 			      isc_result_totext(result));
@@ -1198,10 +1165,11 @@ named_controls_configure(named_controls_t *cp, const cfg_obj_t *config,

 			(void)cfg_map_get(controls, "unix", &unixcontrols);
 			if (unixcontrols != NULL) {
-				cfg_obj_log(controls, ISC_LOG_ERROR,
+				cfg_obj_log(controls, named_g_lctx,
+					    ISC_LOG_ERROR,
 					    "UNIX domain sockets are not "
 					    "supported");
-				return ISC_R_FAILURE;
+				return (ISC_R_FAILURE);
 			}

 			(void)cfg_map_get(controls, "inet", &inetcontrols);
@@ -1234,7 +1202,8 @@ named_controls_configure(named_controls_t *cp, const cfg_obj_t *config,
 				isc_sockaddr_format(&addr, socktext,
 						    sizeof(socktext));

-				isc_log_write(NAMED_LOGCATEGORY_GENERAL,
+				isc_log_write(named_g_lctx,
+					      NAMED_LOGCATEGORY_GENERAL,
 					      NAMED_LOGMODULE_CONTROL,
 					      ISC_LOG_DEBUG(9),
 					      "processing control channel %s",
@@ -1329,12 +1298,13 @@ named_controls_configure(named_controls_t *cp, const cfg_obj_t *config,
 	 * down will be taken care of by listen_done().
 	 */
 	ISC_LIST_APPENDLIST(cp->listeners, new_listeners, link);
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 isc_result_t
 named_controls_create(named_server_t *server, named_controls_t **ctrlsp) {
 	isc_mem_t *mctx = server->mctx;
+	isc_result_t result;
 	named_controls_t *controls = isc_mem_get(mctx, sizeof(*controls));

 	*controls = (named_controls_t){
@@ -1345,11 +1315,16 @@ named_controls_create(named_server_t *server, named_controls_t **ctrlsp) {

 	isc_mutex_init(&controls->symtab_lock);
 	LOCK(&controls->symtab_lock);
-	isccc_cc_createsymtab(mctx, &controls->symtab);
+	result = isccc_cc_createsymtab(&controls->symtab);
 	UNLOCK(&controls->symtab_lock);

+	if (result != ISC_R_SUCCESS) {
+		isc_mutex_destroy(&controls->symtab_lock);
+		isc_mem_put(server->mctx, controls, sizeof(*controls));
+		return (result);
+	}
 	*ctrlsp = controls;
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 void
@@ -1357,11 +1332,10 @@ named_controls_destroy(named_controls_t **ctrlsp) {
 	named_controls_t *controls = *ctrlsp;
 	*ctrlsp = NULL;

-	REQUIRE(controls->shuttingdown);
 	REQUIRE(ISC_LIST_EMPTY(controls->listeners));

 	LOCK(&controls->symtab_lock);
-	isc_symtab_destroy(&controls->symtab);
+	isccc_symtab_destroy(&controls->symtab);
 	UNLOCK(&controls->symtab_lock);
 	isc_mutex_destroy(&controls->symtab_lock);
 	isc_mem_put(controls->server->mctx, controls, sizeof(*controls));
@@ -17,13 +17,13 @@
 #include <stdlib.h>
 #include <string.h>

-#include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
 #include <isc/util.h>
 #include <isc/uv.h>

 #include <dns/dlz_dlopen.h>
+#include <dns/log.h>

 #include <dlz/dlz_dlopen_driver.h>
 #include <named/globals.h>
@@ -80,7 +80,7 @@ static void
 dlopen_log(int level, const char *fmt, ...) {
 	va_list ap;
 	va_start(ap, fmt);
-	isc_log_vwrite(DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_DLZ,
+	isc_log_vwrite(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_DLZ,
 		       ISC_LOG_DEBUG(level), fmt, ap);
 	va_end(ap);
 }
@@ -98,13 +98,13 @@ dlopen_dlz_allnodes(const char *zone, void *driverarg, void *dbdata,
 	UNUSED(driverarg);

 	if (cd->dlz_allnodes == NULL) {
-		return ISC_R_NOPERM;
+		return (ISC_R_NOPERM);
 	}

 	MAYBE_LOCK(cd);
 	result = cd->dlz_allnodes(zone, cd->dbdata, allnodes);
 	MAYBE_UNLOCK(cd);
-	return result;
+	return (result);
 }

 static isc_result_t
@@ -116,13 +116,13 @@ dlopen_dlz_allowzonexfr(void *driverarg, void *dbdata, const char *name,
 	UNUSED(driverarg);

 	if (cd->dlz_allowzonexfr == NULL) {
-		return ISC_R_NOPERM;
+		return (ISC_R_NOPERM);
 	}

 	MAYBE_LOCK(cd);
 	result = cd->dlz_allowzonexfr(cd->dbdata, name, client);
 	MAYBE_UNLOCK(cd);
-	return result;
+	return (result);
 }

 static isc_result_t
@@ -134,13 +134,13 @@ dlopen_dlz_authority(const char *zone, void *driverarg, void *dbdata,
 	UNUSED(driverarg);

 	if (cd->dlz_authority == NULL) {
-		return ISC_R_NOTIMPLEMENTED;
+		return (ISC_R_NOTIMPLEMENTED);
 	}

 	MAYBE_LOCK(cd);
 	result = cd->dlz_authority(zone, cd->dbdata, lookup);
 	MAYBE_UNLOCK(cd);
-	return result;
+	return (result);
 }

 static isc_result_t
@@ -155,7 +155,7 @@ dlopen_dlz_findzonedb(void *driverarg, void *dbdata, const char *name,
 	MAYBE_LOCK(cd);
 	result = cd->dlz_findzonedb(cd->dbdata, name, methods, clientinfo);
 	MAYBE_UNLOCK(cd);
-	return result;
+	return (result);
 }

 static isc_result_t
@@ -172,7 +172,7 @@ dlopen_dlz_lookup(const char *zone, const char *name, void *driverarg,
 	result = cd->dlz_lookup(zone, name, cd->dbdata, lookup, methods,
 				clientinfo);
 	MAYBE_UNLOCK(cd);
-	return result;
+	return (result);
 }

 /*
@@ -195,7 +195,7 @@ dl_load_symbol(dlopen_data_t *cd, const char *symbol, bool mandatory) {
 		}
 	}

-	return ptr;
+	return (ptr);
 }

 static void
@@ -219,7 +219,7 @@ dlopen_dlz_create(const char *dlzname, unsigned int argc, char *argv[],
 			   "dlz_dlopen driver for '%s' needs a path to "
 			   "the shared library",
 			   dlzname);
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

 	isc_mem_create(&mctx);
@@ -319,14 +319,14 @@ dlopen_dlz_create(const char *dlzname, unsigned int argc, char *argv[],

 	*dbdata = cd;

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);

 failed:
 	dlopen_log(ISC_LOG_ERROR, "dlz_dlopen of '%s' failed", dlzname);

 	dlopen_dlz_destroy(NULL, cd);

-	return result;
+	return (result);
 }

 /*
@@ -363,13 +363,13 @@ dlopen_dlz_newversion(const char *zone, void *driverarg, void *dbdata,
 	UNUSED(driverarg);

 	if (cd->dlz_newversion == NULL) {
-		return ISC_R_NOTIMPLEMENTED;
+		return (ISC_R_NOTIMPLEMENTED);
 	}

 	MAYBE_LOCK(cd);
 	result = cd->dlz_newversion(zone, cd->dbdata, versionp);
 	MAYBE_UNLOCK(cd);
-	return result;
+	return (result);
 }

 /*
@@ -404,7 +404,7 @@ dlopen_dlz_configure(dns_view_t *view, dns_dlzdb_t *dlzdb, void *driverarg,
 	UNUSED(driverarg);

 	if (cd->dlz_configure == NULL) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	MAYBE_LOCK(cd);
@@ -413,7 +413,7 @@ dlopen_dlz_configure(dns_view_t *view, dns_dlzdb_t *dlzdb, void *driverarg,
 	cd->in_configure = false;
 	MAYBE_UNLOCK(cd);

-	return result;
+	return (result);
 }

 /*
@@ -429,7 +429,7 @@ dlopen_dlz_ssumatch(const char *signer, const char *name, const char *tcpaddr,
 	UNUSED(driverarg);

 	if (cd->dlz_ssumatch == NULL) {
-		return false;
+		return (false);
 	}

 	MAYBE_LOCK(cd);
@@ -437,7 +437,7 @@ dlopen_dlz_ssumatch(const char *signer, const char *name, const char *tcpaddr,
 			       keydata, cd->dbdata);
 	MAYBE_UNLOCK(cd);

-	return ret;
+	return (ret);
 }

 /*
@@ -452,14 +452,14 @@ dlopen_dlz_addrdataset(const char *name, const char *rdatastr, void *driverarg,
 	UNUSED(driverarg);

 	if (cd->dlz_addrdataset == NULL) {
-		return ISC_R_NOTIMPLEMENTED;
+		return (ISC_R_NOTIMPLEMENTED);
 	}

 	MAYBE_LOCK(cd);
 	result = cd->dlz_addrdataset(name, rdatastr, cd->dbdata, version);
 	MAYBE_UNLOCK(cd);

-	return result;
+	return (result);
 }

 /*
@@ -474,14 +474,14 @@ dlopen_dlz_subrdataset(const char *name, const char *rdatastr, void *driverarg,
 	UNUSED(driverarg);

 	if (cd->dlz_subrdataset == NULL) {
-		return ISC_R_NOTIMPLEMENTED;
+		return (ISC_R_NOTIMPLEMENTED);
 	}

 	MAYBE_LOCK(cd);
 	result = cd->dlz_subrdataset(name, rdatastr, cd->dbdata, version);
 	MAYBE_UNLOCK(cd);

-	return result;
+	return (result);
 }

 /*
@@ -496,14 +496,14 @@ dlopen_dlz_delrdataset(const char *name, const char *type, void *driverarg,
 	UNUSED(driverarg);

 	if (cd->dlz_delrdataset == NULL) {
-		return ISC_R_NOTIMPLEMENTED;
+		return (ISC_R_NOTIMPLEMENTED);
 	}

 	MAYBE_LOCK(cd);
 	result = cd->dlz_delrdataset(name, type, cd->dbdata, version);
 	MAYBE_UNLOCK(cd);

-	return result;
+	return (result);
 }

 static dns_sdlzmethods_t dlz_dlopen_methods = {
@@ -535,7 +535,7 @@ dlz_dlopen_init(isc_mem_t *mctx) {
 		result = ISC_R_UNEXPECTED;
 	}

-	return result;
+	return (result);
 }

 /*
@@ -25,12 +25,14 @@
 #include <string.h>
 #include <unistd.h>

-#include <isc/log.h>
+#include <isc/condition.h>
 #include <isc/loop.h>
 #include <isc/mutex.h>
 #include <isc/thread.h>
 #include <isc/util.h>

+#include <dns/log.h>
+
 #include <named/globals.h>
 #include <named/log.h>
 #include <named/server.h>
@@ -125,7 +127,7 @@ fuzz_thread_client(void *arg) {
 				named_server_flushonshutdown(named_g_server,
 							     false);
 				isc_loopmgr_shutdown(named_g_loopmgr);
-				return NULL;
+				return (NULL);
 			}
 			raise(SIGSTOP);
 			goto next;
@@ -159,7 +161,7 @@ fuzz_thread_client(void *arg) {
 	named_server_flushonshutdown(named_g_server, false);
 	isc_loopmgr_shutdown(named_g_loopmgr);

-	return NULL;
+	return (NULL);
 }

 /*
@@ -373,7 +375,7 @@ fuzz_thread_resolver(void *arg) {
 				named_server_flushonshutdown(named_g_server,
 							     false);
 				isc_loopmgr_shutdown(named_g_loopmgr);
-				return NULL;
+				return (NULL);
 			}
 			raise(SIGSTOP);
 			continue;
@@ -585,7 +587,7 @@ fuzz_thread_resolver(void *arg) {
 	__AFL_LOOP(0);
 #endif /* ifdef __AFL_LOOP */

-	return NULL;
+	return (NULL);
 }

 /*
@@ -716,7 +718,7 @@ fuzz_thread_tcp(void *arg) {
 	named_server_flushonshutdown(named_g_server, false);
 	isc_loopmgr_shutdown(named_g_loopmgr);

-	return NULL;
+	return (NULL);
 }

 #endif /* ENABLE_AFL */
@@ -39,27 +39,27 @@ open_geoip2(const char *dir, const char *dbfile, MMDB_s *mmdb) {

 	n = snprintf(pathbuf, sizeof(pathbuf), "%s/%s", dir, dbfile);
 	if (n >= sizeof(pathbuf)) {
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-			      ISC_LOG_ERROR,
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 			      "GeoIP2 database '%s/%s': path too long", dir,
 			      dbfile);
-		return NULL;
+		return (NULL);
 	}

 	ret = MMDB_open(pathbuf, MMDB_MODE_MMAP, mmdb);
 	if (ret == MMDB_SUCCESS) {
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-			      ISC_LOG_INFO, "opened GeoIP2 database '%s'",
-			      pathbuf);
-		return mmdb;
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
+			      "opened GeoIP2 database '%s'", pathbuf);
+		return (mmdb);
 	}

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-		      ISC_LOG_DEBUG(1),
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_SERVER, ISC_LOG_DEBUG(1),
 		      "unable to open GeoIP2 database '%s' (status %d)",
 		      pathbuf, ret);

-	return NULL;
+	return (NULL);
 }
 #endif /* HAVE_GEOIP2 */

@@ -79,9 +79,9 @@ named_geoip_load(char *dir) {
 #if defined(HAVE_GEOIP2)
 	REQUIRE(dir != NULL);

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-		      ISC_LOG_INFO, "looking for GeoIP2 databases in '%s'",
-		      dir);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
+		      "looking for GeoIP2 databases in '%s'", dir);

 	named_g_geoip->country = open_geoip2(dir, "GeoIP2-Country.mmdb",
 					     &geoip_country);
@@ -17,6 +17,7 @@

 #include <inttypes.h>

+#include <isc/lang.h>
 #include <isc/types.h>

 #include <dns/clientinfo.h>
@@ -57,8 +57,9 @@ named_config_getremotesdef(const cfg_obj_t *cctx, const char *list,
 			   const char *name, const cfg_obj_t **ret);

 isc_result_t
-named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
-			     isc_mem_t *mctx, dns_ipkeylist_t *ipkl);
+named_config_getipandkeylist(const cfg_obj_t *config, const char *listtype,
+			     const cfg_obj_t *list, isc_mem_t *mctx,
+			     dns_ipkeylist_t *ipkl);

 isc_result_t
 named_config_getport(const cfg_obj_t *config, const char *type,
@@ -28,52 +28,48 @@

 #define NAMED_CONTROL_PORT 953

-#define NAMED_COMMAND_ADDZONE	   "addzone"
-#define NAMED_COMMAND_CLOSELOGS	   "closelogs"
-#define NAMED_COMMAND_DELZONE	   "delzone"
-#define NAMED_COMMAND_DNSSEC	   "dnssec"
-#define NAMED_COMMAND_DNSTAP	   "dnstap"
-#define NAMED_COMMAND_DNSTAPREOPEN "dnstap-reopen"
-#define NAMED_COMMAND_DUMPDB	   "dumpdb"
+#define NAMED_COMMAND_STOP	   "stop"
+#define NAMED_COMMAND_HALT	   "halt"
+#define NAMED_COMMAND_RELOAD	   "reload"
+#define NAMED_COMMAND_RECONFIG	   "reconfig"
+#define NAMED_COMMAND_REFRESH	   "refresh"
+#define NAMED_COMMAND_RETRANSFER   "retransfer"
 #define NAMED_COMMAND_DUMPSTATS	   "stats"
-#define NAMED_COMMAND_FETCHLIMIT   "fetchlimit"
+#define NAMED_COMMAND_QUERYLOG	   "querylog"
+#define NAMED_COMMAND_DUMPDB	   "dumpdb"
+#define NAMED_COMMAND_SECROOTS	   "secroots"
+#define NAMED_COMMAND_TRACE	   "trace"
+#define NAMED_COMMAND_NOTRACE	   "notrace"
 #define NAMED_COMMAND_FLUSH	   "flush"
 #define NAMED_COMMAND_FLUSHNAME	   "flushname"
 #define NAMED_COMMAND_FLUSHTREE	   "flushtree"
-#define NAMED_COMMAND_FREEZE	   "freeze"
-#define NAMED_COMMAND_HALT	   "halt"
-#define NAMED_COMMAND_LOADKEYS	   "loadkeys"
-#define NAMED_COMMAND_MEMPROF	   "memprof"
-#define NAMED_COMMAND_MKEYS	   "managed-keys"
-#define NAMED_COMMAND_MODZONE	   "modzone"
-#define NAMED_COMMAND_NOTIFY	   "notify"
-#define NAMED_COMMAND_NOTRACE	   "notrace"
-#define NAMED_COMMAND_NTA	   "nta"
-#define NAMED_COMMAND_NULL	   "null"
-#define NAMED_COMMAND_QUERYLOG	   "querylog"
-#define NAMED_COMMAND_RECONFIG	   "reconfig"
-#define NAMED_COMMAND_RECURSING	   "recursing"
-#define NAMED_COMMAND_REFRESH	   "refresh"
-#define NAMED_COMMAND_RELOAD	   "reload"
-#define NAMED_COMMAND_RESPONSELOG  "responselog"
-#define NAMED_COMMAND_RETRANSFER   "retransfer"
-#define NAMED_COMMAND_SCAN	   "scan"
-#define NAMED_COMMAND_SECROOTS	   "secroots"
-#define NAMED_COMMAND_SERVESTALE   "serve-stale"
-#define NAMED_COMMAND_SHOWZONE	   "showzone"
-#define NAMED_COMMAND_SIGN	   "sign"
-#define NAMED_COMMAND_SIGNING	   "signing"
-#define NAMED_COMMAND_SKR	   "skr"
 #define NAMED_COMMAND_STATUS	   "status"
-#define NAMED_COMMAND_STOP	   "stop"
-#define NAMED_COMMAND_SYNC	   "sync"
-#define NAMED_COMMAND_TCPTIMEOUTS  "tcp-timeouts"
-#define NAMED_COMMAND_TESTGEN	   "testgen"
-#define NAMED_COMMAND_THAW	   "thaw"
-#define NAMED_COMMAND_TRACE	   "trace"
+#define NAMED_COMMAND_FREEZE	   "freeze"
 #define NAMED_COMMAND_UNFREEZE	   "unfreeze"
+#define NAMED_COMMAND_THAW	   "thaw"
+#define NAMED_COMMAND_RECURSING	   "recursing"
+#define NAMED_COMMAND_NULL	   "null"
+#define NAMED_COMMAND_NOTIFY	   "notify"
 #define NAMED_COMMAND_VALIDATION   "validation"
+#define NAMED_COMMAND_SCAN	   "scan"
+#define NAMED_COMMAND_SIGN	   "sign"
+#define NAMED_COMMAND_LOADKEYS	   "loadkeys"
+#define NAMED_COMMAND_ADDZONE	   "addzone"
+#define NAMED_COMMAND_MODZONE	   "modzone"
+#define NAMED_COMMAND_DELZONE	   "delzone"
+#define NAMED_COMMAND_SHOWZONE	   "showzone"
+#define NAMED_COMMAND_SYNC	   "sync"
+#define NAMED_COMMAND_SIGNING	   "signing"
+#define NAMED_COMMAND_DNSSEC	   "dnssec"
 #define NAMED_COMMAND_ZONESTATUS   "zonestatus"
+#define NAMED_COMMAND_NTA	   "nta"
+#define NAMED_COMMAND_TESTGEN	   "testgen"
+#define NAMED_COMMAND_MKEYS	   "managed-keys"
+#define NAMED_COMMAND_DNSTAPREOPEN "dnstap-reopen"
+#define NAMED_COMMAND_DNSTAP	   "dnstap"
+#define NAMED_COMMAND_TCPTIMEOUTS  "tcp-timeouts"
+#define NAMED_COMMAND_SERVESTALE   "serve-stale"
+#define NAMED_COMMAND_FETCHLIMIT   "fetchlimit"

 isc_result_t
 named_controls_create(named_server_t *server, named_controls_t **ctrlsp);
@@ -86,7 +86,10 @@ EXTERN named_server_t *named_g_server INIT(NULL);
 /*
 * Logging.
 */
-EXTERN unsigned int named_g_debuglevel INIT(0);
+EXTERN isc_log_t *named_g_lctx		     INIT(NULL);
+EXTERN isc_logcategory_t *named_g_categories INIT(NULL);
+EXTERN isc_logmodule_t *named_g_modules	     INIT(NULL);
+EXTERN unsigned int named_g_debuglevel	     INIT(0);

 /*
 * Current configuration information.
@@ -97,6 +100,8 @@ EXTERN const char *named_g_conffile	   INIT(NAMED_SYSCONFDIR "/named.conf");
 EXTERN const char *named_g_defaultbindkeys INIT(NULL);
 EXTERN const char *named_g_keyfile	   INIT(NAMED_SYSCONFDIR "/rndc.key");

+EXTERN dns_tsigkey_t *named_g_sessionkey    INIT(NULL);
+EXTERN dns_name_t			    named_g_sessionkeyname;
 EXTERN bool named_g_conffileset		    INIT(false);
 EXTERN cfg_aclconfctx_t *named_g_aclconfctx INIT(NULL);

@@ -108,7 +113,6 @@ EXTERN const char *named_g_chrootdir INIT(NULL);
 EXTERN bool named_g_foreground	     INIT(false);
 EXTERN bool named_g_logstderr	     INIT(false);
 EXTERN bool named_g_nosyslog	     INIT(false);
-EXTERN unsigned int named_g_logflags INIT(0);
 EXTERN const char *named_g_logfile   INIT(NULL);

 EXTERN const char *named_g_defaultsessionkeyfile INIT(NAMED_LOCALSTATEDIR
@@ -125,6 +129,8 @@ EXTERN const char *named_g_defaultpidfile INIT(NAMED_LOCALSTATEDIR "/run/"

 EXTERN const char *named_g_username INIT(NULL);

+EXTERN const char *named_g_engine INIT(NULL);
+
 EXTERN isc_time_t		  named_g_boottime;
 EXTERN isc_time_t		  named_g_configtime;
 EXTERN bool named_g_memstatistics INIT(false);
@@ -18,8 +18,22 @@
 #include <isc/log.h>
 #include <isc/types.h>

+#include <dns/log.h>
+
 #include <named/globals.h> /* Required for named_g_(categories|modules). */

+/* Unused slot 0. */
+#define NAMED_LOGCATEGORY_UNMATCHED (&named_g_categories[1])
+
+/*
+ * Backwards compatibility.
+ */
+#define NAMED_LOGCATEGORY_GENERAL ISC_LOGCATEGORY_GENERAL
+
+#define NAMED_LOGMODULE_MAIN	(&named_g_modules[0])
+#define NAMED_LOGMODULE_SERVER	(&named_g_modules[1])
+#define NAMED_LOGMODULE_CONTROL (&named_g_modules[2])
+
 isc_result_t
 named_log_init(bool safe);
 /*%
@@ -65,3 +79,6 @@ named_log_setunmatchedcategory(isc_logconfig_t *lcfg);
 /*%
 * Set up "category unmatched" to go to the right places.
 */
+
+void
+named_log_shutdown(void);
@@ -26,7 +26,7 @@
 */
 #define NAMED_MAIN_ARGS "46A:c:Cd:D:E:fFgL:M:m:n:N:p:sS:t:T:U:u:vVx:X:"

-ISC_NORETURN void
+noreturn void
 named_main_earlyfatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);

 void
@@ -39,13 +39,10 @@ void
 named_os_inituserinfo(const char *username);

 void
-named_os_changeuser(bool permanent);
-
-void
-named_os_restoreuser(void);
+named_os_changeuser(void);

 uid_t
-named_os_uid(void);
+ns_os_uid(void);

 void
 named_os_adjustnofile(void);
@@ -56,13 +56,15 @@ struct named_server {
 	char *version;	    /*%< User-specified version */
 	bool  hostname_set; /*%< User has set hostname */
 	char *hostname;	    /*%< User-specified hostname */
+#ifdef USE_DNSRPS
+	char *dnsrpslib;
+#endif /* ifdef USE_DNSRPS */

 	/* Server data structures. */
 	dns_loadmgr_t	  *loadmgr;
 	dns_zonemgr_t	  *zonemgr;
 	dns_viewlist_t	   viewlist;
 	dns_kasplist_t	   kasplist;
-	dns_keystorelist_t keystorelist;
 	ns_interfacemgr_t *interfacemgr;
 	dns_db_t	  *in_roothints;

@@ -72,6 +74,7 @@ struct named_server {
 	isc_timer_t *tat_timer;

 	uint32_t interface_interval;
+	uint32_t heartbeat_interval;

 	atomic_int reload_status;

@@ -104,7 +107,6 @@ struct named_server {
 	isc_tlsctx_cache_t *tlsctx_client_cache;

 	isc_signal_t *sighup;
-	isc_signal_t *sigusr1;
 };

 #define NAMED_SERVER_MAGIC    ISC_MAGIC('S', 'V', 'E', 'R')
@@ -181,20 +183,10 @@ named_server_retransfercommand(named_server_t *server, isc_lex_t *lex,
 */

 isc_result_t
-named_server_setortoggle(named_server_t *server, const char *optname,
-			 unsigned int option, isc_lex_t *lex);
+named_server_togglequerylog(named_server_t *server, isc_lex_t *lex);
 /*%<
- * Enable/disable, or toggle, a server option via the command channel.
- * 'option' is the option value to be changed (for example,
- * NS_SERVER_LOGQUERIES or NS_SERVER_LOGRESPOSNES) and 'optname' is the
- * option's human-readable name for logging purposes ("query logging"
- * or "response logging").
- *
- * If an explicit argument to enable the option was provided
- * (i.e., "on", "enable", "true", or "yes") or an explicit argument
- * to disable it ("off", "disable", "false", or "no"), it will be used.
- *
- * If no argument is provided, the option's current state will be reversed.
+ * Enable/disable logging of queries.  (Takes "yes" or "no" argument,
+ * but can also be used as a toggle for backward comptibility.)
 */

 /*%
@@ -382,21 +374,3 @@ named_server_servestale(named_server_t *server, isc_lex_t *lex,
 isc_result_t
 named_server_fetchlimit(named_server_t *server, isc_lex_t *lex,
 			isc_buffer_t **text);
-
-/*%
- * Import SKR file for offline KSK signing.
- */
-isc_result_t
-named_server_skr(named_server_t *server, isc_lex_t *lex, isc_buffer_t **text);
-
-/*%
- * Toggle memory profiling if supported.
- */
-isc_result_t
-named_server_togglememprof(isc_lex_t *lex);
-
-/*%
- * Get status of memory profiling.
- */
-const char *
-named_server_getmemprof(void);
@@ -15,10 +15,13 @@

 /*! \file */

+#include <isc/lang.h>
 #include <isc/types.h>

 #include <isccfg/cfg.h>

+ISC_LANG_BEGINDECLS
+
 isc_result_t
 named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 			 dns_tkeyctx_t **tctxp);
@@ -34,5 +37,7 @@ named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 *
 *	Returns:
 *\li		ISC_R_SUCCESS
- *\li		return codes from dns_name_fromtext()
+ *\li		ISC_R_NOMEMORY
 */
+
+ISC_LANG_ENDDECLS
@@ -15,12 +15,15 @@

 /*! \file */

+#include <isc/lang.h>
 #include <isc/types.h>

 #include <dns/transport.h>

 #include <isccfg/cfg.h>

+ISC_LANG_BEGINDECLS
+
 isc_result_t
 named_transports_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			    isc_mem_t *mctx, dns_transport_list_t **listp);
@@ -36,3 +39,5 @@ named_transports_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 *	\li	'listp' is not NULL, and '*listp' is NULL
 *
 */
+
+ISC_LANG_ENDDECLS
@@ -15,8 +15,11 @@

 /*! \file */

+#include <isc/lang.h>
 #include <isc/types.h>

+ISC_LANG_BEGINDECLS
+
 isc_result_t
 named_tsigkeyring_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			     isc_mem_t *mctx, dns_tsigkeyring_t **ringp);
@@ -32,6 +35,7 @@ named_tsigkeyring_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 *
 *	Returns:
 *	\li	ISC_R_SUCCESS
- *	\li	DNS_R_BADALG
- *	\li	return codes from dns_name_fromtext()
+ *	\li	ISC_R_NOMEMORY
 */
+
+ISC_LANG_ENDDECLS
@@ -17,16 +17,19 @@

 #include <stdbool.h>

+#include <isc/lang.h>
 #include <isc/types.h>

 #include <isccfg/aclconf.h>
 #include <isccfg/cfg.h>

+ISC_LANG_BEGINDECLS
+
 isc_result_t
 named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		     const cfg_obj_t *zconfig, cfg_aclconfctx_t *ac,
-		     dns_kasplist_t *kasplist, dns_keystorelist_t *keystores,
-		     dns_zone_t *zone, dns_zone_t *raw);
+		     dns_kasplist_t *kasplist, dns_zone_t *zone,
+		     dns_zone_t *raw);
 /*%<
 * Configure or reconfigure a zone according to the named.conf
 * data.
@@ -73,3 +76,5 @@ named_zone_configure_writeable_dlz(dns_dlzdb_t *dlzdatabase, dns_zone_t *zone,
 * \li	'rdclass' to be a valid rdataclass
 * \li	'name' to be a valid zone origin name
 */
+
+ISC_LANG_ENDDECLS
@@ -15,29 +15,67 @@

 #include <stdlib.h>

-#include <isc/log.h>
 #include <isc/result.h>
 #include <isc/util.h>

+#include <dns/log.h>
+
+#include <isccfg/log.h>
+
+#include <ns/log.h>
+
 #include <named/log.h>

 #ifndef ISC_FACILITY
 #define ISC_FACILITY LOG_DAEMON
 #endif /* ifndef ISC_FACILITY */

+/*%
+ * When adding a new category, be sure to add the appropriate
+ * \#define to <named/log.h> and to update the list in
+ * bin/check/check-tool.c.
+ */
+static isc_logcategory_t categories[] = { { "", 0 },
+					  { "unmatched", 0 },
+					  { NULL, 0 } };
+
+/*%
+ * When adding a new module, be sure to add the appropriate
+ * \#define to <dns/log.h>.
+ */
+static isc_logmodule_t modules[] = {
+	{ "main", 0 }, { "server", 0 }, { "control", 0 }, { NULL, 0 }
+};
+
 isc_result_t
 named_log_init(bool safe) {
 	isc_result_t result;
 	isc_logconfig_t *lcfg = NULL;
+	isc_mem_t *log_mctx = NULL;
+
+	named_g_categories = categories;
+	named_g_modules = modules;

 	/*
-	 * This is not technically needed, as we are calling named_log_init()
-	 * only at the start of named process.  But since the named binary is
-	 * the only place that also calls isc_logconfig_set(), this is a good
-	 * hygiene.
+	 * Setup a logging context.
 	 */
-	rcu_read_lock();
-	lcfg = isc_logconfig_get();
+	isc_mem_create(&log_mctx);
+	isc_mem_setname(log_mctx, "named_log");
+	isc_log_create(log_mctx, &named_g_lctx, &lcfg);
+	isc_mem_detach(&log_mctx);
+
+	/*
+	 * named-checktool.c:setup_logging() needs to be kept in sync.
+	 */
+	isc_log_registercategories(named_g_lctx, named_g_categories);
+	isc_log_registermodules(named_g_lctx, named_g_modules);
+	isc_log_setcontext(named_g_lctx);
+	dns_log_init(named_g_lctx);
+	dns_log_setcontext(named_g_lctx);
+	cfg_log_init(named_g_lctx);
+	ns_log_init(named_g_lctx);
+	ns_log_setcontext(named_g_lctx);
+
 	if (safe) {
 		named_log_setsafechannels(lcfg);
 	} else {
@@ -50,14 +88,15 @@ named_log_init(bool safe) {
 	}

 	named_log_setdefaultsslkeylogfile(lcfg);
-	rcu_read_unlock();

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);

 cleanup:
-	rcu_read_unlock();
+	isc_log_destroy(&named_g_lctx);
+	isc_log_setcontext(NULL);
+	dns_log_setcontext(NULL);

-	return result;
+	return (result);
 }

 void
@@ -77,16 +116,6 @@ named_log_setdefaultchannels(isc_logconfig_t *lcfg) {
 		isc_log_createchannel(lcfg, "default_debug", ISC_LOG_TOFILE,
 				      ISC_LOG_DYNAMIC, &destination,
 				      ISC_LOG_PRINTTIME | ISC_LOG_DEBUGONLY);
-	} else if (named_g_logstderr && (named_g_logflags != 0)) {
-		/*
-		 * If the option -g is given, but we also requested iso
-		 * timestamps, we'll still need to override the "default_debug"
-		 * logger with a new one.
-		 */
-		isc_log_createchannel(lcfg, "default_debug", ISC_LOG_TOFILEDESC,
-				      ISC_LOG_DYNAMIC,
-				      ISC_LOGDESTINATION_STDERR,
-				      ISC_LOG_PRINTTIME | named_g_logflags);
 	}

 	if (named_g_logfile != NULL) {
@@ -110,7 +139,7 @@ named_log_setdefaultchannels(isc_logconfig_t *lcfg) {
 	/*
 	 * Set the initial debug level.
 	 */
-	isc_log_setdebuglevel(named_g_debuglevel);
+	isc_log_setdebuglevel(named_g_lctx, named_g_debuglevel);
 }

 void
@@ -125,19 +154,9 @@ named_log_setsafechannels(isc_logconfig_t *lcfg) {
 		 * Setting the debug level to zero should get the output
 		 * discarded a bit faster.
 		 */
-		isc_log_setdebuglevel(0);
-	} else if (named_g_logstderr && (named_g_logflags != 0)) {
-		/*
-		 * If the option -g is given, but we also requested iso
-		 * timestamps, we'll still need to override the "default_debug"
-		 * logger with a new one.
-		 */
-		isc_log_createchannel(lcfg, "default_debug", ISC_LOG_TOFILEDESC,
-				      ISC_LOG_DYNAMIC,
-				      ISC_LOGDESTINATION_STDERR,
-				      ISC_LOG_PRINTTIME | named_g_logflags);
+		isc_log_setdebuglevel(named_g_lctx, 0);
 	} else {
-		isc_log_setdebuglevel(named_g_debuglevel);
+		isc_log_setdebuglevel(named_g_lctx, named_g_debuglevel);
 	}

 	if (named_g_logfile != NULL) {
@@ -180,6 +199,7 @@ named_log_setdefaultsslkeylogfile(isc_logconfig_t *lcfg) {
 			.maximum_size = 100 * 1024 * 1024,
 		},
 	};
+	isc_result_t result;

 	if (sslkeylogfile_path == NULL ||
 	    strcmp(sslkeylogfile_path, "config") == 0)
@@ -187,10 +207,11 @@ named_log_setdefaultsslkeylogfile(isc_logconfig_t *lcfg) {
 		return;
 	}

-	isc_log_createandusechannel(lcfg, "default_sslkeylogfile",
-				    ISC_LOG_TOFILE, ISC_LOG_INFO, &destination,
-				    0, ISC_LOGCATEGORY_SSLKEYLOG,
-				    ISC_LOGMODULE_DEFAULT);
+	isc_log_createchannel(lcfg, "default_sslkeylogfile", ISC_LOG_TOFILE,
+			      ISC_LOG_INFO, &destination, 0);
+	result = isc_log_usechannel(lcfg, "default_sslkeylogfile",
+				    ISC_LOGCATEGORY_SSLKEYLOG, NULL);
+	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 }

 isc_result_t
@@ -198,8 +219,7 @@ named_log_setdefaultcategory(isc_logconfig_t *lcfg) {
 	isc_result_t result = ISC_R_SUCCESS;

 	result = isc_log_usechannel(lcfg, "default_debug",
-				    ISC_LOGCATEGORY_DEFAULT,
-				    ISC_LOGMODULE_DEFAULT);
+				    ISC_LOGCATEGORY_DEFAULT, NULL);
 	if (result != ISC_R_SUCCESS) {
 		goto cleanup;
 	}
@@ -208,16 +228,16 @@ named_log_setdefaultcategory(isc_logconfig_t *lcfg) {
 		if (named_g_logfile != NULL) {
 			result = isc_log_usechannel(lcfg, "default_logfile",
 						    ISC_LOGCATEGORY_DEFAULT,
-						    ISC_LOGMODULE_DEFAULT);
+						    NULL);
 		} else if (!named_g_nosyslog) {
 			result = isc_log_usechannel(lcfg, "default_syslog",
 						    ISC_LOGCATEGORY_DEFAULT,
-						    ISC_LOGMODULE_DEFAULT);
+						    NULL);
 		}
 	}

 cleanup:
-	return result;
+	return (result);
 }

 isc_result_t
@@ -225,6 +245,13 @@ named_log_setunmatchedcategory(isc_logconfig_t *lcfg) {
 	isc_result_t result;

 	result = isc_log_usechannel(lcfg, "null", NAMED_LOGCATEGORY_UNMATCHED,
-				    ISC_LOGMODULE_DEFAULT);
-	return result;
+				    NULL);
+	return (result);
+}
+
+void
+named_log_shutdown(void) {
+	isc_log_destroy(&named_g_lctx);
+	isc_log_setcontext(NULL);
+	dns_log_setcontext(NULL);
 }
@@ -24,6 +24,7 @@
 #include <isc/util.h>

 #include <isccfg/cfg.h>
+#include <isccfg/log.h>

 #include <named/log.h>
 #include <named/logconf.h>
@@ -43,25 +44,28 @@ static isc_result_t
 category_fromconf(const cfg_obj_t *ccat, isc_logconfig_t *logconfig) {
 	isc_result_t result;
 	const char *catname;
-	isc_logcategory_t category;
+	isc_logcategory_t *category;
+	isc_logmodule_t *module;
 	const cfg_obj_t *destinations = NULL;
 	const cfg_listelt_t *element = NULL;

 	catname = cfg_obj_asstring(cfg_tuple_get(ccat, "name"));
-	category = isc_log_categorybyname(catname);
-	if (category == ISC_LOGCATEGORY_INVALID) {
-		cfg_obj_log(ccat, ISC_LOG_ERROR,
+	category = isc_log_categorybyname(named_g_lctx, catname);
+	if (category == NULL) {
+		cfg_obj_log(ccat, named_g_lctx, ISC_LOG_ERROR,
 			    "unknown logging category '%s' ignored", catname);
 		/*
 		 * Allow further processing by returning success.
 		 */
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	if (logconfig == NULL) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

+	module = NULL;
+
 	destinations = cfg_tuple_get(ccat, "destinations");
 	for (element = cfg_list_first(destinations); element != NULL;
 	     element = cfg_list_next(element))
@@ -70,16 +74,16 @@ category_fromconf(const cfg_obj_t *ccat, isc_logconfig_t *logconfig) {
 		const char *channelname = cfg_obj_asstring(channel);

 		result = isc_log_usechannel(logconfig, channelname, category,
-					    ISC_LOGMODULE_DEFAULT);
+					    module);
 		if (result != ISC_R_SUCCESS) {
-			isc_log_write(CFG_LOGCATEGORY_CONFIG,
+			isc_log_write(named_g_lctx, CFG_LOGCATEGORY_CONFIG,
 				      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 				      "logging channel '%s': %s", channelname,
 				      isc_result_totext(result));
-			return result;
+			return (result);
 		}
 	}
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 /*%
@@ -123,11 +127,11 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *logconfig) {
 	}

 	if (i != 1) {
-		cfg_obj_log(channel, ISC_LOG_ERROR,
+		cfg_obj_log(channel, named_g_lctx, ISC_LOG_ERROR,
 			    "channel '%s': exactly one of file, syslog, "
 			    "null, and stderr must be present",
 			    channelname);
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

 	type = ISC_LOG_TONULL;
@@ -239,8 +243,6 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *logconfig) {
 				flags |= ISC_LOG_ISO8601;
 			} else if (strcasecmp(s, "iso8601-utc") == 0) {
 				flags |= ISC_LOG_ISO8601 | ISC_LOG_UTC;
-			} else if (strcasecmp(s, "iso8601-tzinfo") == 0) {
-				flags |= ISC_LOG_ISO8601 | ISC_LOG_TZINFO;
 			}
 		}
 	}
@@ -308,7 +310,7 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *logconfig) {
 	}

 done:
-	return result;
+	return (result);
 }

 isc_result_t
@@ -363,8 +365,8 @@ named_logconfig(isc_logconfig_t *logconfig, const cfg_obj_t *logstmt) {
 		CHECK(named_log_setunmatchedcategory(logconfig));
 	}

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);

 cleanup:
-	return result;
+	return (result);
 }
@@ -27,12 +27,11 @@
 #include <isc/attributes.h>
 #include <isc/backtrace.h>
 #include <isc/commandline.h>
-#include <isc/crypto.h>
 #include <isc/dir.h>
 #include <isc/file.h>
+#include <isc/fips.h>
 #include <isc/hash.h>
 #include <isc/httpd.h>
-#include <isc/lib.h>
 #include <isc/managers.h>
 #include <isc/netmgr.h>
 #include <isc/os.h>
@@ -47,7 +46,6 @@

 #include <dns/dispatch.h>
 #include <dns/dyndb.h>
-#include <dns/lib.h>
 #include <dns/name.h>
 #include <dns/resolver.h>
 #include <dns/view.h>
@@ -90,6 +88,10 @@
 #include <openssl/crypto.h>
 #include <openssl/evp.h>
 #include <openssl/opensslv.h>
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+#include <openssl/err.h>
+#include <openssl/provider.h>
+#endif
 #ifdef HAVE_LIBXML2
 #include <libxml/parser.h>
 #include <libxml/xmlversion.h>
@@ -129,7 +131,6 @@ static int maxudp = 0;
 /*
 * -T options:
 */
-static bool cookiealwaysvalid = false;
 static bool dropedns = false;
 static bool ednsformerr = false;
 static bool ednsnotimp = false;
@@ -151,13 +152,25 @@ static bool transferstuck = false;
 static bool disable6 = false;
 static bool disable4 = false;

+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+static OSSL_PROVIDER *fips = NULL, *base = NULL;
+#endif
+
 void
 named_main_earlywarning(const char *format, ...) {
 	va_list args;

 	va_start(args, format);
-	isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		       ISC_LOG_WARNING, format, args);
+	if (named_g_lctx != NULL) {
+		isc_log_vwrite(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			       NAMED_LOGMODULE_MAIN, ISC_LOG_WARNING, format,
+			       args);
+	} else {
+		fprintf(stderr, "%s: ", program_name);
+		vfprintf(stderr, format, args);
+		fprintf(stderr, "\n");
+		fflush(stderr);
+	}
 	va_end(args);
 }

@@ -166,16 +179,25 @@ named_main_earlyfatal(const char *format, ...) {
 	va_list args;

 	va_start(args, format);
-	isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		       ISC_LOG_CRITICAL, format, args);
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_CRITICAL, "exiting (due to early fatal error)");
+	if (named_g_lctx != NULL) {
+		isc_log_vwrite(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			       NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL, format,
+			       args);
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL,
+			      "exiting (due to early fatal error)");
+	} else {
+		fprintf(stderr, "%s: ", program_name);
+		vfprintf(stderr, format, args);
+		fprintf(stderr, "\n");
+		fflush(stderr);
+	}
 	va_end(args);

-	_exit(EXIT_FAILURE);
+	exit(1);
 }

-ISC_NORETURN static void
+noreturn static void
 assertion_failed(const char *file, int line, isc_assertiontype_t type,
 		 const char *cond);

@@ -186,27 +208,35 @@ assertion_failed(const char *file, int line, isc_assertiontype_t type,
 	 * Handle assertion failures.
 	 */

-	/*
-	 * Reset the assertion callback in case it is the log
-	 * routines causing the assertion.
-	 */
-	isc_assertion_setcallback(NULL);
+	if (named_g_lctx != NULL) {
+		/*
+		 * Reset the assertion callback in case it is the log
+		 * routines causing the assertion.
+		 */
+		isc_assertion_setcallback(NULL);

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_CRITICAL, "%s:%d: %s(%s) failed", file, line,
-		      isc_assertion_typetotext(type), cond);
-	isc_backtrace_log(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-			  ISC_LOG_CRITICAL);
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_CRITICAL, "exiting (due to assertion failure)");
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL,
+			      "%s:%d: %s(%s) failed", file, line,
+			      isc_assertion_typetotext(type), cond);
+		isc_backtrace_log(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+				  NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL);
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL,
+			      "exiting (due to assertion failure)");
+	} else {
+		fprintf(stderr, "%s:%d: %s(%s) failed\n", file, line,
+			isc_assertion_typetotext(type), cond);
+		fflush(stderr);
+	}

 	if (named_g_coreok) {
 		abort();
 	}
-	_exit(EXIT_FAILURE);
+	exit(1);
 }

-ISC_NORETURN static void
+noreturn static void
 library_fatal_error(const char *file, int line, const char *func,
 		    const char *format, va_list args) ISC_FORMAT_PRINTF(3, 0);

@@ -217,25 +247,33 @@ library_fatal_error(const char *file, int line, const char *func,
 	 * Handle isc_error_fatal() calls from our libraries.
 	 */

-	/*
-	 * Reset the error callback in case it is the log
-	 * routines causing the assertion.
-	 */
-	isc_error_setfatal(NULL);
+	if (named_g_lctx != NULL) {
+		/*
+		 * Reset the error callback in case it is the log
+		 * routines causing the assertion.
+		 */
+		isc_error_setfatal(NULL);

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_CRITICAL, "%s:%d:%s(): fatal error: ", file, line,
-		      func);
-	isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		       ISC_LOG_CRITICAL, format, args);
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_CRITICAL,
-		      "exiting (due to fatal error in library)");
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL,
+			      "%s:%d:%s(): fatal error: ", file, line, func);
+		isc_log_vwrite(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			       NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL, format,
+			       args);
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL,
+			      "exiting (due to fatal error in library)");
+	} else {
+		fprintf(stderr, "%s:%d:%s(): fatal error: ", file, line, func);
+		vfprintf(stderr, format, args);
+		fprintf(stderr, "\n");
+		fflush(stderr);
+	}

 	if (named_g_coreok) {
 		abort();
 	}
-	_exit(EXIT_FAILURE);
+	exit(1);
 }

 static void
@@ -250,23 +288,32 @@ library_unexpected_error(const char *file, int line, const char *func,
 	 * Handle isc_error_unexpected() calls from our libraries.
 	 */

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_ERROR, "%s:%d:%s(): unexpected error: ", file,
-		      line, func);
-	isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		       ISC_LOG_ERROR, format, args);
+	if (named_g_lctx != NULL) {
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_MAIN, ISC_LOG_ERROR,
+			      "%s:%d:%s(): unexpected error: ", file, line,
+			      func);
+		isc_log_vwrite(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			       NAMED_LOGMODULE_MAIN, ISC_LOG_ERROR, format,
+			       args);
+	} else {
+		fprintf(stderr, "%s:%d:%s(): fatal error: ", file, line, func);
+		vfprintf(stderr, format, args);
+		fprintf(stderr, "\n");
+		fflush(stderr);
+	}
 }

 static void
 usage(void) {
 	fprintf(stderr, "usage: named [-4|-6] [-c conffile] [-d debuglevel] "
-			"[-D comment]\n"
+			"[-D comment] [-E engine]\n"
 			"             [-f|-g] [-L logfile] [-n number_of_cpus] "
 			"[-p port] [-s]\n"
 			"             [-S sockets] [-t chrootdir] [-u "
 			"username] [-U listeners]\n"
 			"             [-m "
-			"{usage|trace|record}]\n"
+			"{usage|trace|record|size|mctx}]\n"
 			"             [-M fill|nofill]\n"
 			"usage: named [-v|-V|-C]\n");
 }
@@ -359,7 +406,7 @@ parse_int(char *arg, const char *desc) {
 	if (tmp < 0 || tmp != ltmp) {
 		named_main_earlyfatal("%s '%s' out of range", desc, arg);
 	}
-	return tmp;
+	return (tmp);
 }

 static struct flag_def {
@@ -463,8 +510,9 @@ list_hmac_algorithms(isc_buffer_t *b) {

 static void
 logit(isc_buffer_t *b) {
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "%.*s", (int)isc_buffer_usedlength(b),
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE, "%.*s",
+		      (int)isc_buffer_usedlength(b),
 		      (char *)isc_buffer_base(b));
 }

@@ -508,6 +556,8 @@ format_supported_algorithms(void (*emit)(isc_buffer_t *b)) {
 static void
 printversion(bool verbose) {
 	char rndcconf[PATH_MAX], *dot = NULL;
+	isc_mem_t *mctx = NULL;
+	isc_result_t result;
 	isc_buffer_t b;
 	char buf[512];
 #if defined(HAVE_GEOIP2)
@@ -540,8 +590,16 @@ printversion(bool verbose) {
 	printf("compiled by Solaris Studio %x\n", __SUNPRO_C);
 #endif /* ifdef __SUNPRO_C */
 	printf("compiled with OpenSSL version: %s\n", OPENSSL_VERSION_TEXT);
+#if !defined(LIBRESSL_VERSION_NUMBER) && \
+	OPENSSL_VERSION_NUMBER >= 0x10100000L /* 1.1.0 or higher */
 	printf("linked to OpenSSL version: %s\n",
 	       OpenSSL_version(OPENSSL_VERSION));
+
+#else  /* if !defined(LIBRESSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER >= \
+	* 0x10100000L */
+	printf("linked to OpenSSL version: %s\n",
+	       SSLeay_version(SSLEAY_VERSION));
+#endif /* OPENSSL_VERSION_NUMBER >= 0x10100000L */
 	printf("compiled with libuv version: %d.%d.%d\n", UV_VERSION_MAJOR,
 	       UV_VERSION_MINOR, UV_VERSION_PATCH);
 	printf("linked to libuv version: %s\n", uv_version_string());
@@ -581,9 +639,17 @@ printversion(bool verbose) {
 #endif /* if defined(HAVE_DNSTAP) */
 	printf("threads support is enabled\n");

-	isc_buffer_init(&b, buf, sizeof(buf));
-	format_supported_algorithms(printit);
-	printf("\n");
+	isc_mem_create(&mctx);
+	result = dst_lib_init(mctx, named_g_engine);
+	if (result == ISC_R_SUCCESS) {
+		isc_buffer_init(&b, buf, sizeof(buf));
+		format_supported_algorithms(printit);
+		printf("\n");
+		dst_lib_destroy();
+	} else {
+		printf("DST initialization failure: %s\n",
+		       isc_result_totext(result));
+	}

 	/*
 	 * The default rndc.conf and rndc.key paths are in the same
@@ -607,9 +673,7 @@ printversion(bool verbose) {
 	printf("  named PID file:       %s\n", named_g_defaultpidfile);
 #if defined(HAVE_GEOIP2)
 #define RTC(x) RUNTIME_CHECK((x) == ISC_R_SUCCESS)
-	isc_mem_t *mctx = NULL;
-	isc_mem_create(&mctx);
-	RTC(cfg_parser_create(mctx, &parser));
+	RTC(cfg_parser_create(mctx, named_g_lctx, &parser));
 	RTC(named_config_parsedefaults(parser, &config));
 	RTC(cfg_map_get(config, "options", &defaults));
 	RTC(cfg_map_get(defaults, "geoip-directory", &obj));
@@ -653,9 +717,7 @@ parse_T_opt(char *option) {
 	 * force the server to behave (or misbehave) in
 	 * specified ways for testing purposes.
 	 */
-	if (!strcmp(option, "cookiealwaysvalid")) {
-		cookiealwaysvalid = true;
-	} else if (!strcmp(option, "dropedns")) {
+	if (!strcmp(option, "dropedns")) {
 		dropedns = true;
 	} else if (!strcmp(option, "ednsformerr")) {
 		ednsformerr = true;
@@ -830,7 +892,7 @@ parse_command_line(int argc, char *argv[]) {
 			printf("# Built-in default values. "
 			       "This is NOT the run-time configuration!\n");
 			printf("%s", named_config_getdefault());
-			exit(EXIT_SUCCESS);
+			exit(0);
 		case 'd':
 			named_g_debuglevel = parse_int(isc_commandline_argument,
 						       "debug "
@@ -840,8 +902,7 @@ parse_command_line(int argc, char *argv[]) {
 			/* Descriptive comment for 'ps'. */
 			break;
 		case 'E':
-			named_main_earlyfatal(
-				"%s", isc_result_totext(DST_R_NOENGINE));
+			named_g_engine = isc_commandline_argument;
 			break;
 		case 'f':
 			named_g_foreground = true;
@@ -849,8 +910,6 @@ parse_command_line(int argc, char *argv[]) {
 		case 'g':
 			named_g_foreground = true;
 			named_g_logstderr = true;
-			named_g_logflags = ISC_LOG_PRINTTIME | ISC_LOG_ISO8601 |
-					   ISC_LOG_TZINFO;
 			break;
 		case 'L':
 			named_g_logfile = isc_commandline_argument;
@@ -890,17 +949,16 @@ parse_command_line(int argc, char *argv[]) {
 			break;
 		case 'U':
 			/* Obsolete.  No longer in use.  Ignore. */
-			named_main_earlywarning("option '-U' has been removed");
 			break;
 		case 'u':
 			named_g_username = isc_commandline_argument;
 			break;
 		case 'v':
 			printversion(false);
-			exit(EXIT_SUCCESS);
+			exit(0);
 		case 'V':
 			printversion(true);
-			exit(EXIT_SUCCESS);
+			exit(0);
 		case 'x':
 			/* Obsolete. No longer in use. Ignore. */
 			break;
@@ -909,7 +967,25 @@ parse_command_line(int argc, char *argv[]) {
 			named_main_earlyfatal("option '-X' has been removed");
 			break;
 		case 'F':
-			if (isc_crypto_fips_enable() != ISC_R_SUCCESS) {
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+			fips = OSSL_PROVIDER_load(NULL, "fips");
+			if (fips == NULL) {
+				ERR_clear_error();
+				named_main_earlyfatal(
+					"Failed to load FIPS provider");
+			}
+			base = OSSL_PROVIDER_load(NULL, "base");
+			if (base == NULL) {
+				OSSL_PROVIDER_unload(fips);
+				ERR_clear_error();
+				named_main_earlyfatal(
+					"Failed to load base provider");
+			}
+#endif
+			if (isc_fips_mode()) { /* Already in FIPS mode. */
+				break;
+			}
+			if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
 				named_main_earlyfatal(
 					"setting FIPS mode failed");
 			}
@@ -917,7 +993,7 @@ parse_command_line(int argc, char *argv[]) {
 		case '?':
 			usage();
 			if (isc_commandline_option == '?') {
-				exit(EXIT_SUCCESS);
+				exit(0);
 			}
 			p = strchr(NAMED_MAIN_ARGS, isc_commandline_option);
 			if (p == NULL || *++p != ':') {
@@ -955,18 +1031,18 @@ create_managers(void) {
 		named_g_cpus = named_g_cpus_detected;
 	}

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-		      ISC_LOG_INFO, "found %u CPU%s, using %u worker thread%s",
-		      named_g_cpus_detected,
-		      named_g_cpus_detected == 1 ? "" : "s", named_g_cpus,
-		      named_g_cpus == 1 ? "" : "s");
+	isc_log_write(
+		named_g_lctx, NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+		ISC_LOG_INFO, "found %u CPU%s, using %u worker thread%s",
+		named_g_cpus_detected, named_g_cpus_detected == 1 ? "" : "s",
+		named_g_cpus, named_g_cpus == 1 ? "" : "s");

 	isc_managers_create(&named_g_mctx, named_g_cpus, &named_g_loopmgr,
 			    &named_g_netmgr);

 	isc_nm_maxudp(named_g_netmgr, maxudp);

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static void
@@ -1039,129 +1115,150 @@ setup(void) {
 		named_os_daemonize();
 	}

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "starting %s%s <id:%s>", PACKAGE_STRING,
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "starting %s%s <id:%s>", PACKAGE_STRING,
 		      PACKAGE_DESCRIPTION, PACKAGE_SRCID);

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "running on %s", named_os_uname());
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE, "running on %s",
+		      named_os_uname());

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "built with %s", PACKAGE_CONFIGARGS);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE, "built with %s",
+		      PACKAGE_CONFIGARGS);

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "running as: %s%s%s", program_name,
-		      saved_command_line, ellipsis);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "running as: %s%s%s", program_name, saved_command_line,
+		      ellipsis);
 #ifdef __clang__
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "compiled by CLANG %s", __VERSION__);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "compiled by CLANG %s", __VERSION__);
 #else /* ifdef __clang__ */
 #if defined(__ICC) || defined(__INTEL_COMPILER)
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "compiled by ICC %s", __VERSION__);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "compiled by ICC %s", __VERSION__);
 #else /* if defined(__ICC) || defined(__INTEL_COMPILER) */
 #ifdef __GNUC__
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "compiled by GCC %s", __VERSION__);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "compiled by GCC %s", __VERSION__);
 #endif /* ifdef __GNUC__ */
 #endif /* if defined(__ICC) || defined(__INTEL_COMPILER) */
 #endif /* ifdef __clang__ */
 #ifdef __SUNPRO_C
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "compiled by Solaris Studio %x",
-		      __SUNPRO_C);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "compiled by Solaris Studio %x", __SUNPRO_C);
 #endif /* ifdef __SUNPRO_C */
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "compiled with OpenSSL version: %s",
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "compiled with OpenSSL version: %s",
 		      OPENSSL_VERSION_TEXT);
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "linked to OpenSSL version: %s",
+#if !defined(LIBRESSL_VERSION_NUMBER) && \
+	OPENSSL_VERSION_NUMBER >= 0x10100000L /* 1.1.0 or higher */
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "linked to OpenSSL version: %s",
 		      OpenSSL_version(OPENSSL_VERSION));
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "compiled with libuv version: %d.%d.%d",
-		      UV_VERSION_MAJOR, UV_VERSION_MINOR, UV_VERSION_PATCH);
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "linked to libuv version: %s",
-		      uv_version_string());
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "compiled with %s version: %s",
-		      RCU_FLAVOR, RCU_VERSION);
+#else  /* if !defined(LIBRESSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER >= \
+	* 0x10100000L */
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "linked to OpenSSL version: %s",
+		      SSLeay_version(SSLEAY_VERSION));
+#endif /* OPENSSL_VERSION_NUMBER >= 0x10100000L */
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "compiled with libuv version: %d.%d.%d", UV_VERSION_MAJOR,
+		      UV_VERSION_MINOR, UV_VERSION_PATCH);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "linked to libuv version: %s", uv_version_string());
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "compiled with %s version: %s", RCU_FLAVOR, RCU_VERSION);
 #if defined(JEMALLOC_VERSION)
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE,
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "compiled with jemalloc version: %u.%u.%u",
 		      JEMALLOC_VERSION_MAJOR, JEMALLOC_VERSION_MINOR,
 		      JEMALLOC_VERSION_BUGFIX);
 #elif defined(M_VERSION)
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE,
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "compiled with system jemalloc version: %u", M_VERSION);
 #endif
 #if HAVE_LIBNGHTTP2
 	nghttp2_info *nginfo = NULL;
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "compiled with libnghttp2 version: %s",
-		      NGHTTP2_VERSION);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "compiled with libnghttp2 version: %s", NGHTTP2_VERSION);
 	nginfo = nghttp2_version(1);
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "linked to libnghttp2 version: %s",
-		      nginfo->version_str);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "linked to libnghttp2 version: %s", nginfo->version_str);
 #endif
 #ifdef HAVE_LIBXML2
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "compiled with libxml2 version: %s",
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "compiled with libxml2 version: %s",
 		      LIBXML_DOTTED_VERSION);
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "linked to libxml2 version: %s",
-		      xmlParserVersion);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "linked to libxml2 version: %s", xmlParserVersion);
 #endif /* ifdef HAVE_LIBXML2 */
 #if defined(HAVE_JSON_C)
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "compiled with json-c version: %s",
-		      JSON_C_VERSION);
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "linked to json-c version: %s",
-		      json_c_version());
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "compiled with json-c version: %s", JSON_C_VERSION);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "linked to json-c version: %s", json_c_version());
 #endif /* if defined(HAVE_JSON_C) */
 #if defined(HAVE_ZLIB) && defined(ZLIB_VERSION)
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "compiled with zlib version: %s",
-		      ZLIB_VERSION);
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "linked to zlib version: %s",
-		      zlibVersion());
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "compiled with zlib version: %s", ZLIB_VERSION);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "linked to zlib version: %s", zlibVersion());
 #endif /* if defined(HAVE_ZLIB) && defined(ZLIB_VERSION) */
 #if defined(HAVE_GEOIP2)
 	/* Unfortunately, no version define on link time */
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "linked to maxminddb version: %s",
-		      MMDB_lib_version());
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "linked to maxminddb version: %s", MMDB_lib_version());
 #endif /* if defined(HAVE_GEOIP2) */
 #if defined(HAVE_DNSTAP)
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "compiled with protobuf-c version: %s",
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "compiled with protobuf-c version: %s",
 		      PROTOBUF_C_VERSION);
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "linked to protobuf-c version: %s",
-		      protobuf_c_version());
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "linked to protobuf-c version: %s", protobuf_c_version());
 #endif /* if defined(HAVE_DNSTAP) */
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE,
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "----------------------------------------------------");
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE,
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "BIND 9 is maintained by Internet Systems Consortium,");
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE,
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "Inc. (ISC), a non-profit 501(c)(3) public-benefit ");
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE,
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "corporation.  Support and training for BIND 9 are ");
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE,
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "available at https://www.isc.org/support");
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE,
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "----------------------------------------------------");

 	/*
@@ -1218,14 +1315,15 @@ setup(void) {
 	ENSURE(named_g_server != NULL);
 	sctx = named_g_server->sctx;

+	/*
+	 * Report supported algorithms now that dst_lib_init() has
+	 * been called via named_server_create().
+	 */
 	format_supported_algorithms(logit);

 	/*
 	 * Modify server context according to command line options
 	 */
-	if (cookiealwaysvalid) {
-		ns_server_setoption(sctx, NS_SERVER_COOKIEALWAYSVALID, true);
-	}
 	if (disable4) {
 		ns_server_setoption(sctx, NS_SERVER_DISABLE4, true);
 	}
@@ -1296,8 +1394,9 @@ cleanup(void) {
 	 */
 	dlz_dlopen_clear();

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "exiting");
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE, "exiting");
+	named_log_shutdown();
 }

 static char *memstats = NULL;
@@ -1337,7 +1436,7 @@ named_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {
 			UNEXPECTED_ERROR("scf_handle_create() failed: %s",
 					 scf_strerror(scf_error()));
 		}
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

 	if (scf_handle_bind(h) == -1) {
@@ -1346,7 +1445,7 @@ named_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {
 					 scf_strerror(scf_error()));
 		}
 		scf_handle_destroy(h);
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

 	if ((namelen = scf_myname(h, NULL, 0)) == -1) {
@@ -1355,10 +1454,17 @@ named_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {
 					 scf_strerror(scf_error()));
 		}
 		scf_handle_destroy(h);
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
+	}
+
+	if ((instance = isc_mem_allocate(mctx, namelen + 1)) == NULL) {
+		UNEXPECTED_ERROR("named_smf_get_instance memory "
+				 "allocation failed: %s",
+				 isc_result_totext(ISC_R_NOMEMORY));
+		scf_handle_destroy(h);
+		return (ISC_R_FAILURE);
 	}

-	instance = isc_mem_allocate(mctx, namelen + 1);
 	if (scf_myname(h, instance, namelen + 1) == -1) {
 		if (debug) {
 			UNEXPECTED_ERROR("scf_myname() failed: %s",
@@ -1366,12 +1472,12 @@ named_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {
 		}
 		scf_handle_destroy(h);
 		isc_mem_free(mctx, instance);
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

 	scf_handle_destroy(h);
 	*ins_name = instance;
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }
 #endif /* HAVE_LIBSCF */

@@ -1460,7 +1566,6 @@ main(int argc, char *argv[]) {
 	 * Start things running
 	 */
 	isc_signal_start(named_g_server->sighup);
-	isc_signal_start(named_g_server->sigusr1);

 	/*
 	 * Pause the loop manager in fatal.
@@ -1503,7 +1608,7 @@ main(int argc, char *argv[]) {
 	isc_managers_destroy(&named_g_mctx, &named_g_loopmgr, &named_g_netmgr);

 #if ENABLE_LEAK_DETECTION
-	isc__crypto_setdestroycheck(true);
+	isc__tls_setdestroycheck(true);
 	isc__uv_setdestroycheck(true);
 	isc__xml_setdestroycheck(true);
 #endif
@@ -1516,9 +1621,18 @@ main(int argc, char *argv[]) {

 	named_os_shutdown();

+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+	if (base != NULL) {
+		OSSL_PROVIDER_unload(base);
+	}
+	if (fips != NULL) {
+		OSSL_PROVIDER_unload(fips);
+	}
+#endif
+
 #ifdef HAVE_GPERFTOOLS_PROFILER
 	ProfilerStop();
 #endif /* ifdef HAVE_GPERFTOOLS_PROFILER */

-	return 0;
+	return (0);
 }
@@ -21,7 +21,7 @@ named - Internet domain name server
 Synopsis
 ~~~~~~~~

-:program:`named` [ [**-4**] | [**-6**] ] [**-c** config-file] [**-C**] [**-d** debug-level] [**-D** string] [**-f**] [**-g**] [**-L** logfile] [**-M** option] [**-m** flag] [**-n** #cpus] [**-p** port] [**-s**] [**-t** directory] [**-u** user] [**-v**] [**-V**] ]
+:program:`named` [ [**-4**] | [**-6**] ] [**-c** config-file] [**-C**] [**-d** debug-level] [**-D** string] [**-E** engine-name] [**-f**] [**-g**] [**-L** logfile] [**-M** option] [**-m** flag] [**-n** #cpus] [**-p** port] [**-s**] [**-t** directory] [**-U** #listeners] [**-u** user] [**-v**] [**-V**] ]

 Description
 ~~~~~~~~~~~
@@ -73,6 +73,15 @@ Options
   This option specifies a string that is used to identify a instance of :program:`named`
   in a process listing. The contents of ``string`` are not examined.

+.. option:: -E engine-name
+
+   When applicable, this option specifies the hardware to use for cryptographic
+   operations, such as a secure key store used for signing.
+
+   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
+   engine identifier that drives the cryptographic accelerator or
+   hardware service module (usually ``pkcs11``).
+
 .. option:: -f

   This option runs the server in the foreground (i.e., do not daemonize).
@@ -108,7 +117,7 @@ Options
 .. option:: -m flag

   This option turns on memory usage debugging flags. Possible flags are ``usage``,
-   ``trace`` and ``record``. These correspond to the
+   ``trace``, ``record``, ``size``, and ``mctx``. These correspond to the
   ``ISC_MEM_DEBUGXXXX`` flags described in ``<isc/mem.h>``.

 .. option:: -n #cpus
@@ -154,7 +163,14 @@ Options

 .. option:: -U #listeners

-   This option has been removed. Attempts to use it now result in a warning.
+   This option tells :program:`named` the number of ``#listeners`` worker threads to listen on, for incoming UDP packets on
+   each address. If not specified, :program:`named` calculates a default
+   value based on the number of detected CPUs: 1 for 1 CPU, and the
+   number of detected CPUs minus one for machines with more than 1 CPU.
+   This cannot be increased to a value higher than the number of CPUs.
+   If :option:`-n` has been set to a higher value than the number of detected
+   CPUs, then :option:`-U` may be increased as high as that value, but no
+   higher.

 .. option:: -u user

--- a/Show More
+++ b/Show More