set "multi-master" automatically with multiple primaries

By default, named logs a message at level info if a secondary zone receives an update indicating that the serial number has gone backwards. The "multi-master" option was provided to allow this message to be suppressed if a zone was configured with multiple primary servers. That option has now been marked obsolete. The message is now logged at debug level 1 when there are multiple primary server addresses configured for the zone. It is still logged at level info if there is only address.
fix: dev: clean up incorrect logging module names
2024-12-11 11:15:04 -08:00 · 2024-12-11 17:12:18 +00:00 · 2024-12-11 17:11:32 +00:00 · 2024-12-11 13:39:02 +00:00 · 2024-12-11 14:04:37 +01:00 · 2024-12-11 03:39:21 +00:00
1338 changed files with 63184 additions and 89442 deletions
@@ -79,3 +79,5 @@ PenaltyExcessCharacter: 100
 Standard: Cpp11
 ContinuationIndentWidth: 8
 ForEachMacros: [ 'cds_lfs_for_each', 'cds_lfs_for_each_safe', 'cds_list_for_each_entry_safe', 'ISC_LIST_FOREACH', 'ISC_LIST_FOREACH_SAFE', 'ISC_LIST_FOREACH_REV', 'ISC_LIST_FOREACH_REV_SAFE' ]
+RemoveParentheses: ReturnStatement
+RemoveSemicolon: true
@@ -78,3 +78,5 @@ PenaltyBreakString: 80
 PenaltyExcessCharacter: 100
 Standard: Cpp11
 ContinuationIndentWidth: 8
+RemoveParentheses: ReturnStatement
+RemoveSemicolon: true
@@ -1540,3 +1540,11 @@ ffbe6b95371c99b7fb05e6de17a8d6b7bf4f629f
 79d93600116faabd89798522817ad95a69684fff
 # Reformat sources with up-to-date clang-format-18
 b7de2c7cb959fa35099d72c3f9b13938348c74e6
+# Reformat sources with up-to-date clang-format-19
+ff69d07fed2619a9bedf5ccc18cf106b7dd49bef
+# Reformat sources with up-to-date clang-format-19
+ebb5bd9c0f079de8970b538fe48e5f5c60ea7ee9
+# Remove redundant semicolons after the closing braces of functions
+1a19ce39db12ed4ecf59a3d0f5734656d24999a5
+# Remove redundant parentheses from the return statement
+0258850f202b7a46b52f3e3a4968c3fc68fe9a45
@@ -10,4 +10,4 @@
 /util/**			 export-ignore
 /util/bindkeys.pl		-export-ignore
 /util/check-make-install.in	-export-ignore
-/util/mksymtbl.pl		-export-ignore
+/util/dtrace.sh		-export-ignore
@@ -0,0 +1 @@
+contrib/gitchangelog/changelog.rc.py
@@ -15,7 +15,7 @@ variables:
  TEST_PARALLEL_JOBS: 4

  CONFIGURE: ./configure
-  CLANG_VERSION: 18
+  CLANG_VERSION: 19
  CLANG: "clang-${CLANG_VERSION}"
  SCAN_BUILD: "scan-build-${CLANG_VERSION}"
  LLVM_SYMBOLIZER: "/usr/lib/llvm-${CLANG_VERSION}/bin/llvm-symbolizer"
@@ -64,6 +64,13 @@ default:
  # See: https://docs.gitlab.com/ee/ci/pipelines/settings.html#auto-cancel-redundant-pipelines
  interruptible: true

+  # AWS can interrupt the spot instance anytime, so let's retry the job when
+  # the interruption event happens to avoid a pipeline failure.
+  retry:
+    max: 2
+    when:
+      - runner_system_failure
+
 stages:
  - autoconf
  - precheck
@@ -116,8 +123,8 @@ stages:

 # Alpine Linux

-.alpine-3.20-amd64: &alpine_3_20_amd64_image
-  image: "$CI_REGISTRY_IMAGE:alpine-3.20-amd64"
+.alpine-3.21-amd64: &alpine_3_21_amd64_image
+  image: "$CI_REGISTRY_IMAGE:alpine-3.21-amd64"
  <<: *linux_amd64

 # Oracle Linux
@@ -140,10 +147,6 @@ stages:

 # Debian

-.debian-bullseye-amd64: &debian_bullseye_amd64_image
-  image: "$CI_REGISTRY_IMAGE:debian-bullseye-amd64"
-  <<: *linux_amd64
-
 .debian-bookworm-amd64: &debian_bookworm_amd64_image
  image: "$CI_REGISTRY_IMAGE:debian-bookworm-amd64"
  <<: *linux_amd64
@@ -168,16 +171,16 @@ stages:

 # Fedora

-.tsan-fedora-40-amd64: &tsan_fedora_40_amd64_image
-  image: "$CI_REGISTRY_IMAGE:tsan-fedora-40-amd64"
+.tsan-fedora-41-amd64: &tsan_fedora_41_amd64_image
+  image: "$CI_REGISTRY_IMAGE:tsan-fedora-41-amd64"
  <<: *linux_amd64

-.fedora-40-amd64: &fedora_40_amd64_image
-  image: "$CI_REGISTRY_IMAGE:fedora-40-amd64"
+.fedora-41-amd64: &fedora_41_amd64_image
+  image: "$CI_REGISTRY_IMAGE:fedora-41-amd64"
  <<: *linux_amd64

-.fedora-40-arm64: &fedora_40_arm64_image
-  image: "$CI_REGISTRY_IMAGE:fedora-40-arm64"
+.fedora-41-arm64: &fedora_41_arm64_image
+  image: "$CI_REGISTRY_IMAGE:fedora-41-arm64"
  <<: *linux_arm64

 # Ubuntu
@@ -203,15 +206,15 @@ stages:
 ### QCOW2 Image Templates

 .freebsd-13-amd64: &freebsd_13_amd64_image
-  image: "freebsd-13.3-x86_64"
+  image: "freebsd-13.4-x86_64"
  <<: *libvirt_amd64

 .freebsd-14-amd64: &freebsd_14_amd64_image
-  image: "freebsd-14.0-x86_64"
+  image: "freebsd-14.2-x86_64"
  <<: *libvirt_amd64

 .openbsd-amd64: &openbsd_amd64_image
-  image: "openbsd-7.5-x86_64"
+  image: "openbsd-7.6-x86_64"
  <<: *libvirt_amd64

 ### Job Templates
@@ -263,7 +266,6 @@ stages:
      --enable-developer
      --enable-option-checking=fatal
      --enable-dnstap
-      --enable-dnsrps
      --with-cmocka
      --with-libxml2
      --with-json-c
@@ -314,9 +316,7 @@ stages:
    - *configure
    - *check_readline_setup
    - make -j${BUILD_PARALLEL_JOBS:-1} -k all V=1
-    - test -z "${BUILD_CONTRIB}" || for DIR in contrib/dlz/modules/*; do test -f "${DIR}/Makefile" && CFLAGS="${CFLAGS} -Werror" make -C "${DIR}"; done
    - test -z "${RUN_MAKE_INSTALL}" || make DESTDIR="${INSTALL_PATH}" install
-    - test -z "${RUN_MAKE_INSTALL}" -o -z "${BUILD_CONTRIB}" || for DIR in contrib/dlz/modules/*; do test -f "${DIR}/Makefile" && make -C "${DIR}" DESTDIR="${INSTALL_PATH}" install; done
    - test -z "${RUN_MAKE_INSTALL}" || DESTDIR="${INSTALL_PATH}" sh util/check-make-install
    - if [[ "${CFLAGS}" == *"-fsanitize=address"* ]]; then ( ! grep -F AddressSanitizer config.log ); fi
    - test -z "${CROSS_COMPILATION}" || grep -F -A 1 "checking whether we are cross compiling" config.log | grep -q "result.*yes"
@@ -361,6 +361,7 @@ stages:
  needs:
    - job: ci-variables
      artifacts: true
+  timeout: 2h

 .system_test_common: &system_test_common
  <<: *default_triggering_rules
@@ -513,18 +514,6 @@ misc:
      - checklibs.out
    when: on_failure

-changes:
-  <<: *precheck_job
-  except:
-    - pipelines
-  script:
-    - sh util/tabify-changes < CHANGES > CHANGES.tmp
-    - diff -urNap CHANGES CHANGES.tmp
-    - perl util/check-changes CHANGES
-    - sh util/check-line-length.sh CHANGES
-    - rm CHANGES.tmp
-  needs: []
-
 black:
  <<: *precheck_job
  needs: []
@@ -538,6 +527,12 @@ black:
    expire_in: "1 week"
    when: on_failure

+vulture:
+  <<: *precheck_job
+  needs: []
+  script:
+    - vulture --exclude "*/ans*/ans.py,conftest.py,isctest" --ignore-names "pytestmark" bin/tests/system/
+
 ci-variables:
  stage: precheck
  <<: *precheck_job
@@ -581,7 +576,7 @@ pylint:
  variables:
    PYTHONPATH: "${CI_PROJECT_DIR}/bin/tests/system"
  script:
-    - pylint --rcfile $CI_PROJECT_DIR/.pylintrc $(git ls-files '*.py' | grep -vE '(ans\.py|dangerfile\.py|^bin/tests/system/)')
+    - pylint --rcfile $CI_PROJECT_DIR/.pylintrc $(git ls-files '*.py' | grep -vE '(ans\.py|dangerfile\.py|^bin/tests/system/|^contrib/)')
      # Ignore Pylint wrong-import-position error in system test to enable use of pytest.importorskip
    - pylint --rcfile $CI_PROJECT_DIR/.pylintrc --disable=wrong-import-position $(git ls-files 'bin/tests/system/*.py' | grep -vE 'ans\.py')

@@ -656,6 +651,28 @@ tarball-create:

 # Jobs for doc builds on Debian 12 "bookworm" (amd64)

+changelog:
+  <<: *base_image
+  <<: *docs_job
+  rules:
+    - if: '$CI_MERGE_REQUEST_TITLE =~ /\s(dev|usr|pkg):/'
+  variables:
+    GIT_AUTHOR_NAME: $GITLAB_USER_NAME
+    GIT_AUTHOR_EMAIL: $GITLAB_USER_EMAIL
+    GIT_COMMITTER_NAME: $GITLAB_USER_NAME
+    GIT_COMMITTER_EMAIL: $GITLAB_USER_EMAIL
+  before_script:
+    - echo -e "$CI_MERGE_REQUEST_TITLE\n" > commitmsg
+    - sed -i 's/^Draft:\s*//' commitmsg
+    - echo -e "$CI_MERGE_REQUEST_DESCRIPTION" >> commitmsg
+    - git commit --allow-empty -F commitmsg
+    - ./contrib/gitchangelog/gitchangelog.py HEAD^..HEAD
+  needs:
+    - job: autoreconf
+      artifacts: true
+  artifacts:
+    untracked: true
+
 docs:
  <<: *default_triggering_rules
  <<: *base_image
@@ -688,7 +705,6 @@ cross-version-config-tests:
    # Disable option checking to prevent problems with new default options in
    # the &configure anchor.
    EXTRA_CONFIGURE: "--disable-option-checking"
-    PYTEST: "/usr/bin/pytest-3"
  script:
    - *configure
    - *setup_interfaces
@@ -698,16 +714,20 @@ cross-version-config-tests:
    - autoreconf -fi
    - *configure
    - make -j${BUILD_PARALLEL_JOBS:-1}
+    - *find_pytest
+    # The cross-version-config-tests job would fail when a system test is
+    # removed from the upcoming release. To avoid this, remove the system test
+    # also from the $BIND_BASELINE_VERSION.
+    - find bin/tests/system/ -mindepth 1 -maxdepth 1 -type d -exec sh -c 'test -e ../"$0" || rm -rfv -- "$0"' {} \;
    - cd bin/tests/system
+    # System tests that employ binary drivers will fail on ABI change and
+    # should not be run.
+    - rm -r dlzexternal
+    - rm -r dyndb
    # Run the setup phase of all system tests in the most recently tagged BIND 9
    # release using the binaries built for the current BIND 9 version.  This
    # intends to detect obvious backward compatibility issues with the latter.
-    - >
-      if [ -f isctest/vars/autoconf.py ]; then
-        echo "${CI_PROJECT_DIR}" > isctest/vars/.ac_vars/TOP_BUILDDIR
-      else
-        sed -i -E "s|(export TOP_BUILDDIR)=.*|\1=${CI_PROJECT_DIR}|" conf.sh;
-      fi
+    - sed -i "s|f\"{AC_VARS\['TOP_BUILDDIR'\]}|\"$CI_PROJECT_DIR|g" isctest/vars/basic.py
    - >
      "$PYTEST" --setup-only --junit-xml="$CI_PROJECT_DIR"/junit.xml -n "${TEST_PARALLEL_JOBS:-1}"
  needs:
@@ -724,29 +744,41 @@ cross-version-config-tests:
    untracked: true
    expire_in: "1 day"
    when: always
+  # Changes in the January milestone necessitate allowing this job to fail. The
+  # "soft failure" should be reverted when January releases are published.
+  # - #4261 introduced extra artifacts check but missed a file visible only in
+  #   this job. This is fixed in !9815 but present in December releases.
+  #   System test affected: mkeys.
+  # - #4666 removed the "fixed" value for the "rrset-order" option, but the
+  #   value is still present in the December release system test.
+  #   System test affected: rrsetorder.
+  # - #4482 removed the "dnssec-must-be-secure" feature that is still present
+  #   in the December release.
+  #   System tests affected: autosign, dnssec, and dsdigest.
+  allow_failure: true

-# Jobs for regular GCC builds on Alpine Linux 3.20 (amd64)
+# Jobs for regular GCC builds on Alpine Linux 3.21 (amd64)

-gcc:alpine3.20:amd64:
+gcc:alpine3.21:amd64:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON}"
    EXTRA_CONFIGURE: "${WITHOUT_READLINE}"
-  <<: *alpine_3_20_amd64_image
+  <<: *alpine_3_21_amd64_image
  <<: *build_job

-system:gcc:alpine3.20:amd64:
-  <<: *alpine_3_20_amd64_image
+system:gcc:alpine3.21:amd64:
+  <<: *alpine_3_21_amd64_image
  <<: *system_test_job
  needs:
-    - job: gcc:alpine3.20:amd64
+    - job: gcc:alpine3.21:amd64
      artifacts: true

-unit:gcc:alpine3.20:amd64:
-  <<: *alpine_3_20_amd64_image
+unit:gcc:alpine3.21:amd64:
+  <<: *alpine_3_21_amd64_image
  <<: *unit_test_job
  needs:
-    - job: gcc:alpine3.20:amd64
+    - job: gcc:alpine3.21:amd64
      artifacts: true

 # Jobs for regular GCC builds on Oracle Linux 8 (amd64)
@@ -868,7 +900,6 @@ gcc:tarball:nosphinx:

 gcc:bookworm:amd64:
  variables:
-    BUILD_CONTRIB: 1
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} --coverage -O0"
    EXTRA_CONFIGURE: "--with-libidn2 ${WITH_READLINE_LIBEDIT}"
@@ -881,6 +912,7 @@ system:gcc:bookworm:amd64:
  <<: *system_test_gcov_job
  variables:
    CI_ENABLE_ALL_TESTS: 1
+    TZ: Australia/Sydney
  needs:
    - job: unit:gcc:bookworm:amd64
      artifacts: true
@@ -900,7 +932,7 @@ gcc:bookworm:rbt:amd64:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON}"
-    EXTRA_CONFIGURE: "--with-libidn2 --with-zonedb=rbt --with-cachedb=rbt"
+    EXTRA_CONFIGURE: "--with-libidn2"
  <<: *debian_bookworm_amd64_image
  <<: *build_job

@@ -1095,15 +1127,7 @@ gcc:tumbleweed:amd64:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -DDEBUG"
-    # NOTE: Testing DNSRPS-enabled builds currently requires an
-    # operating system with glibc 2.34+.  This requirement will go away
-    # once the DNSRPS dynamic loading code gets reworked to use libuv's
-    # dlopen() API.
-    #
-    # NOTE: This does *not* enable testing of the DNSRPS feature itself.
-    # Doing that requires a DNSRPS provider library to be present on the
-    # test host.
-    EXTRA_CONFIGURE: "--enable-dnsrps --enable-dnsrps-dl --with-libidn2 ${WITH_READLINE_READLINE}"
+    EXTRA_CONFIGURE: "--with-libidn2 ${WITH_READLINE_READLINE}"
  <<: *tumbleweed_latest_amd64_image
  <<: *build_job

@@ -1193,7 +1217,7 @@ unit:gcc:noble:amd64:
    - job: gcc:noble:amd64
      artifacts: true

-# Jobs for ASAN builds on Fedora 40 (amd64)
+# Jobs for ASAN builds on Fedora 41 (amd64)

 gcc:asan:
  variables:
@@ -1201,20 +1225,20 @@ gcc:asan:
    CFLAGS: "${CFLAGS_COMMON} -fsanitize=address,undefined"
    LDFLAGS: "-fsanitize=address,undefined"
    EXTRA_CONFIGURE: "--with-libidn2 --without-jemalloc"
-  <<: *fedora_40_amd64_image
+  <<: *fedora_41_amd64_image
  <<: *build_job

 system:gcc:asan:
  variables:
    LSAN_OPTIONS: "suppressions=$CI_PROJECT_DIR/suppr-lsan.txt"
-  <<: *fedora_40_amd64_image
+  <<: *fedora_41_amd64_image
  <<: *system_test_job
  needs:
    - job: gcc:asan
      artifacts: true

 unit:gcc:asan:
-  <<: *fedora_40_amd64_image
+  <<: *fedora_41_amd64_image
  <<: *unit_test_job
  needs:
    - job: gcc:asan
@@ -1243,21 +1267,21 @@ unit:clang:asan:
    - job: clang:asan
      artifacts: true

-# Jobs for TSAN builds on Fedora 40 (amd64)
+# Jobs for TSAN builds on Fedora 41 (amd64)

 gcc:tsan:
  variables:
    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -fsanitize=thread"
+    CFLAGS: "${CFLAGS_COMMON} -Wno-stringop-overread -ggdb -O2 -fsanitize=thread"
    LDFLAGS: "-fsanitize=thread"
-    EXTRA_CONFIGURE: "--with-libidn2 --enable-pthread-rwlock --without-jemalloc"
-  <<: *tsan_fedora_40_amd64_image
+    EXTRA_CONFIGURE: "--with-libidn2 --enable-pthread-rwlock --without-jemalloc PKG_CONFIG_PATH=/opt/tsan/lib/pkgconfig"
+  <<: *tsan_fedora_41_amd64_image
  <<: *build_job

 system:gcc:tsan:
  variables:
    TSAN_OPTIONS: "${TSAN_OPTIONS_FEDORA}"
-  <<: *tsan_fedora_40_amd64_image
+  <<: *tsan_fedora_41_amd64_image
  <<: *system_test_tsan_job
  needs:
    - job: gcc:tsan
@@ -1266,7 +1290,7 @@ system:gcc:tsan:
 unit:gcc:tsan:
  variables:
    TSAN_OPTIONS: "${TSAN_OPTIONS_FEDORA}"
-  <<: *tsan_fedora_40_amd64_image
+  <<: *tsan_fedora_41_amd64_image
  <<: *unit_test_tsan_job
  needs:
    - job: gcc:tsan
@@ -1277,9 +1301,9 @@ clang:tsan:
  <<: *build_job
  variables:
    CC: "${CLANG}"
-    CFLAGS: "${CFLAGS_COMMON} -fsanitize=thread"
+    CFLAGS: "${CFLAGS_COMMON} -ggdb -O2 -fsanitize=thread"
    LDFLAGS: "-fsanitize=thread"
-    EXTRA_CONFIGURE: "--with-libidn2 --enable-pthread-rwlock --without-jemalloc"
+    EXTRA_CONFIGURE: "--with-libidn2 --enable-pthread-rwlock --without-jemalloc PKG_CONFIG_PATH=/opt/tsan/lib/pkgconfig"

 system:clang:tsan:
  variables:
@@ -1299,61 +1323,39 @@ unit:clang:tsan:
    - job: clang:tsan
      artifacts: true

-# Jobs for Debian 11 "bullseye" (amd64)
+generate-tsan-stress-test-configs:
+  <<: *base_image
+  <<: *default_triggering_rules
+  stage: system
+  script:
+    - util/generate-tsan-stress-jobs.py > tsan-stress-test-configs.yml
+  artifacts:
+    paths:
+      - tsan-stress-test-configs.yml
+  needs: []
+  when: manual

-clang:bullseye:amd64:
+tsan:stress:
+  <<: *default_triggering_rules
+  stage: postcheck
  variables:
-    CC: ${CLANG}
-    CFLAGS: "${CFLAGS_COMMON} -Wenum-conversion"
-  <<: *debian_bullseye_amd64_image
-  <<: *build_job
-
-system:clang:bullseye:amd64:
-  <<: *debian_bullseye_amd64_image
-  <<: *system_test_job
+    PARENT_PIPELINE_ID: $CI_PIPELINE_ID
+  trigger:
+    include:
+      - artifact: tsan-stress-test-configs.yml
+        job: generate-tsan-stress-test-configs
  needs:
-    - job: clang:bullseye:amd64
+    - job: generate-tsan-stress-test-configs
      artifacts: true
-
-unit:clang:bullseye:amd64:
-  <<: *debian_bullseye_amd64_image
-  <<: *unit_test_job
-  needs:
-    - job: clang:bullseye:amd64
+    - job: gcc:tsan
      artifacts: true
-
-gcc:bullseye:amd64:
-  variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON}"
-    # See https://gitlab.isc.org/isc-projects/bind9/-/issues/3444
-    EXTRA_CONFIGURE: "--with-libidn2 --without-jemalloc --disable-leak-detection"
-  <<: *debian_bullseye_amd64_image
-  <<: *build_job
-
-system:gcc:bullseye:amd64:
-  # Set up environment variables that allow the "keyfromlabel" system test to be run
-  variables:
-    OPENSSL_CONF: "/var/tmp/etc/openssl.cnf"
-    SOFTHSM2_CONF: "/var/tmp/softhsm2/softhsm2.conf"
-  <<: *debian_bullseye_amd64_image
-  <<: *system_test_job
-  needs:
-    - job: gcc:bullseye:amd64
-      artifacts: true
-
-unit:gcc:bullseye:amd64:
-  <<: *debian_bullseye_amd64_image
-  <<: *unit_test_job
-  needs:
-    - job: gcc:bullseye:amd64
+    - job: clang:tsan
      artifacts: true

 # Jobs for Clang builds on Debian 12 "bookworm" (amd64)

 clang:bookworm:amd64:
  variables:
-    BUILD_CONTRIB: 1
    CC: ${CLANG}
    CFLAGS: "${CFLAGS_COMMON} -Wenum-conversion -DOPENSSL_API_COMPAT=10100"
    # See https://gitlab.isc.org/isc-projects/bind9/-/issues/3444
@@ -1363,10 +1365,6 @@ clang:bookworm:amd64:
  <<: *build_job

 system:clang:bookworm:amd64:
-  # Set up environment variables that allow the "keyfromlabel" system test to be run
-  variables:
-    OPENSSL_CONF: "/var/tmp/etc/openssl.cnf"
-    SOFTHSM2_CONF: "/var/tmp/softhsm2/softhsm2.conf"
  <<: *debian_bookworm_amd64_image
  <<: *system_test_job
  needs:
@@ -1435,6 +1433,7 @@ unit:clang:freebsd14:amd64:
  needs:
    - job: clang:freebsd14:amd64
      artifacts: true
+  retry: 1  # GL #4924

 # Jobs for Clang builds on OpenBSD (amd64)

@@ -1467,11 +1466,12 @@ release:
    - pushd "${BIND_DIRECTORY}-release"
    - mv "../${BIND_DIRECTORY}.tar.xz" .
    - tar --extract --file="${BIND_DIRECTORY}.tar.xz"
-    - mv "${BIND_DIRECTORY}"/{CHANGES*,COPYRIGHT,LICENSE,README.md,srcid} .
+    - mv "${BIND_DIRECTORY}"/{COPYRIGHT,LICENSE,README.md,srcid} .
    - rm -rf "${BIND_DIRECTORY}"
    - mv "../doc/arm/_build/html" doc/arm/
    - mv "../doc/arm/_build/epub/Bv9ARM.epub" doc/arm/
    - echo '<!DOCTYPE HTML><html lang="en"><meta http-equiv="refresh" content="0; url=doc/arm/html/notes.html"><title>Redirect</title></html>' > "RELEASE-NOTES-${BIND_DIRECTORY}.html"
+    - echo '<!DOCTYPE HTML><html lang="en"><meta http-equiv="refresh" content="0; url=doc/arm/html/changelog.html"><title>Redirect</title></html>' > "CHANGELOG-${BIND_DIRECTORY}.html"
    - popd
  needs:
    - job: tarball-create
@@ -1601,7 +1601,7 @@ respdiff:asan:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -Og -fsanitize=address,undefined"
    LDFLAGS: "-fsanitize=address,undefined"
-    EXTRA_CONFIGURE: "--disable-dnsrps --without-jemalloc"
+    EXTRA_CONFIGURE: "--without-jemalloc"
    MAX_DISAGREEMENTS_PERCENTAGE: "0.5"
  script:
    - bash respdiff.sh -s named -q "${PWD}/100k_mixed.txt" -c 3 -w "${PWD}/rspworkdir" "${CI_PROJECT_DIR}" "/usr/local/respdiff-reference-bind/sbin/named"
@@ -1614,7 +1614,7 @@ respdiff:tsan:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -Og -fsanitize=thread"
    LDFLAGS: "-fsanitize=thread"
-    EXTRA_CONFIGURE: "--disable-dnsrps --enable-pthread-rwlock --without-jemalloc"
+    EXTRA_CONFIGURE: "--enable-pthread-rwlock --without-jemalloc PKG_CONFIG_PATH=/opt/tsan/lib/pkgconfig"
    MAX_DISAGREEMENTS_PERCENTAGE: "0.5"
    TSAN_OPTIONS: "${TSAN_OPTIONS_DEBIAN}"
  script:
@@ -1649,7 +1649,7 @@ shotgun:tcp:
  <<: *shotgun_job
  variables:
    SHOTGUN_SCENARIO: tcp
-    SHOTGUN_TRAFFIC_MULTIPLIER: 6
+    SHOTGUN_TRAFFIC_MULTIPLIER: 13
  when: delayed
  start_in: 5 minutes

@@ -1657,7 +1657,7 @@ shotgun:dot:
  <<: *shotgun_job
  variables:
    SHOTGUN_SCENARIO: dot
-    SHOTGUN_TRAFFIC_MULTIPLIER: 3
+    SHOTGUN_TRAFFIC_MULTIPLIER: 6
  when: delayed
  start_in: 5 minutes

@@ -1675,16 +1675,32 @@ shotgun:dot:
    - job: autoreconf
      artifacts: true

-.stress-test-short: &stress_test_short_job
+.stress-test-long: &stress_test_long_job
  <<: *stress_test
  artifacts:
    untracked: true
+    exclude:
+      - "output/ns4/*.dtq*"
+      - "output/ns4/large-delta-rpz*.local"
+      - "output/rpz_*"
+    expire_in: "1 week"
    when: always
+  timeout: 2h
+
+.stress-test-short: &stress_test_short_job
+  <<: *stress_test
  only:
    - merge_requests
+  artifacts:
+    untracked: true
+    exclude:
+      - "output/ns4/*.dtq*"
+      - "output/ns4/large-delta-rpz*.local"
+      - "output/rpz_*"
+    when: always

-stress:short:authoritative:fedora:40:amd64:
-  <<: *fedora_40_amd64_image
+stress:short:authoritative:fedora:41:amd64:
+  <<: *fedora_41_amd64_image
  <<: *linux_amd64
  <<: *stress_test_short_job
  variables:
@@ -1695,8 +1711,8 @@ stress:short:authoritative:fedora:40:amd64:
    RATE: 10000
    RUN_TIME: 15

-stress:short:recursive:fedora:40:amd64:
-  <<: *fedora_40_amd64_image
+stress:short:recursive:fedora:41:amd64:
+  <<: *fedora_41_amd64_image
  <<: *linux_amd64
  <<: *stress_test_short_job
  variables:
@@ -1707,8 +1723,8 @@ stress:short:recursive:fedora:40:amd64:
    RATE: 10000
    RUN_TIME: 15

-stress:short:rpz:fedora:40:amd64:
-  <<: *fedora_40_amd64_image
+stress:short:rpz:fedora:41:amd64:
+  <<: *fedora_41_amd64_image
  <<: *linux_amd64
  <<: *stress_test_short_job
  variables:
@@ -1719,8 +1735,8 @@ stress:short:rpz:fedora:40:amd64:
    RATE: 1500
    RUN_TIME: 15

-stress:short:authoritative:fedora:40:arm64:
-  <<: *fedora_40_arm64_image
+stress:short:authoritative:fedora:41:arm64:
+  <<: *fedora_41_arm64_image
  <<: *linux_arm64
  <<: *stress_test_short_job
  variables:
@@ -1731,8 +1747,8 @@ stress:short:authoritative:fedora:40:arm64:
    RATE: 10000
    RUN_TIME: 15

-stress:short:recursive:fedora:40:arm64:
-  <<: *fedora_40_arm64_image
+stress:short:recursive:fedora:41:arm64:
+  <<: *fedora_41_arm64_image
  <<: *linux_arm64
  <<: *stress_test_short_job
  variables:
@@ -1743,8 +1759,8 @@ stress:short:recursive:fedora:40:arm64:
    RATE: 10000
    RUN_TIME: 15

-stress:short:rpz:fedora:40:arm64:
-  <<: *fedora_40_arm64_image
+stress:short:rpz:fedora:41:arm64:
+  <<: *fedora_41_arm64_image
  <<: *linux_arm64
  <<: *stress_test_short_job
  variables:
@@ -1788,16 +1804,8 @@ stress:short:rpz:freebsd13:amd64:
    RATE: 1500
    RUN_TIME: 15

-.stress-test-long: &stress_test_long_job
-  <<: *stress_test
-  artifacts:
-    untracked: true
-    expire_in: "1 week"
-    when: always
-  timeout: 2h
-
-stress:authoritative:fedora:40:amd64:
-  <<: *fedora_40_amd64_image
+stress:authoritative:fedora:41:amd64:
+  <<: *fedora_41_amd64_image
  <<: *linux_amd64
  <<: *stress_test_long_job
  variables:
@@ -1811,8 +1819,8 @@ stress:authoritative:fedora:40:amd64:
    variables:
      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /authoritative/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)

-stress:recursive:fedora:40:amd64:
-  <<: *fedora_40_amd64_image
+stress:recursive:fedora:41:amd64:
+  <<: *fedora_41_amd64_image
  <<: *linux_amd64
  <<: *stress_test_long_job
  variables:
@@ -1826,8 +1834,8 @@ stress:recursive:fedora:40:amd64:
    variables:
      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /recursive/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)

-stress:rpz:fedora:40:amd64:
-  <<: *fedora_40_amd64_image
+stress:rpz:fedora:41:amd64:
+  <<: *fedora_41_amd64_image
  <<: *linux_amd64
  <<: *stress_test_long_job
  variables:
@@ -1841,8 +1849,8 @@ stress:rpz:fedora:40:amd64:
    variables:
      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /rpz/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)

-stress:authoritative:fedora:40:arm64:
-  <<: *fedora_40_arm64_image
+stress:authoritative:fedora:41:arm64:
+  <<: *fedora_41_arm64_image
  <<: *linux_arm64
  <<: *stress_test_long_job
  variables:
@@ -1856,8 +1864,8 @@ stress:authoritative:fedora:40:arm64:
    variables:
      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /authoritative/i && $BIND_STRESS_TEST_ARCH =~ /arm64/i)

-stress:recursive:fedora:40:arm64:
-  <<: *fedora_40_arm64_image
+stress:recursive:fedora:41:arm64:
+  <<: *fedora_41_arm64_image
  <<: *linux_arm64
  <<: *stress_test_long_job
  variables:
@@ -1871,8 +1879,8 @@ stress:recursive:fedora:40:arm64:
    variables:
      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /recursive/i && $BIND_STRESS_TEST_ARCH =~ /arm64/i)

-stress:rpz:fedora:40:arm64:
-  <<: *fedora_40_arm64_image
+stress:rpz:fedora:41:arm64:
+  <<: *fedora_41_arm64_image
  <<: *linux_arm64
  <<: *stress_test_long_job
  variables:
@@ -1997,23 +2005,46 @@ pairwise:
    variables:
      - $PAIRWISE_TESTING

-backports:
+.post_merge_template: &post_merge
  <<: *base_image
  stage: postmerge
-  rules:
-    - if: '$CI_PIPELINE_SOURCE == "push" && ($CI_COMMIT_REF_NAME =~ /^bind-9.[0-9]+$/ || $CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH)'
+  needs: []
+  # post-merge processes should run even if another MR was merged while the job was running (or queued)
+  interruptible: false
  variables:
    # automated commits will inherit identification from the user who pressed Merge button
    GIT_COMMITTER_NAME: $GITLAB_USER_NAME
    GIT_COMMITTER_EMAIL: $GITLAB_USER_EMAIL
    # avoid leftover branches from previous jobs
    GIT_STRATEGY: clone
-    # assumed max depth of a MR for backport
-    GIT_DEPTH: 200
+    # assumed max depth of a MR for backport or a rebased force-push
+    GIT_DEPTH: 1000
+  before_script:
+    # force-pushes should not trigger process automation (happens only in -sub branches)
+    - >
+      echo "previous branch tip: $CI_COMMIT_BEFORE_SHA"
+    - set +o pipefail; git log --format='%H' | grep --silent "$CI_COMMIT_BEFORE_SHA" && PREVIOUS_TIP_REACHABLE=1
+    - test "$PREVIOUS_TIP_REACHABLE" != "1" && echo "force-push detected, stop" && exit 1
+    # non-fast-forward merges are disabled so we have to have merge commit on top
+    - MERGE_REQUEST_ID="$(git log -1 --format='%b' | sed --silent -e 's/^See merge request [^!]\+!//p')"
+    - >
+      : stop if this is not a merge request
+    - test "$MERGE_REQUEST_ID" -ge 0
+    - git clone --depth 1 https://gitlab.isc.org/isc-projects/bind9-qa.git
+
+backports:
+  <<: *post_merge
+  rules:
+    # -sub branches are handled manually
+    - if: '$CI_PIPELINE_SOURCE == "push" && ($CI_COMMIT_REF_NAME =~ /^bind-9.[0-9]+$/ || $CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH)'
  script:
    # CI job token is not sufficient for push operations
    - git remote get-url origin | sed -e "s/gitlab-ci-token:$CI_JOB_TOKEN/oauth2:$BIND_TEAM_WRITE_TOKEN/" | xargs git remote set-url --push origin
-    # force-pushing is disabled so we have to have merge request on top
-    - MERGE_REQUEST_ID="$(git log -1 --format='%b' | sed --silent -e 's/^See merge request [^!]\+!//p')"
-    - git clone --depth 1 https://gitlab.isc.org/isc-projects/bind9-qa.git
    - bind9-qa/releng/backport_mr.py $CI_PROJECT_ID "$MERGE_REQUEST_ID"
+
+merged-metadata:
+  <<: *post_merge
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "push" && ($CI_COMMIT_REF_NAME =~ /^bind-9.[0-9]+(-sub)?$/ || $CI_COMMIT_REF_NAME =~ /^bind-9.[0-9]+.[0-9]+-release$/ || $CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH)'
+  script:
+    - bind9-qa/releng/after_merge.py "$CI_PROJECT_ID" "$MERGE_REQUEST_ID"
@@ -12,12 +12,14 @@ confidential!
 | Deputy Incident Manager: | @user                                |
 | Public Disclosure Date:  | YYYY-MM-DD                           |
 | CVSS Score:              | [0.0][cvss_score]                    |
+| CWE:                     | [CWE-NNN][cwe_category]
 | Security Advisory:       | isc-private/printing-press!NNN       |
 | Mattermost Channel:      | [CVE-YYYY-NNNN][mattermost_url]      |
 | Support Ticket:          | [URL]                                |
 | Release Checklist:       | #NNNN                                |

 [cvss_score]: https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:X/AC:X/PR:X/UI:X/S:X/C:X/I:X/A:X&version=3.1
+[cwe_category]: https://cwe.mitre.org/data/definitions/NNN.html
 [mattermost_url]:

 :bulb: **Click [here][checklist_explanations] (internal resource) for general information about the security incident handling process.**
@@ -30,12 +32,12 @@ confidential!
  - [ ] [:link:][step_respond]           **(IM)** Respond to the bug reporter
  - [ ] [:link:][step_public_mrs]        **(SwEng)** Ensure there are no public merge requests which inadvertently disclose the issue
  - [ ] [:link:][step_assign_cve_id]     **(IM)** Assign a CVE identifier
-  - [ ] [:link:][step_note_cve_info]     **(SwEng)** Update this issue with the assigned CVE identifier and the CVSS score
+  - [ ] [:link:][step_note_cve_info]     **(SwEng)** Update this issue with the assigned CVE identifier, the CVSS score, and CWE category
  - [ ] [:link:][step_versions_affected] **(SwEng)** Determine the range of product versions affected (including the Subscription Edition)
  - [ ] [:link:][step_workarounds]       **(SwEng)** Determine whether workarounds for the problem exist
  - [ ] [:link:][step_coordinate]        **(SwEng)** If necessary, coordinate with other parties
-  - [ ] [:link:][step_earliest_prepare]  **(Support)** Prepare "earliest" notification text and hand it off to Marketing
-  - [ ] [:link:][step_earliest_send]     **(Marketing)** Update "earliest" notification document in SF portal and send bulk email to earliest customers
+  - [ ] [:link:][step_earliest_prepare]  **(Support)** Prepare "earliest" notification text
+  - [ ] [:link:][step_earliest_send]     **(Support)** Update "earliest" notification ticket in support portal Earliest queue which will notify earliest customers
  - [ ] [:link:][step_advisory_mr]       **(Support)** Create a merge request for the Security Advisory and include all readily available information in it
  - [ ] [:link:][step_reproducer_mr]     **(SwEng)** Prepare a private merge request containing a system test reproducing the problem
  - [ ] [:link:][step_notify_support]    **(SwEng)** Notify Support when a reproducer is ready
@@ -46,18 +48,19 @@ confidential!
  - [ ] [:link:][step_backports]         **(SwEng)** Prepare backports of the merge request addressing the problem for all affected (and still maintained) branches of a given product
  - [ ] [:link:][step_finish_advisory]   **(Support)** Finish preparing the Security Advisory
  - [ ] [:link:][step_meta_issue]        **(QA)** Create (or update) the private issue containing links to fixes & reproducers for all CVEs fixed in a given release cycle
-  - [ ] [:link:][step_changes]           **(QA)** (BIND 9 only) Reserve a block of `CHANGES` placeholders once the complete set of vulnerabilities fixed in a given release cycle is determined
  - [ ] [:link:][step_merge_fixes]       **(QA)** Merge the CVE fixes in CVE identifier order
  - [ ] [:link:][step_patches]           **(QA)** Prepare a standalone patch for the last stable release of each affected (and still maintained) product branch
  - [ ] [:link:][step_asn_releases]      **(QA)** Prepare ASN releases (as outlined in the Release Checklist)

 ### At T-5

-  - [ ] [:link:][step_asn_documents]     **(Marketing)** Update the text on the T-5 (from the Printing Press project) and "earliest" ASN documents in the SF portal
-  - [ ] [:link:][step_asn_links]         **(Marketing)** (BIND 9 only) Update the BIND -S information document in SF with download links to the new versions
-  - [ ] [:link:][step_asn_send]          **(Marketing)** Bulk email eligible customers to check the SF portal
+  - [ ] [:link:][step_asn_links]         **(Marketing)** (BIND 9 only) Update the BIND -S information document in the support portal with download links to the new versions
+  - [ ] [:link:][step_asn_send]          **(Support)** Notify eligible customers by adding a ticket to the 5 Day queue in RT with the text of the advisory (earliest, and T-5)
  - [ ] [:link:][step_preannouncement]   **(Marketing)** (BIND 9 only) Send a pre-announcement email to the *bind-announce* mailing list to alert users that the upcoming release will include security fixes

+### At T-3
+  - [ ] [:link:][step_asn_send]          **(Support)** Notify eligible customers by adding a ticket to the 3 Day queue in RT with the text of the advisory (T-3)
+
 ### At T-1

  - [ ] [:link:][step_packager_emails]   **(First IM)** Send notifications to OS packagers
@@ -72,8 +75,8 @@ confidential!
  - [ ] [:link:][step_mitre]             **(First IM)** Advise MITRE about the disclosed CVEs
  - [ ] [:link:][step_merge_advisory]    **(First IM)** Merge the Security Advisory merge request
  - [ ] [:link:][step_embargo_end]       **(IM)** Inform original reporter (if external) that the security disclosure process is complete
-  - [ ] [:link:][step_asn_clear]         **(Marketing)** Update the SF portal to clear the ASN
-  - [ ] [:link:][step_customers]         **(Marketing)** Email ASN recipients that the embargo is lifted
+  - [ ] [:link:][step_asn_clear]         **(Support)** Update the tickets in the ASN queues in RT that the embargo is lifted
+  - [ ] [:link:][step_customers]         **(Marketing)** Open a ticket in the <software name> Announce queue that the release is published

 ### After Public Disclosure

@@ -83,7 +86,7 @@ confidential!
 [step_respond]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#respond-to-the-bug-reporter
 [step_public_mrs]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#ensure-there-are-no-public-merge-requests-which-inadvertently-disclose-the-issue
 [step_assign_cve_id]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#assign-a-cve-identifier
-[step_note_cve_info]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-this-issue-with-the-assigned-cve-identifier-and-the-cvss-score
+[step_note_cve_info]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-this-issue-with-the-assigned-cve-identifier-the-cvss-score-and-the-cwe-category
 [step_versions_affected]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#determine-the-range-of-product-versions-affected-including-the-subscription-edition
 [step_workarounds]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#determine-whether-workarounds-for-the-problem-exist
 [step_coordinate]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#if-necessary-coordinate-with-other-parties
@@ -1,4 +1,5 @@
 Alan Clegg <aclegg@isc.org>
+Alessio Podda <alessio@isc.org>
 Aram Sargsyan <aram@isc.org>
 Artem Boldariev <artem@isc.org> <artem@boldariev.com>
 Curtis Blackburn <ckb@isc.org> <ckb@freebsd11.local>
@@ -1,4 +1,10 @@
-[MASTER]
+[IMPORTS]
+
+deprecated-modules=
+    dns.resolver,
+
+[MESSAGES CONTROL]
+
 disable=
    C0103, # invalid-name
    C0114, # missing-module-docstring
@@ -6,6 +12,17 @@ disable=
    C0116, # missing-function-docstring
    C0209, # consider-using-f-string
    C0301, # line-too-long, handled better by black
+    C0302, # too-many-lines
    C0415, # import-outside-toplevel
    R0801, # duplicate-code
+    R0901, # too-many-ancestors
+    R0902, # too-many-instance-attributes
    R0903, # too-few-public-methods
+    R0904, # too-many-public-methods
+    R0911, # too-many-return-statements
+    R0912, # too-many-branches
+    R0913, # too-many-arguments
+    R0914, # too-many-locals
+    R0915, # too-many-statements
+    R0916, # too-many-boolean-expressions
+    R0917, # too-many-positional-arguments
@@ -6,6 +6,9 @@ build:
  os: ubuntu-22.04
  tools:
    python: "3.11"
+  jobs:
+    pre_build:
+      - python -m pip install -r https://gitlab.isc.org/isc-projects/bind9/-/raw/main/doc/arm/requirements.txt

 # Build documentation in doc/arm/ with Sphinx
 sphinx:
@@ -13,8 +16,3 @@ sphinx:

 # Build all formats
 formats: all
-
-# Explicitly set the version of Python and its requirements
-python:
-   install:
-   - requirements: doc/arm/requirements.txt
@@ -26,7 +26,6 @@ Files: **/*.after*
       .gitlab/*
       .mailmap
       AUTHORS
-       CHANGES
       COPYRIGHT
       Makefile
       Makefile.*
@@ -74,6 +73,11 @@ Files: **/*.after*
       bin/tests/system/masterfile/knowngood.include
       bin/tests/system/masterfile/knowngood.ttl1
       bin/tests/system/masterfile/knowngood.ttl2
+       bin/tests/system/notify/CA/CA.cfg
+       bin/tests/system/notify/CA/README
+       bin/tests/system/notify/CA/index.txt
+       bin/tests/system/notify/CA/index.txt.attr
+       bin/tests/system/notify/CA/serial
       bin/tests/system/notify/ns4/named.port.in
       bin/tests/system/nsupdate/CA/CA.cfg
       bin/tests/system/nsupdate/CA/README
@@ -191,6 +195,8 @@ Files: **/.clang-format
       .readthedocs.yaml
       .tsan-suppress
       .uncrustify.cfg
+       contrib/gitchangelog/changelog.rc.py
+       contrib/gitchangelog/relnotes.rc.py
       doc/misc/*.zoneopt
       doc/misc/options
       doc/misc/rndc.grammar
@@ -21,7 +21,6 @@ EXTRA_DIST =			\
 	util/bindkeys.pl	\
 	util/dtrace.sh		\
 	contrib			\
-	CHANGES			\
 	COPYRIGHT		\
 	LICENSE			\
 	*.md
@@ -1 +1 @@
-CHANGES
+doc/arm/changelog.rst
@@ -26,4 +26,3 @@ Some of these settings are:
 | `-DISC_MEM_TRACKLINES=0`     | Don't track memory allocations by file and line number; this improves performance but makes debugging more difficult                   |
 | `-DNAMED_RUN_PID_DIR=0`      | Create default PID files in `${localstatedir}/run` rather than `${localstatedir}/run/named/`                                           |
 | `-DNS_CLIENT_DROPPORT=0`     | Disable dropping queries from particular well-known ports                                                                              |
-| `-DOPENSSL_API_COMPAT=10100` | Build using the deprecated OpenSSL APIs so that the `engine` API is available when building with OpenSSL 3.0.0 for PKCS#11 support     |
@@ -20,7 +20,6 @@ information regarding copyright ownership.
 1. [Building BIND](#build)
 1. [Automated testing](#testing)
 1. [Documentation](#doc)
-1. [Change log](#changes)
 1. [Acknowledgments](#ack)

 ### <a name="intro"/> Introduction
@@ -49,8 +48,7 @@ ongoing maintenance and improvement. BIND is open source software
 licensed under the terms of the Mozilla Public License, version 2.0.

 For a detailed list of changes made throughout the history of BIND 9, see
-the file [CHANGES](CHANGES). See [below](#changes) for details on the
-CHANGES file format.
+the [changelog](doc/arm/changelog.rst).

 For up-to-date versions and release notes, see
 [https://www.isc.org/download/](https://www.isc.org/download/).
@@ -163,38 +161,9 @@ can be found in the ISC Knowledgebase at
 Additional information on various subjects can be found in other
 `README` files throughout the source tree.

-### <a name="changes"/> Change log
-
-A detailed list of all changes that have been made throughout the
-development of BIND 9 is included in the file CHANGES, with the most recent
-changes listed first. Change notes include tags indicating the category of
-the change that was made; these categories are:
-
-|Category	|Description	        			|
-|--------------	|-----------------------------------------------|
-| [func] | New feature |
-| [bug] | General bug fix |
-| [security] | Fix for a significant security flaw |
-| [experimental] | Used for new features when the syntax or other aspects of the design are still in flux and may change |
-| [port] | Portability enhancement |
-| [maint] | Updates to built-in data such as root server addresses and keys |
-| [tuning] | Changes to built-in configuration defaults and constants to improve performance |
-| [performance] | Other changes to improve server performance |
-| [protocol] | Updates to the DNS protocol such as new RR types |
-| [test] | Changes to the automatic tests, not affecting server functionality |
-| [cleanup] | Minor corrections and refactoring |
-| [doc] | Documentation |
-| [contrib] | Changes to the contributed tools and libraries in the 'contrib' subdirectory |
-| [placeholder] | Used in the main development branch to reserve change numbers for use in other branches, e.g., when fixing a bug that only exists in older releases |
-
-In general, [func] and [experimental] tags only appear in new-feature
-releases (i.e., those with version numbers ending in zero). Some new
-functionality may be backported to older releases on a case-by-case basis.
-All other change types may be applied to all currently supported releases.
-
 #### Bug report identifiers

-Most notes in the CHANGES file include a reference to a bug report or
+Most notes in the ARM Changelog appendix include a reference to a bug report or
 issue number. Prior to 2018, these were usually of the form `[RT #NNN]`
 and referred to entries in the "bind9-bugs" RT database, which was not open
 to the public. More recent entries use the form `[GL #NNN]` or, less often,
@@ -33,7 +33,6 @@
 #include <dns/db.h>
 #include <dns/dbiterator.h>
 #include <dns/fixedname.h>
-#include <dns/log.h>
 #include <dns/name.h>
 #include <dns/rdata.h>
 #include <dns/rdataclass.h>
@@ -43,10 +42,6 @@
 #include <dns/types.h>
 #include <dns/zone.h>

-#include <isccfg/log.h>
-
-#include <ns/log.h>
-
 #include "check-tool.h"

 #ifndef CHECK_SIBLING
@@ -97,13 +92,6 @@ dns_zoneopt_t zone_options = DNS_ZONEOPT_CHECKNS | DNS_ZONEOPT_CHECKMX |
 			     DNS_ZONEOPT_CHECKSVCB | DNS_ZONEOPT_CHECKWILDCARD |
 			     DNS_ZONEOPT_WARNMXCNAME | DNS_ZONEOPT_WARNSRVCNAME;

-/*
- * This needs to match the list in bin/named/log.c.
- */
-static isc_logcategory_t categories[] = { { "", 0 },
-					  { "unmatched", 0 },
-					  { NULL, 0 } };
-
 static isc_symtab_t *symtab = NULL;
 static isc_mem_t *sym_mctx;

@@ -146,14 +134,14 @@ logged(char *key, int value) {
 	isc_result_t result;

 	if (symtab == NULL) {
-		return (false);
+		return false;
 	}

 	result = isc_symtab_lookup(symtab, key, value, NULL);
 	if (result == ISC_R_SUCCESS) {
-		return (true);
+		return true;
 	}
-	return (false);
+	return false;
 }

 static bool
@@ -177,7 +165,7 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 		aaaa->type == dns_rdatatype_aaaa);

 	if (a == NULL || aaaa == NULL) {
-		return (answer);
+		return answer;
 	}

 	memset(&hints, 0, sizeof(hints));
@@ -234,7 +222,7 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 			add(namebuf, ERR_NO_ADDRESSES);
 		}
 		/* XXX950 make fatal for 9.5.0 */
-		return (true);
+		return true;

 	default:
 		if (!logged(namebuf, ERR_LOOKUP_FAILURE)) {
@@ -243,7 +231,7 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 				     gai_strerror(result));
 			add(namebuf, ERR_LOOKUP_FAILURE);
 		}
-		return (true);
+		return true;
 	}

 	/*
@@ -371,7 +359,7 @@ checkmissing:
 		}
 	}
 	freeaddrinfo(ai);
-	return (answer);
+	return answer;
 }

 static bool
@@ -434,7 +422,7 @@ checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 			}
 		}
 		freeaddrinfo(ai);
-		return (answer);
+		return answer;

 	case EAI_NONAME:
 #if defined(EAI_NODATA) && (EAI_NODATA != EAI_NONAME)
@@ -448,7 +436,7 @@ checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 			add(namebuf, ERR_NO_ADDRESSES);
 		}
 		/* XXX950 make fatal for 9.5.0. */
-		return (true);
+		return true;

 	default:
 		if (!logged(namebuf, ERR_LOOKUP_FAILURE)) {
@@ -457,7 +445,7 @@ checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 				     gai_strerror(result));
 			add(namebuf, ERR_LOOKUP_FAILURE);
 		}
-		return (true);
+		return true;
 	}
 }

@@ -521,7 +509,7 @@ checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 			}
 		}
 		freeaddrinfo(ai);
-		return (answer);
+		return answer;

 	case EAI_NONAME:
 #if defined(EAI_NODATA) && (EAI_NODATA != EAI_NONAME)
@@ -535,7 +523,7 @@ checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 			add(namebuf, ERR_NO_ADDRESSES);
 		}
 		/* XXX950 make fatal for 9.5.0. */
-		return (true);
+		return true;

 	default:
 		if (!logged(namebuf, ERR_LOOKUP_FAILURE)) {
@@ -544,36 +532,19 @@ checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 				     gai_strerror(result));
 			add(namebuf, ERR_LOOKUP_FAILURE);
 		}
-		return (true);
+		return true;
 	}
 }

 isc_result_t
-setup_logging(isc_mem_t *mctx, FILE *errout, isc_log_t **logp) {
-	isc_logdestination_t destination;
-	isc_logconfig_t *logconfig = NULL;
-	isc_log_t *log = NULL;
+setup_logging(FILE *errout) {
+	isc_logconfig_t *logconfig = isc_logconfig_get();
+	isc_log_createandusechannel(
+		logconfig, "default_stderr", ISC_LOG_TOFILEDESC,
+		ISC_LOG_DYNAMIC, ISC_LOGDESTINATION_FILE(errout), 0,
+		ISC_LOGCATEGORY_DEFAULT, ISC_LOGMODULE_DEFAULT);

-	isc_log_create(mctx, &log, &logconfig);
-	isc_log_registercategories(log, categories);
-	isc_log_setcontext(log);
-	dns_log_init(log);
-	dns_log_setcontext(log);
-	cfg_log_init(log);
-	ns_log_init(log);
-
-	destination.file.stream = errout;
-	destination.file.name = NULL;
-	destination.file.versions = ISC_LOG_ROLLNEVER;
-	destination.file.maximum_size = 0;
-	isc_log_createchannel(logconfig, "stderr", ISC_LOG_TOFILEDESC,
-			      ISC_LOG_DYNAMIC, &destination, 0);
-
-	RUNTIME_CHECK(isc_log_usechannel(logconfig, "stderr", NULL, NULL) ==
-		      ISC_R_SUCCESS);
-
-	*logp = log;
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 /*% load the zone */
@@ -648,7 +619,7 @@ cleanup:
 	if (zone != NULL) {
 		dns_zone_detach(&zone);
 	}
-	return (result);
+	return result;
 }

 /*% dump the zone */
@@ -679,7 +650,7 @@ dump_zone(const char *zonename, dns_zone_t *zone, const char *filename,
 				"could not open output "
 				"file \"%s\" for writing\n",
 				filename);
-			return (ISC_R_FAILURE);
+			return ISC_R_FAILURE;
 		}
 	}

@@ -689,5 +660,5 @@ dump_zone(const char *zonename, dns_zone_t *zone, const char *filename,
 		(void)isc_stdio_close(output);
 	}

-	return (result);
+	return result;
 }
@@ -29,7 +29,7 @@
 ISC_LANG_BEGINDECLS

 isc_result_t
-setup_logging(isc_mem_t *mctx, FILE *errout, isc_log_t **logp);
+setup_logging(FILE *errout);

 isc_result_t
 load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,
@@ -30,7 +30,6 @@

 #include <dns/db.h>
 #include <dns/fixedname.h>
-#include <dns/log.h>
 #include <dns/name.h>
 #include <dns/rdataclass.h>
 #include <dns/rootns.h>
@@ -44,8 +43,6 @@

 static const char *program = "named-checkconf";

-isc_log_t *logc = NULL;
-
 #define CHECK(r)                             \
 	do {                                 \
 		result = (r);                \
@@ -54,7 +51,7 @@ isc_log_t *logc = NULL;
 	} while (0)

 /*% usage */
-noreturn static void
+ISC_NORETURN static void
 usage(void);

 static void
@@ -83,13 +80,13 @@ directory_callback(const char *clausename, const cfg_obj_t *obj, void *arg) {
 	directory = cfg_obj_asstring(obj);
 	result = isc_dir_chdir(directory);
 	if (result != ISC_R_SUCCESS) {
-		cfg_obj_log(obj, logc, ISC_LOG_ERROR,
+		cfg_obj_log(obj, ISC_LOG_ERROR,
 			    "change directory to '%s' failed: %s\n", directory,
 			    isc_result_totext(result));
-		return (result);
+		return result;
 	}

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static bool
@@ -97,10 +94,10 @@ get_maps(const cfg_obj_t **maps, const char *name, const cfg_obj_t **obj) {
 	int i;
 	for (i = 0;; i++) {
 		if (maps[i] == NULL) {
-			return (false);
+			return false;
 		}
 		if (cfg_map_get(maps[i], name, obj) == ISC_R_SUCCESS) {
-			return (true);
+			return true;
 		}
 	}
 }
@@ -116,7 +113,7 @@ get_checknames(const cfg_obj_t **maps, const cfg_obj_t **obj) {

 	for (i = 0;; i++) {
 		if (maps[i] == NULL) {
-			return (false);
+			return false;
 		}
 		checknames = NULL;
 		result = cfg_map_get(maps[i], "check-names", &checknames);
@@ -125,7 +122,7 @@ get_checknames(const cfg_obj_t **maps, const cfg_obj_t **obj) {
 		}
 		if (checknames != NULL && !cfg_obj_islist(checknames)) {
 			*obj = checknames;
-			return (true);
+			return true;
 		}
 		for (element = cfg_list_first(checknames); element != NULL;
 		     element = cfg_list_next(element))
@@ -139,7 +136,7 @@ get_checknames(const cfg_obj_t **maps, const cfg_obj_t **obj) {
 				continue;
 			}
 			*obj = cfg_tuple_get(value, "mode");
-			return (true);
+			return true;
 		}
 	}
 }
@@ -152,23 +149,23 @@ configure_hint(const char *zfile, const char *zclass, isc_mem_t *mctx) {
 	isc_textregion_t r;

 	if (zfile == NULL) {
-		return (ISC_R_FAILURE);
+		return ISC_R_FAILURE;
 	}

 	r.base = UNCONST(zclass);
 	r.length = strlen(zclass);
 	result = dns_rdataclass_fromtext(&rdclass, &r);
 	if (result != ISC_R_SUCCESS) {
-		return (result);
+		return result;
 	}

 	result = dns_rootns_create(mctx, rdclass, zfile, &db);
 	if (result != ISC_R_SUCCESS) {
-		return (result);
+		return result;
 	}

 	dns_db_detach(&db);
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 /*% configure the zone */
@@ -224,18 +221,18 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 		printf("%s %s %s in-view %s\n", zname, zclass, view, inview);
 	}
 	if (inviewobj != NULL) {
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	cfg_map_get(zoptions, "type", &typeobj);
 	if (typeobj == NULL) {
-		return (ISC_R_FAILURE);
+		return ISC_R_FAILURE;
 	}

 	if (list) {
 		const char *ztype = cfg_obj_asstring(typeobj);
 		printf("%s %s %s %s\n", zname, zclass, view, ztype);
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	/*
@@ -245,12 +242,12 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 	if (dbobj != NULL &&
 	    strcmp(ZONEDB_DEFAULT, cfg_obj_asstring(dbobj)) != 0)
 	{
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	cfg_map_get(zoptions, "dlz", &dlzobj);
 	if (dlzobj != NULL) {
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	cfg_map_get(zoptions, "file", &fileobj);
@@ -264,12 +261,12 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 	 * master and redirect
 	 */
 	if (strcasecmp(cfg_obj_asstring(typeobj), "hint") == 0) {
-		return (configure_hint(zfile, zclass, mctx));
+		return configure_hint(zfile, zclass, mctx);
 	} else if ((strcasecmp(cfg_obj_asstring(typeobj), "primary") != 0) &&
 		   (strcasecmp(cfg_obj_asstring(typeobj), "master") != 0) &&
 		   (strcasecmp(cfg_obj_asstring(typeobj), "redirect") != 0))
 	{
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	/*
@@ -282,12 +279,12 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 		}

 		if (primariesobj != NULL) {
-			return (ISC_R_SUCCESS);
+			return ISC_R_SUCCESS;
 		}
 	}

 	if (zfile == NULL) {
-		return (ISC_R_FAILURE);
+		return ISC_R_FAILURE;
 	}

 	obj = NULL;
@@ -465,7 +462,7 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 		fprintf(stderr, "%s/%s/%s: %s\n", view, zname, zclass,
 			isc_result_totext(result));
 	}
-	return (result);
+	return result;
 }

 /*% configure a view */
@@ -500,7 +497,7 @@ configure_view(const char *vclass, const char *view, const cfg_obj_t *config,
 			result = tresult;
 		}
 	}
-	return (result);
+	return result;
 }

 static isc_result_t
@@ -510,11 +507,11 @@ config_getclass(const cfg_obj_t *classobj, dns_rdataclass_t defclass,

 	if (!cfg_obj_isstring(classobj)) {
 		*classp = defclass;
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}
 	r.base = UNCONST(cfg_obj_asstring(classobj));
 	r.length = strlen(r.base);
-	return (dns_rdataclass_fromtext(classp, &r));
+	return dns_rdataclass_fromtext(classp, &r);
 }

 /*% load zones from the configuration */
@@ -572,7 +569,7 @@ load_zones_fromconfig(const cfg_obj_t *config, isc_mem_t *mctx,
 	}

 cleanup:
-	return (result);
+	return result;
 }

 static void
@@ -593,11 +590,11 @@ main(int argc, char **argv) {
 	const char *conffile = NULL;
 	isc_mem_t *mctx = NULL;
 	isc_result_t result = ISC_R_SUCCESS;
-	bool cleanup_dst = true;
 	bool load_zones = false;
 	bool list_zones = false;
 	bool print = false;
 	bool nodeprecate = false;
+	bool allconfigs = false;
 	unsigned int flags = 0;
 	unsigned int checkflags = BIND_CHECK_PLUGINS | BIND_CHECK_ALGORITHMS;

@@ -606,7 +603,7 @@ main(int argc, char **argv) {
 	/*
 	 * Process memory debugging argument first.
 	 */
-#define CMDLINE_FLAGS "acdhijlm:t:pvxz"
+#define CMDLINE_FLAGS "acdhijlm:nt:pvxz"
 	while ((c = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (c) {
 		case 'm':
@@ -660,6 +657,10 @@ main(int argc, char **argv) {
 		case 'm':
 			break;

+		case 'n':
+			allconfigs = true;
+			break;
+
 		case 't':
 			result = isc_dir_chroot(isc_commandline_argument);
 			if (result != ISC_R_SUCCESS) {
@@ -726,20 +727,20 @@ main(int argc, char **argv) {
 		conffile = NAMED_CONFFILE;
 	}

-	CHECK(setup_logging(mctx, stdout, &logc));
+	CHECK(setup_logging(stdout));

-	CHECK(dst_lib_init(mctx, NULL));
-	cleanup_dst = true;
-
-	CHECK(cfg_parser_create(mctx, logc, &parser));
+	CHECK(cfg_parser_create(mctx, &parser));

 	if (nodeprecate) {
 		cfg_parser_setflags(parser, CFG_PCTX_NODEPRECATED, true);
 	}
+	if (allconfigs) {
+		cfg_parser_setflags(parser, CFG_PCTX_ALLCONFIGS, true);
+	}
 	cfg_parser_setcallback(parser, directory_callback, NULL);

 	CHECK(cfg_parse_file(parser, conffile, &cfg_type_namedconf, &config));
-	CHECK(isccfg_check_namedconf(config, checkflags, logc, mctx));
+	CHECK(isccfg_check_namedconf(config, checkflags, mctx));
 	if (load_zones || list_zones) {
 		CHECK(load_zones_fromconfig(config, mctx, list_zones));
 	}
@@ -757,17 +758,9 @@ cleanup:
 		cfg_parser_destroy(&parser);
 	}

-	if (cleanup_dst) {
-		dst_lib_destroy();
-	}
-
-	if (logc != NULL) {
-		isc_log_destroy(&logc);
-	}
-
 	if (mctx != NULL) {
 		isc_mem_destroy(&mctx);
 	}

-	return (result == ISC_R_SUCCESS ? 0 : 1);
+	return result == ISC_R_SUCCESS ? 0 : 1;
 }
@@ -21,7 +21,7 @@ named-checkconf - named configuration file syntax checking tool
 Synopsis
 ~~~~~~~~

-:program:`named-checkconf` [**-achjlvz**] [**-p** [**-x** ]] [**-t** directory] {filename}
+:program:`named-checkconf` [**-achjlnvz**] [**-p** [**-x** ]] [**-t** directory] {filename}

 Description
 ~~~~~~~~~~~
@@ -71,6 +71,12 @@ Options

   This option ignores warnings on deprecated options.

+.. option:: -n
+
+   Do not print errors when encountering options that are disabled in
+   this build. This allows checking of configuration files for other
+   builds, in which those options are enabled.
+
 .. option:: -p

   This option prints out the :iscman:`named.conf` and included files in canonical form if
@@ -31,7 +31,6 @@

 #include <dns/db.h>
 #include <dns/fixedname.h>
-#include <dns/log.h>
 #include <dns/master.h>
 #include <dns/masterdump.h>
 #include <dns/name.h>
@@ -62,7 +61,7 @@ static enum { progmode_check, progmode_compile } progmode;
 		}                                                             \
 	} while (0)

-noreturn static void
+ISC_NORETURN static void
 usage(void);

 static void
@@ -95,7 +94,6 @@ main(int argc, char **argv) {
 	int c;
 	char *origin = NULL;
 	const char *filename = NULL;
-	isc_log_t *lctx = NULL;
 	isc_result_t result;
 	char classname_in[] = "IN";
 	char *classname = classname_in;
@@ -161,7 +159,7 @@ main(int argc, char **argv) {

 	while ((c = isc_commandline_parse(argc, argv,
 					  "c:df:hi:jJ:k:L:l:m:n:qr:s:t:o:vw:C:"
-					  "DF:M:S:T:W:")) != EOF)
+					  "DF:M:R:S:T:W:")) != EOF)
 	{
 		switch (c) {
 		case 'c':
@@ -325,6 +323,18 @@ main(int argc, char **argv) {
 			}
 			break;

+		case 'R':
+			if (ARGCMP("fail")) {
+				zone_options |= DNS_ZONEOPT_LOGREPORTS;
+			} else if (ARGCMP("ignore")) {
+				zone_options &= ~DNS_ZONEOPT_LOGREPORTS;
+			} else {
+				fprintf(stderr, "invalid argument to -R: %s\n",
+					isc_commandline_argument);
+				exit(EXIT_FAILURE);
+			}
+			break;
+
 		case 's':
 			if (ARGCMP("full")) {
 				outputstyle = &dns_master_style_full;
@@ -525,8 +535,7 @@ main(int argc, char **argv) {

 	isc_mem_create(&mctx);
 	if (!quiet) {
-		RUNTIME_CHECK(setup_logging(mctx, errout, &lctx) ==
-			      ISC_R_SUCCESS);
+		RUNTIME_CHECK(setup_logging(errout) == ISC_R_SUCCESS);
 	}

 	origin = argv[isc_commandline_index++];
@@ -566,10 +575,7 @@ main(int argc, char **argv) {
 		fprintf(errout, "OK\n");
 	}
 	destroy();
-	if (lctx != NULL) {
-		isc_log_destroy(&lctx);
-	}
 	isc_mem_destroy(&mctx);

-	return ((result == ISC_R_SUCCESS) ? 0 : 1);
+	return (result == ISC_R_SUCCESS) ? 0 : 1;
 }
@@ -23,7 +23,7 @@ named-checkzone - zone file validation tool
 Synopsis
 ~~~~~~~~

-:program:`named-checkzone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-C** mode] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-o** filename] [**-r** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {zonename} {filename}
+:program:`named-checkzone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-C** mode] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-o** filename] [**-r** mode] [**-R** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {zonename} {filename}

 Description
 ~~~~~~~~~~~
@@ -166,6 +166,12 @@ Options
   semantically equal in plain DNS. Possible modes are ``fail``,
   ``warn`` (the default), and ``ignore``.

+.. option:: -R mode
+
+   This option checks whether a TXT wildcard record exists that
+   matches the name format for RFC 9567 error-reporting queries: ``*._er``.
+   Possible modes are ``fail`` and ``ignore`` (the default).
+
 .. option:: -s style

   This option specifies the style of the dumped zone file. Possible styles are
@@ -23,7 +23,7 @@ named-compilezone - zone file converting tool
 Synopsis
 ~~~~~~~~

-:program:`named-compilezone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-C** mode] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-r** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {**-o** filename} {zonename} {filename}
+:program:`named-compilezone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-C** mode] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-r** mode] [**-R** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {**-o** filename} {zonename} {filename}

 Description
 ~~~~~~~~~~~
@@ -175,6 +175,12 @@ Options
   semantically equal in plain DNS. Possible modes are ``fail``,
   ``warn``, and ``ignore`` (the default).

+.. option:: -R mode
+
+   This option checks whether a TXT wildcard record exists that
+   matches the name format for RFC 9567 error-reporting queries: ``*._er``.
+   Possible modes are ``fail`` and ``ignore`` (the default).
+
 .. option:: -s style

   This option specifies the style of the dumped zone file. Possible styles are
@@ -44,24 +44,24 @@ alg_fromtext(const char *name) {
 	}

 	if (strcasecmp(p, "md5") == 0) {
-		return (DST_ALG_HMACMD5);
+		return DST_ALG_HMACMD5;
 	}
 	if (strcasecmp(p, "sha1") == 0) {
-		return (DST_ALG_HMACSHA1);
+		return DST_ALG_HMACSHA1;
 	}
 	if (strcasecmp(p, "sha224") == 0) {
-		return (DST_ALG_HMACSHA224);
+		return DST_ALG_HMACSHA224;
 	}
 	if (strcasecmp(p, "sha256") == 0) {
-		return (DST_ALG_HMACSHA256);
+		return DST_ALG_HMACSHA256;
 	}
 	if (strcasecmp(p, "sha384") == 0) {
-		return (DST_ALG_HMACSHA384);
+		return DST_ALG_HMACSHA384;
 	}
 	if (strcasecmp(p, "sha512") == 0) {
-		return (DST_ALG_HMACSHA512);
+		return DST_ALG_HMACSHA512;
 	}
-	return (DST_ALG_UNKNOWN);
+	return DST_ALG_UNKNOWN;
 }

 /*%
@@ -71,19 +71,19 @@ int
 alg_bits(dns_secalg_t alg) {
 	switch (alg) {
 	case DST_ALG_HMACMD5:
-		return (128);
+		return 128;
 	case DST_ALG_HMACSHA1:
-		return (160);
+		return 160;
 	case DST_ALG_HMACSHA224:
-		return (224);
+		return 224;
 	case DST_ALG_HMACSHA256:
-		return (256);
+		return 256;
 	case DST_ALG_HMACSHA384:
-		return (384);
+		return 384;
 	case DST_ALG_HMACSHA512:
-		return (512);
+		return 512;
 	default:
-		return (0);
+		return 0;
 	}
 }

@@ -120,8 +120,6 @@ generate_key(isc_mem_t *mctx, dns_secalg_t alg, int keysize,
 		fatal("unsupported algorithm %d\n", alg);
 	}

-	DO("initialize dst library", dst_lib_init(mctx, NULL));
-
 	DO("generate key",
 	   dst_key_generate(dns_rootname, alg, keysize, 0, 0, DNS_KEYPROTO_ANY,
 			    dns_rdataclass_in, NULL, mctx, &key, NULL));
@@ -132,14 +130,12 @@ generate_key(isc_mem_t *mctx, dns_secalg_t alg, int keysize,

 	isc_buffer_usedregion(&key_rawbuffer, &key_rawregion);

-	DO("bsse64 encode secret",
+	DO("base64 encode secret",
 	   isc_base64_totext(&key_rawregion, -1, "", key_txtbuffer));

 	if (key != NULL) {
 		dst_key_free(&key);
 	}
-
-	dst_lib_destroy();
 }

 /*%
@@ -30,7 +30,7 @@ set_user(FILE *fd, const char *user) {
 	pw = getpwnam(user);
 	if (pw == NULL) {
 		errno = EINVAL;
-		return (-1);
+		return -1;
 	}
-	return (fchown(fileno(fd), pw->pw_uid, -1));
+	return fchown(fileno(fd), pw->pw_uid, -1);
 }
@@ -60,7 +60,7 @@ bool verbose = false;

 const char *keyfile, *keydef;

-noreturn static void
+ISC_NORETURN static void
 usage(int status);

 static void
@@ -290,5 +290,5 @@ options {\n\

 	isc_mem_destroy(&mctx);

-	return (0);
+	return 0;
 }
@@ -53,7 +53,7 @@ const char *progname;
 static enum { progmode_keygen, progmode_confgen } progmode;
 bool verbose = false; /* needed by util.c but not used here */

-noreturn static void
+ISC_NORETURN static void
 usage(int status);

 static void
@@ -296,5 +296,5 @@ nsupdate -k <keyfile>\n");

 	isc_mem_destroy(&mctx);

-	return (0);
+	return 0;
 }
@@ -36,7 +36,7 @@ ISC_LANG_BEGINDECLS
 void
 notify(const char *fmt, ...) ISC_FORMAT_PRINTF(1, 2);

-noreturn void
+ISC_NORETURN void
 fatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);

 ISC_LANG_ENDDECLS
@@ -5,7 +5,8 @@ AM_CPPFLAGS +=				\
 	$(LIBISC_CFLAGS)		\
 	$(LIBDNS_CFLAGS)		\
 	$(LIBNS_CFLAGS)			\
-	$(LIBISCCFG_CFLAGS)
+	$(LIBISCCFG_CFLAGS)		\
+	$(OPENSSL_CFLAGS)

 AM_CPPFLAGS +=				\
 	-DSYSCONFDIR=\"${sysconfdir}\"
@@ -19,4 +20,5 @@ delv_LDADD =				\
 	$(LIBISC_LIBS)			\
 	$(LIBDNS_LIBS)			\
 	$(LIBNS_LIBS)			\
-	$(LIBISCCFG_LIBS)
+	$(LIBISCCFG_LIBS)		\
+	$(OPENSSL_LIBS)
@@ -25,10 +25,17 @@
 #include <sys/types.h>
 #include <unistd.h>

+#include <openssl/opensslv.h>
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#include <openssl/err.h>
+#include <openssl/provider.h>
+#endif
+
 #include <isc/async.h>
 #include <isc/attributes.h>
 #include <isc/base64.h>
 #include <isc/buffer.h>
+#include <isc/fips.h>
 #include <isc/hex.h>
 #include <isc/log.h>
 #include <isc/managers.h>
@@ -52,7 +59,6 @@
 #include <dns/fixedname.h>
 #include <dns/keytable.h>
 #include <dns/keyvalues.h>
-#include <dns/log.h>
 #include <dns/masterdump.h>
 #include <dns/message.h>
 #include <dns/name.h>
@@ -70,7 +76,6 @@

 #include <dst/dst.h>

-#include <isccfg/log.h>
 #include <isccfg/namedconf.h>

 #include <ns/client.h>
@@ -88,10 +93,13 @@

 #define MAXNAME (DNS_NAME_MAXTEXT + 1)

+#define MAX_QUERIES  50
+#define MAX_TOTAL    200
+#define MAX_RESTARTS 11
+
 /* Variables used internally by delv. */
 char *progname = NULL;
 static isc_mem_t *mctx = NULL;
-static isc_log_t *lctx = NULL;
 static dns_view_t *view = NULL;
 static ns_server_t *sctx = NULL;
 static ns_interface_t *ifp = NULL;
@@ -130,6 +138,10 @@ static bool showcomments = true, showdnssec = true, showtrust = true,
 	    multiline = false, short_form = false, print_unknown_format = false,
 	    yaml = false, fulltrace = false;

+static uint32_t maxqueries = MAX_QUERIES;
+static uint32_t maxtotal = MAX_TOTAL;
+static uint32_t restarts = MAX_RESTARTS;
+
 static bool resolve_trace = false, validator_trace = false,
 	    message_trace = false, send_trace = false;

@@ -153,6 +165,10 @@ static dns_fixedname_t qfn;
 /* Default trust anchors */
 static char anchortext[] = TRUST_ANCHORS;

+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+static OSSL_PROVIDER *fips = NULL, *base = NULL;
+#endif
+
 /*
 * Static function prototypes
 */
@@ -250,7 +266,7 @@ usage(void) {
 	exit(EXIT_FAILURE);
 }

-noreturn static void
+ISC_NORETURN static void
 fatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);

 static void
@@ -281,12 +297,6 @@ warn(const char *format, ...) {
 	fprintf(stderr, "\n");
 }

-static isc_logcategory_t categories[] = { { "delv", 0 }, { NULL, 0 } };
-#define LOGCATEGORY_DEFAULT (&categories[0])
-#define LOGMODULE_DEFAULT   (&modules[0])
-
-static isc_logmodule_t modules[] = { { "delv", 0 }, { NULL, 0 } };
-
 static void
 delv_log(int level, const char *fmt, ...) ISC_FORMAT_PRINTF(2, 3);

@@ -295,15 +305,15 @@ delv_log(int level, const char *fmt, ...) {
 	va_list ap;
 	char msgbuf[2048];

-	if (!isc_log_wouldlog(lctx, level)) {
+	if (!isc_log_wouldlog(level)) {
 		return;
 	}

 	va_start(ap, fmt);

 	vsnprintf(msgbuf, sizeof(msgbuf), fmt, ap);
-	isc_log_write(lctx, LOGCATEGORY_DEFAULT, LOGMODULE_DEFAULT, level, "%s",
-		      msgbuf);
+	isc_log_write(DELV_LOGCATEGORY_DEFAULT, DELV_LOGMODULE_DEFAULT, level,
+		      "%s", msgbuf);
 	va_end(ap);
 }

@@ -311,76 +321,45 @@ static int loglevel = 0;

 static void
 setup_logging(FILE *errout) {
-	isc_result_t result;
-	isc_logdestination_t destination;
-	isc_logconfig_t *logconfig = NULL;
 	int packetlevel = 10;

-	isc_log_create(mctx, &lctx, &logconfig);
-	isc_log_registercategories(lctx, categories);
-	isc_log_registermodules(lctx, modules);
-	isc_log_setcontext(lctx);
-	dns_log_init(lctx);
-	dns_log_setcontext(lctx);
-	cfg_log_init(lctx);
+	isc_log_setdebuglevel(loglevel);

-	destination.file.stream = errout;
-	destination.file.name = NULL;
-	destination.file.versions = ISC_LOG_ROLLNEVER;
-	destination.file.maximum_size = 0;
-	isc_log_createchannel(logconfig, "stderr", ISC_LOG_TOFILEDESC,
-			      ISC_LOG_DYNAMIC, &destination,
-			      ISC_LOG_PRINTPREFIX);
+	isc_logconfig_t *logconfig = isc_logconfig_get();

-	isc_log_setdebuglevel(lctx, loglevel);
 	isc_log_settag(logconfig, ";; ");

-	result = isc_log_usechannel(logconfig, "stderr",
-				    ISC_LOGCATEGORY_DEFAULT, NULL);
-	if (result != ISC_R_SUCCESS) {
-		fatal("Couldn't attach to log channel 'stderr'");
-	}
+	isc_log_createandusechannel(
+		logconfig, "default_stderr", ISC_LOG_TOFILEDESC,
+		ISC_LOG_DYNAMIC, ISC_LOGDESTINATION_FILE(errout),
+		ISC_LOG_PRINTPREFIX, ISC_LOGCATEGORY_DEFAULT,
+		ISC_LOGMODULE_DEFAULT);

 	if (resolve_trace && loglevel < 1) {
-		isc_log_createchannel(logconfig, "resolver", ISC_LOG_TOFILEDESC,
-				      ISC_LOG_DEBUG(1), &destination,
-				      ISC_LOG_PRINTPREFIX);
-
-		result = isc_log_usechannel(logconfig, "resolver",
-					    DNS_LOGCATEGORY_RESOLVER,
-					    DNS_LOGMODULE_RESOLVER);
-		if (result != ISC_R_SUCCESS) {
-			fatal("Couldn't attach to log channel 'resolver'");
-		}
+		isc_log_createandusechannel(
+			logconfig, "resolver", ISC_LOG_TOFILEDESC,
+			ISC_LOG_DEBUG(1), ISC_LOGDESTINATION_FILE(errout),
+			ISC_LOG_PRINTPREFIX, DNS_LOGCATEGORY_RESOLVER,
+			DNS_LOGMODULE_RESOLVER);
 	}

 	if (validator_trace && loglevel < 3) {
-		isc_log_createchannel(logconfig, "validator",
-				      ISC_LOG_TOFILEDESC, ISC_LOG_DEBUG(3),
-				      &destination, ISC_LOG_PRINTPREFIX);
-
-		result = isc_log_usechannel(logconfig, "validator",
-					    DNS_LOGCATEGORY_DNSSEC,
-					    DNS_LOGMODULE_VALIDATOR);
-		if (result != ISC_R_SUCCESS) {
-			fatal("Couldn't attach to log channel 'validator'");
-		}
+		isc_log_createandusechannel(
+			logconfig, "validator", ISC_LOG_TOFILEDESC,
+			ISC_LOG_DEBUG(3), ISC_LOGDESTINATION_FILE(errout),
+			ISC_LOG_PRINTPREFIX, DNS_LOGCATEGORY_DNSSEC,
+			DNS_LOGMODULE_VALIDATOR);
 	}

 	if (send_trace) {
 		packetlevel = 11;
 	}
 	if ((message_trace || send_trace) && loglevel < packetlevel) {
-		isc_log_createchannel(logconfig, "messages", ISC_LOG_TOFILEDESC,
-				      ISC_LOG_DEBUG(packetlevel), &destination,
-				      ISC_LOG_PRINTPREFIX);
-
-		result = isc_log_usechannel(logconfig, "messages",
-					    DNS_LOGCATEGORY_RESOLVER,
-					    DNS_LOGMODULE_PACKETS);
-		if (result != ISC_R_SUCCESS) {
-			fatal("Couldn't attach to log channel 'messagse'");
-		}
+		isc_log_createandusechannel(
+			logconfig, "messages", ISC_LOG_TOFILEDESC,
+			ISC_LOG_DEBUG(packetlevel),
+			ISC_LOGDESTINATION_FILE(errout), ISC_LOG_PRINTPREFIX,
+			DNS_LOGCATEGORY_RESOLVER, DNS_LOGMODULE_PACKETS);
 	}
 }

@@ -600,7 +579,7 @@ setup_style(void) {
 						48, 80, 8, splitwidth, mctx);
 	}

-	return (result);
+	return result;
 }

 static isc_result_t
@@ -621,11 +600,11 @@ convert_name(dns_fixedname_t *fn, dns_name_t **name, const char *text) {
 	if (result != ISC_R_SUCCESS) {
 		delv_log(ISC_LOG_ERROR, "failed to convert name %s: %s", text,
 			 isc_result_totext(result));
-		return (result);
+		return result;
 	}

 	*name = n;
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static isc_result_t
@@ -658,7 +637,7 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client, dns_view_t *toview) {
 	CHECK(convert_name(&fkeyname, &keyname, keynamestr));

 	if (!root_validation) {
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	if (anchor_name) {
@@ -666,11 +645,11 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client, dns_view_t *toview) {
 	}

 	if (!match_root) {
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	if (!root_validation) {
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	delv_log(ISC_LOG_DEBUG(3), "adding trust anchor %s", trust_anchor);
@@ -689,7 +668,7 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client, dns_view_t *toview) {
 	if (cfg_obj_isvoid(obj)) {
 		/*
 		 * "anchortype" is not defined, this must be a static-key
-		 * configured with trusted-keys.
+		 * configured with trust-anchors.
 		 */
 		anchortype = STATIC_KEY;
 	} else {
@@ -810,20 +789,20 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client, dns_view_t *toview) {

 cleanup:
 	if (result == DST_R_NOCRYPTO) {
-		cfg_obj_log(key, lctx, ISC_LOG_ERROR, "no crypto support");
+		cfg_obj_log(key, ISC_LOG_ERROR, "no crypto support");
 	} else if (result == DST_R_UNSUPPORTEDALG) {
-		cfg_obj_log(key, lctx, ISC_LOG_WARNING,
+		cfg_obj_log(key, ISC_LOG_WARNING,
 			    "skipping trusted key '%s': %s", keynamestr,
 			    isc_result_totext(result));
 		result = ISC_R_SUCCESS;
 	} else if (result != ISC_R_SUCCESS) {
-		cfg_obj_log(key, lctx, ISC_LOG_ERROR,
+		cfg_obj_log(key, ISC_LOG_ERROR,
 			    "failed to add trusted key '%s': %s", keynamestr,
 			    isc_result_totext(result));
 		result = ISC_R_FAILURE;
 	}

-	return (result);
+	return result;
 }

 static isc_result_t
@@ -848,20 +827,18 @@ cleanup:
 	if (result == DST_R_NOCRYPTO) {
 		result = ISC_R_SUCCESS;
 	}
-	return (result);
+	return result;
 }

 static isc_result_t
 setup_dnsseckeys(dns_client_t *client, dns_view_t *toview) {
 	isc_result_t result;
 	cfg_parser_t *parser = NULL;
-	const cfg_obj_t *trusted_keys = NULL;
-	const cfg_obj_t *managed_keys = NULL;
 	const cfg_obj_t *trust_anchors = NULL;
 	cfg_obj_t *bindkeys = NULL;

 	if (!root_validation) {
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	if (trust_anchor == NULL) {
@@ -872,7 +849,7 @@ setup_dnsseckeys(dns_client_t *client, dns_view_t *toview) {
 		CHECK(convert_name(&afn, &anchor_name, trust_anchor));
 	}

-	CHECK(cfg_parser_create(mctx, dns_lctx, &parser));
+	CHECK(cfg_parser_create(mctx, &parser));

 	if (anchorfile != NULL) {
 		if (access(anchorfile, R_OK) != 0) {
@@ -898,16 +875,7 @@ setup_dnsseckeys(dns_client_t *client, dns_view_t *toview) {
 	}

 	INSIST(bindkeys != NULL);
-	cfg_map_get(bindkeys, "trusted-keys", &trusted_keys);
-	cfg_map_get(bindkeys, "managed-keys", &managed_keys);
 	cfg_map_get(bindkeys, "trust-anchors", &trust_anchors);
-
-	if (trusted_keys != NULL) {
-		CHECK(load_keys(trusted_keys, client, toview));
-	}
-	if (managed_keys != NULL) {
-		CHECK(load_keys(managed_keys, client, toview));
-	}
 	if (trust_anchors != NULL) {
 		CHECK(load_keys(trust_anchors, client, toview));
 	}
@@ -928,7 +896,7 @@ cleanup:
 		delv_log(ISC_LOG_ERROR, "setup_dnsseckeys: %s",
 			 isc_result_totext(result));
 	}
-	return (result);
+	return result;
 }

 static isc_result_t
@@ -975,7 +943,7 @@ addserver(dns_client_t *client) {
 		if (gaierror != 0) {
 			delv_log(ISC_LOG_ERROR, "getaddrinfo failed: %s",
 				 gai_strerror(gaierror));
-			return (ISC_R_FAILURE);
+			return ISC_R_FAILURE;
 		}

 		result = ISC_R_SUCCESS;
@@ -1011,7 +979,7 @@ cleanup:
 			 isc_result_totext(result));
 	}

-	return (result);
+	return result;
 }

 static isc_result_t
@@ -1080,7 +1048,7 @@ cleanup:
 	if (resconf != NULL) {
 		irs_resconf_destroy(&resconf);
 	}
-	return (result);
+	return result;
 }

 static isc_result_t
@@ -1093,10 +1061,10 @@ parse_uint(uint32_t *uip, const char *value, uint32_t max, const char *desc) {
 	if (result != ISC_R_SUCCESS) {
 		printf("invalid %s '%s': %s\n", desc, value,
 		       isc_result_totext(result));
-		return (result);
+		return result;
 	}
 	*uip = n;
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static void
@@ -1191,6 +1159,47 @@ plus_option(char *option) {
 		break;
 	case 'm':
 		switch (cmd[1]) {
+		case 'a':
+			switch (cmd[3]) {
+			case 'q': /* maxqueries */
+				FULLCHECK("maxqueries");
+				if (value == NULL) {
+					goto need_value;
+				}
+				if (!state) {
+					goto invalid_option;
+				}
+				result = parse_uint(&maxqueries, value,
+						    UINT_MAX, "maxqueries");
+				if (result != ISC_R_SUCCESS) {
+					fatal("Couldn't parse maxqueries");
+				}
+				if (maxqueries == 0) {
+					fatal("maxqueries must be nonzero");
+				}
+				break;
+			case 't': /* maxtotalqueries */
+				FULLCHECK("maxtotalqueries");
+				if (value == NULL) {
+					goto need_value;
+				}
+				if (!state) {
+					goto invalid_option;
+				}
+				result = parse_uint(&maxtotal, value, UINT_MAX,
+						    "maxtotalqueries");
+				if (result != ISC_R_SUCCESS) {
+					fatal("Couldn't parse maxtotalqueries");
+				}
+				if (maxtotal == 0) {
+					fatal("maxtotalqueries must be "
+					      "nonzero");
+				}
+				break;
+			default:
+				goto invalid_option;
+			}
+			break;
 		case 't': /* mtrace */
 			FULLCHECK("mtrace");
 			message_trace = state;
@@ -1243,6 +1252,22 @@ plus_option(char *option) {
 		break;
 	case 'r':
 		switch (cmd[1]) {
+		case 'e': /* restarts */
+			FULLCHECK("restarts");
+			if (value == NULL) {
+				goto need_value;
+			}
+			if (!state) {
+				goto invalid_option;
+			}
+			result = parse_uint(&restarts, value, 255, "restarts");
+			if (result != ISC_R_SUCCESS) {
+				fatal("Couldn't parse restarts");
+			}
+			if (restarts == 0) {
+				fatal("restarts must be between 1..255");
+			}
+			break;
 		case 'o': /* root */
 			FULLCHECK("root");
 			if (state && no_sigs) {
@@ -1370,10 +1395,7 @@ plus_option(char *option) {
 		break;
 	default:
 	invalid_option:
-		/*
-		 * We can also add a "need_value:" case here if we ever
-		 * add a plus-option that requires a specified value
-		 */
+	need_value:
 		fprintf(stderr, "Invalid option: +%s\n", option);
 		usage();
 	}
@@ -1383,8 +1405,8 @@ plus_option(char *option) {
 /*
 * options: "46a:b:c:d:himp:q:t:vx:";
 */
-static const char *single_dash_opts = "46himv";
-static const char *dash_opts = "46abcdhimpqtvx";
+static const char *single_dash_opts = "46Fhimv";
+static const char *dash_opts = "46abcdFhimpqtvx";

 static bool
 dash_option(char *option, char *next, bool *open_type_class) {
@@ -1427,6 +1449,9 @@ dash_option(char *option, char *next, bool *open_type_class) {
 				use_ipv4 = false;
 			}
 			break;
+		case 'F': /* FIPS */
+			/* handled in preparse_args() */
+			break;
 		case 'h':
 			usage();
 			exit(EXIT_SUCCESS);
@@ -1446,7 +1471,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
 		if (strlen(option) > 1U) {
 			option = &option[1];
 		} else {
-			return (false);
+			return false;
 		}
 	}
 	opt = option[0];
@@ -1463,7 +1488,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
 	switch (opt) {
 	case 'a':
 		anchorfile = isc_mem_strdup(mctx, value);
-		return (value_from_next);
+		return value_from_next;
 	case 'b':
 		hash = strchr(value, '#');
 		if (hash != NULL) {
@@ -1500,7 +1525,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
 		if (hash != NULL) {
 			*hash = '#';
 		}
-		return (value_from_next);
+		return value_from_next;
 	case 'c':
 		if (classset) {
 			warn("extra query class");
@@ -1518,28 +1543,28 @@ dash_option(char *option, char *next, bool *open_type_class) {
 		} else {
 			warn("ignoring invalid class");
 		}
-		return (value_from_next);
+		return value_from_next;
 	case 'd':
 		result = parse_uint(&num, value, 99, "debug level");
 		if (result != ISC_R_SUCCESS) {
 			fatal("Couldn't parse debug level");
 		}
 		loglevel = num;
-		return (value_from_next);
+		return value_from_next;
 	case 'p':
 		port = value;
 		result = parse_uint(&destport, port, 0xffff, "port");
 		if (result != ISC_R_SUCCESS) {
 			fatal("Couldn't parse port number");
 		}
-		return (value_from_next);
+		return value_from_next;
 	case 'q':
 		if (curqname != NULL) {
 			warn("extra query name");
 			isc_mem_free(mctx, curqname);
 		}
 		curqname = isc_mem_strdup(mctx, value);
-		return (value_from_next);
+		return value_from_next;
 	case 't':
 		*open_type_class = false;
 		tr.base = value;
@@ -1560,7 +1585,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
 		} else {
 			warn("ignoring invalid type");
 		}
-		return (value_from_next);
+		return value_from_next;
 	case 'x':
 		result = get_reverse(textname, sizeof(textname), value, false);
 		if (result == ISC_R_SUCCESS) {
@@ -1578,14 +1603,14 @@ dash_option(char *option, char *next, bool *open_type_class) {
 			fprintf(stderr, "Invalid IP address %s\n", value);
 			exit(EXIT_FAILURE);
 		}
-		return (value_from_next);
+		return value_from_next;
 	invalid_option:
 	default:
 		fprintf(stderr, "Invalid option: -%s\n", option);
 		usage();
 	}
 	UNREACHABLE();
-	return (false);
+	return false;
 }

 /*
@@ -1605,6 +1630,28 @@ preparse_args(int argc, char **argv) {
 		option = &argv[0][1];
 		while (strpbrk(option, single_dash_opts) == &option[0]) {
 			switch (option[0]) {
+			case 'F':
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+				fips = OSSL_PROVIDER_load(NULL, "fips");
+				if (fips == NULL) {
+					ERR_clear_error();
+					fatal("Failed to load FIPS provider");
+				}
+				base = OSSL_PROVIDER_load(NULL, "base");
+				if (base == NULL) {
+					OSSL_PROVIDER_unload(fips);
+					ERR_clear_error();
+					fatal("Failed to load base provider");
+				}
+#endif
+				/* Already in FIPS mode?  */
+				if (isc_fips_mode()) {
+					break;
+				}
+				if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
+					fatal("setting FIPS mode failed");
+				}
+				break;
 			case 'm':
 				isc_mem_debugging = ISC_MEM_DEBUGTRACE |
 						    ISC_MEM_DEBUGRECORD;
@@ -1752,11 +1799,11 @@ parse_args(int argc, char **argv) {
 static isc_result_t
 append_str(const char *text, int len, char **p, char *end) {
 	if (len > end - *p) {
-		return (ISC_R_NOSPACE);
+		return ISC_R_NOSPACE;
 	}
 	memmove(*p, text, len);
 	*p += len;
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static isc_result_t
@@ -1767,17 +1814,17 @@ reverse_octets(const char *in, char **p, char *end) {
 		isc_result_t result;
 		result = reverse_octets(dot + 1, p, end);
 		if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
 		result = append_str(".", 1, p, end);
 		if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
 		len = (int)(dot - in);
 	} else {
 		len = strlen(in);
 	}
-	return (append_str(in, len, p, end));
+	return append_str(in, len, p, end);
 }

 static isc_result_t
@@ -1796,10 +1843,10 @@ get_reverse(char *reverse, size_t len, char *value, bool strict) {
 		name = dns_fixedname_initname(&fname);
 		result = dns_byaddr_createptrname(&addr, name);
 		if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
 		dns_name_format(name, reverse, (unsigned int)len);
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	} else {
 		/*
 		 * Not a valid IPv6 address.  Assume IPv4.
@@ -1812,17 +1859,17 @@ get_reverse(char *reverse, size_t len, char *value, bool strict) {
 		char *p = reverse;
 		char *end = reverse + len;
 		if (strict && inet_pton(AF_INET, value, &addr.type.in) != 1) {
-			return (DNS_R_BADDOTTEDQUAD);
+			return DNS_R_BADDOTTEDQUAD;
 		}
 		result = reverse_octets(value, &p, end);
 		if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
 		result = append_str(".in-addr.arpa.", 15, &p, end);
 		if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}
 }

@@ -1898,6 +1945,8 @@ run_resolve(void *arg) {
 	/* Create client */
 	CHECK(dns_client_create(mctx, loopmgr, netmgr, 0, tlsctx_client_cache,
 				&client, srcaddr4, srcaddr6));
+	dns_client_setmaxrestarts(client, restarts);
+	dns_client_setmaxqueries(client, maxtotal);

 	/* Set the nameserver */
 	if (server != NULL) {
@@ -2058,7 +2107,7 @@ accept_cb(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 	UNUSED(handle);
 	UNUSED(arg);

-	return (result);
+	return result;
 }

 static void
@@ -2133,7 +2182,7 @@ matchview(isc_netaddr_t *srcaddr, isc_netaddr_t *destaddr,

 	*viewp = view;
 	*viewpatchresultp = ISC_R_SUCCESS;
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static void
@@ -2154,14 +2203,16 @@ run_server(void *arg) {
 	isc_sockaddr_any(&any);
 	CHECK(dns_dispatch_createudp(dispatchmgr, &any, &dispatch));
 	CHECK(ns_interfacemgr_create(mctx, sctx, loopmgr, netmgr, dispatchmgr,
-				     NULL, false, &interfacemgr));
+				     NULL, &interfacemgr));

-	CHECK(dns_view_create(mctx, dispatchmgr, dns_rdataclass_in, "_default",
-			      &view));
+	CHECK(dns_view_create(mctx, loopmgr, dispatchmgr, dns_rdataclass_in,
+			      "_default", &view));
 	CHECK(dns_cache_create(loopmgr, dns_rdataclass_in, "", mctx, &cache));
 	dns_view_setcache(view, cache, false);
 	dns_cache_detach(&cache);
 	dns_view_setdstport(view, destport);
+	dns_view_setmaxrestarts(view, restarts);
+	dns_view_setmaxqueries(view, maxtotal);

 	CHECK(dns_rootns_create(mctx, dns_rdataclass_in, hintfile, &roothints));
 	dns_view_sethints(view, roothints);
@@ -2175,6 +2226,7 @@ run_server(void *arg) {

 	CHECK(dns_view_createresolver(view, netmgr, 0, tlsctx_client_cache,
 				      dispatch, NULL));
+	dns_resolver_setmaxqueries(view->resolver, maxqueries);

 	isc_stats_create(mctx, &resstats, dns_resstatscounter_max);
 	dns_resolver_setstats(view->resolver, resstats);
@@ -2220,11 +2272,6 @@ main(int argc, char *argv[]) {
 	isc_managers_create(&mctx, 1, &loopmgr, &netmgr);
 	loop = isc_loop_main(loopmgr);

-	result = dst_lib_init(mctx, NULL);
-	if (result != ISC_R_SUCCESS) {
-		fatal("dst_lib_init failed: %d", result);
-	}
-
 	parse_args(argc, argv);

 	CHECK(setup_style());
@@ -2266,10 +2313,16 @@ cleanup:
 		dns_master_styledestroy(&style, mctx);
 	}

-	isc_log_destroy(&lctx);
-	dst_lib_destroy();
-
 	isc_managers_destroy(&mctx, &loopmgr, &netmgr);

-	return (0);
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+	if (base != NULL) {
+		OSSL_PROVIDER_unload(base);
+	}
+	if (fips != NULL) {
+		OSSL_PROVIDER_unload(fips);
+	}
+#endif
+
+	return 0;
 }
@@ -21,7 +21,7 @@ delv - DNS lookup and validation utility
 Synopsis
 ~~~~~~~~

-:program:`delv` [@server] [ [**-4**] | [**-6**] ] [**-a** anchor-file] [**-b** address] [**-c** class] [**-d** level] [**-i**] [**-m**] [**-p** port#] [**-q** name] [**-t** type] [**-x** addr] [name] [type] [class] [queryopt...]
+:program:`delv` [@server] [ [**-4**] | [**-6**] ] [**-a** anchor-file] [**-b** address] [**-c** class] [**-d** level] [**-F**] [**-i**] [**-m**] [**-p** port#] [**-q** name] [**-t** type] [**-x** addr] [name] [type] [class] [queryopt...]

 :program:`delv` [**-h**]

@@ -138,6 +138,10 @@ Options
   :option:`+mtrace`, :option:`+rtrace`, and :option:`+vtrace` options below for
   additional debugging details.

+.. option:: -F
+
+   This option enables FIPS mode if supported by the cryptographic library in use.
+
 .. option:: -h

   This option displays the :program:`delv` help usage output and exits.
@@ -337,6 +341,23 @@ assign values to options like the timeout interval. They have the form
   they are replaced by the string ``[omitted]`` or, in the DNSKEY case, the
   key ID is displayed as the replacement, e.g. ``[ key id = value ]``.

+.. option:: +restarts
+
+   When name server mode (``delv +ns``) is in use, this option sets the
+   maximum number of CNAME queries to follow before terminating resolution.
+   This prevents ``delv`` from hanging in the event of a CNAME loop.
+   The default is 11.
+
+.. option:: +maxqueries
+
+   This option specifies the maximum number of queries to send to resolve
+   a name before giving up. The default is 50.
+
+.. option:: +maxtotalqueries
+
+   This option specifies the maximum number of queries to send to resolve
+   a client request before giving up. The default is 200.
+
 .. option:: +trust, +notrust

   This option controls whether to display the trust level when printing a record.
@@ -5,13 +5,16 @@ AM_CPPFLAGS +=			\
 	$(LIBDNS_CFLAGS)	\
 	$(LIBISCCFG_CFLAGS)	\
 	$(LIBIDN2_CFLAGS)	\
-	$(LIBUV_CFLAGS)
+	$(OPENSSL_CFLAGS)	\
+	$(LIBUV_CFLAGS)		\
+	$(OPENSSL_CFLAGS)

 LDADD +=			\
 	libdighost.la		\
 	$(LIBISC_LIBS)		\
 	$(LIBDNS_LIBS)		\
 	$(LIBISCCFG_LIBS)	\
+	$(OPENSSL_LIBS)		\
 	$(LIBIDN2_LIBS)

 noinst_LTLIBRARIES = libdighost.la
@@ -21,6 +21,7 @@

 #include <isc/attributes.h>
 #include <isc/dir.h>
+#include <isc/fips.h>
 #include <isc/loop.h>
 #include <isc/netaddr.h>
 #include <isc/parseint.h>
@@ -69,6 +70,16 @@ static bool short_form = false, printcmd = true, plusquest = false,
 	    pluscomm = false, ipv4only = false, ipv6only = false, digrc = true;
 static uint32_t splitwidth = 0xffffffff;

+#include <openssl/opensslv.h>
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#include <openssl/err.h>
+#include <openssl/provider.h>
+#endif
+
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+static OSSL_PROVIDER *fips = NULL, *base = NULL;
+#endif
+
 /*% opcode text */
 static const char *const opcodetext[] = {
 	"QUERY",      "IQUERY",	    "STATUS",	  "RESERVED3",
@@ -89,9 +100,9 @@ rcode_totext(dns_rcode_t rcode) {
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 	if (strspn(buf + 1, "0123456789") == strlen(buf + 1)) {
 		buf[0] = '?';
-		return (buf);
+		return buf;
 	}
-	return (buf + 1);
+	return buf + 1;
 }

 /*% print usage */
@@ -111,7 +122,7 @@ usage(void) {
 	fprintf(stderr, "Press <Help> for complete list of options\n");
 }
 #else  /* if TARGET_OS_IPHONE */
-noreturn static void
+ISC_NORETURN static void
 usage(void);

 static void
@@ -473,7 +484,7 @@ say_message(dns_rdata_t *rdata, dig_query_t *query, isc_buffer_t *buf) {
 	if (query->lookup->trace || query->lookup->ns_search_only) {
 		result = dns_rdatatype_totext(rdata->type, buf);
 		if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
 		ADD_STRING(buf, " ");
 	}
@@ -494,7 +505,7 @@ say_message(dns_rdata_t *rdata, dig_query_t *query, isc_buffer_t *buf) {
 	result = dns_rdata_tofmttext(rdata, NULL, styleflags, 0, splitwidth,
 				     " ", buf);
 	if (result == ISC_R_NOSPACE) {
-		return (result);
+		return result;
 	}
 	check_result(result, "dns_rdata_totext");
 	if (query->lookup->identify) {
@@ -511,7 +522,7 @@ say_message(dns_rdata_t *rdata, dig_query_t *query, isc_buffer_t *buf) {
 		ADD_STRING(buf, store);
 	}
 	ADD_STRING(buf, "\n");
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 /*%
@@ -535,14 +546,14 @@ dns64prefix_answer(dns_message_t *msg, isc_buffer_t *buf) {
 				      dns_rdatatype_aaaa, dns_rdatatype_none,
 				      NULL, &rdataset);
 	if (result == DNS_R_NXDOMAIN || result == DNS_R_NXRRSET) {
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	} else if (result != ISC_R_SUCCESS) {
-		return (result);
+		return result;
 	}

 	result = dns_dns64_findprefix(rdataset, prefix, &count);
 	if (result == ISC_R_NOTFOUND) {
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}
 	if (count > 10) {
 		count = 10;
@@ -550,15 +561,15 @@ dns64prefix_answer(dns_message_t *msg, isc_buffer_t *buf) {
 	for (i = 0; i < count; i++) {
 		result = isc_netaddr_totext(&prefix[i].addr, buf);
 		if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
 		result = isc_buffer_printf(buf, "/%u\n", prefix[i].prefixlen);
 		if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
 	}

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 /*%
@@ -578,9 +589,9 @@ short_answer(dns_message_t *msg, dns_messagetextflag_t flags, isc_buffer_t *buf,
 	dns_name_init(&empty_name, NULL);
 	result = dns_message_firstname(msg, DNS_SECTION_ANSWER);
 	if (result == ISC_R_NOMORE) {
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	} else if (result != ISC_R_SUCCESS) {
-		return (result);
+		return result;
 	}

 	for (;;) {
@@ -595,7 +606,7 @@ short_answer(dns_message_t *msg, dns_messagetextflag_t flags, isc_buffer_t *buf,
 				dns_rdataset_current(rdataset, &rdata);
 				result = say_message(&rdata, query, buf);
 				if (result == ISC_R_NOSPACE) {
-					return (result);
+					return result;
 				}
 				check_result(result, "say_message");
 				loopresult = dns_rdataset_next(rdataset);
@@ -606,11 +617,11 @@ short_answer(dns_message_t *msg, dns_messagetextflag_t flags, isc_buffer_t *buf,
 		if (result == ISC_R_NOMORE) {
 			break;
 		} else if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
 	}

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static bool
@@ -628,10 +639,10 @@ isdotlocal(dns_message_t *msg) {
 		dns_name_t *name = NULL;
 		dns_message_currentname(msg, DNS_SECTION_QUESTION, &name);
 		if (dns_name_issubdomain(name, &local)) {
-			return (true);
+			return true;
 		}
 	}
-	return (false);
+	return false;
 }

 /*
@@ -748,8 +759,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		char *hash;
 		int pf;

-		printf("-\n");
-		printf("  type: MESSAGE\n");
+		printf("- type: MESSAGE\n");
 		printf("  message:\n");

 		if (isquery) {
@@ -1025,7 +1035,7 @@ repopulate_buffer:

 	dig_idnsetup(query->lookup, false);

-	return (result);
+	return result;
 }

 /*%
@@ -1194,7 +1204,7 @@ proxy_handle_addr_string(const char *addr_start, const size_t addr_len,
 		}
 	}

-	return (result);
+	return result;
 }

 static bool
@@ -1214,7 +1224,7 @@ parse_proxy_addresses(const char *addrs, isc_sockaddr_t *psrc,
 	/* start syntax analysis and verification */
 	if (!rule_proxy_addrs(&st)) {
 		warn("PROXY source and destination addresses cannot be parsed");
-		return (false);
+		return false;
 	}

 	/* get port numeric values */
@@ -1241,7 +1251,7 @@ parse_proxy_addresses(const char *addrs, isc_sockaddr_t *psrc,
 	if (result != ISC_R_SUCCESS) {
 		warn("Cannot get PROXY source address: %s",
 		     isc_result_totext(result));
-		return (false);
+		return false;
 	}

 	result = proxy_handle_addr_string(st.dst_addr_start, st.dst_addr_len,
@@ -1249,26 +1259,26 @@ parse_proxy_addresses(const char *addrs, isc_sockaddr_t *psrc,
 	if (result != ISC_R_SUCCESS) {
 		warn("Cannot get PROXY destination address: %s",
 		     isc_result_totext(result));
-		return (false);
+		return false;
 	}

 	/* addresses should be of the same type */
 	if (isc_sockaddr_pf(&src) != isc_sockaddr_pf(&dst)) {
 		warn("PROXY source and destination addresses must be of the "
 		     "same type");
-		return (false);
+		return false;
 	}

 	*psrc = src;
 	*pdst = dst;

-	return (true);
+	return true;
 }

 static bool
 rule_proxy_addrs(isc_proxy_addrs_parser_state_t *st) {
 	if (!rule_addr(st)) {
-		return (false);
+		return false;
 	}

 	st->src_addr_start = st->last_addr_start;
@@ -1277,13 +1287,13 @@ rule_proxy_addrs(isc_proxy_addrs_parser_state_t *st) {
 	st->src_port_len = st->last_port_len;

 	if (!MATCH('-')) {
-		return (false);
+		return false;
 	}

 	ADVANCE();

 	if (!rule_addr(st)) {
-		return (false);
+		return false;
 	}

 	st->dst_addr_start = st->last_addr_start;
@@ -1292,17 +1302,17 @@ rule_proxy_addrs(isc_proxy_addrs_parser_state_t *st) {
 	st->dst_port_len = st->last_port_len;

 	if (!MATCH('\0')) {
-		return (false);
+		return false;
 	}

-	return (true);
+	return true;
 }

 static bool
 rule_addr(isc_proxy_addrs_parser_state_t *st) {
 	const char *start = GETP();
 	if (!rule_addr_char(st)) {
-		return (false);
+		return false;
 	}

 	while (rule_addr_char(st)) {
@@ -1316,18 +1326,18 @@ rule_addr(isc_proxy_addrs_parser_state_t *st) {
 		ADVANCE();

 		if (!rule_port(st)) {
-			return (false);
+			return false;
 		}
 	}

-	return (true);
+	return true;
 }

 static bool
 rule_port(isc_proxy_addrs_parser_state_t *st) {
 	const char *start = GETP();
 	if (!MATCH_DIGIT()) {
-		return (false);
+		return false;
 	}

 	ADVANCE();
@@ -1339,18 +1349,18 @@ rule_port(isc_proxy_addrs_parser_state_t *st) {
 	st->last_port_start = start;
 	st->last_port_len = GETP() - start;

-	return (true);
+	return true;
 }

 static bool
 rule_addr_char(isc_proxy_addrs_parser_state_t *st) {
 	if (MATCH('#') || MATCH('-') || MATCH('\0')) {
-		return (false);
+		return false;
 	}

 	ADVANCE();

-	return (true);
+	return true;
 }

 #undef GETP
@@ -1367,20 +1377,20 @@ plus_proxy_handle_addresses(const char *value, const bool state,
 		 * We are not interested in the option value in that
 		 * case
 		 */
-		return (true);
+		return true;
 	}

 	if (value == NULL || *value == '\0') {
 		lookup->proxy_local = true;
-		return (true);
+		return true;
 	}

 	if (!parse_proxy_addresses(value, &lookup->proxy_src_addr,
 				   &lookup->proxy_dst_addr))
 	{
-		return (false);
+		return false;
 	}
-	return (true);
+	return true;
 }

 static bool
@@ -1403,10 +1413,10 @@ plus_proxy_options(const char *cmd, const char *value, const bool state,
 	default:
 		goto invalid_option;
 	}
-	return (true);
+	return true;

 invalid_option:
-	return (false);
+	return false;
 }

 static bool
@@ -1526,7 +1536,7 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,

 	if ((cmd = strtok_r(option, "=", &last)) == NULL) {
 		printf(";; Invalid option %s\n", option);
-		return (lookup);
+		return lookup;
 	}
 	if (strncasecmp(cmd, "no", 2) == 0) {
 		cmd += 2;
@@ -1825,9 +1835,12 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 							     "specified");
 							goto exit_or_usage;
 						}
-						extra = strtok_r(NULL, "\0",
+						extra = strtok_r(NULL, "",
 								 &last);
 						save_opt(lookup, code, extra);
+						if (extra != NULL) {
+							extra[-1] = ':';
+						}
 						break;
 					default:
 						goto invalid_option;
@@ -2556,7 +2569,10 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 		fprintf(stderr, "Invalid option: +%s\n", option);
 		usage();
 	}
-	return (lookup);
+	if (value != NULL) {
+		value[-1] = '=';
+	}
+	return lookup;

 #if !TARGET_OS_IPHONE
 exit_or_usage:
@@ -2568,8 +2584,8 @@ exit_or_usage:
 /*%
 * #true returned if value was used
 */
-static const char *single_dash_opts = "46dhimnruv";
-static const char *dash_opts = "46bcdfhikmnpqrtvyx";
+static const char *single_dash_opts = "46dFhimnruv";
+static const char *dash_opts = "46bcdFfhikmnpqrtvyx";
 static bool
 dash_option(char *option, char *next, dig_lookup_t **lookup,
 	    bool *open_type_class, bool *need_clone, bool config_only, int argc,
@@ -2602,7 +2618,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 			} else {
 				fatal("can't find IPv4 networking");
 				UNREACHABLE();
-				return (false);
+				return false;
 			}
 			break;
 		case '6':
@@ -2612,7 +2628,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 			} else {
 				fatal("can't find IPv6 networking");
 				UNREACHABLE();
-				return (false);
+				return false;
 			}
 			break;
 		case 'd':
@@ -2621,11 +2637,14 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 				cmd = option;
 				FULLCHECK("debug");
 				debugging = true;
-				return (false);
+				return false;
 			} else {
 				debugging = true;
 			}
 			break;
+		case 'F': /* FIPS */
+			/* FIPS is handled in preparse_args() */
+			break;
 		case 'h':
 			help();
 			exit(EXIT_SUCCESS);
@@ -2652,7 +2671,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		if (strlen(option) > 1U) {
 			option = &option[1];
 		} else {
-			return (false);
+			return false;
 		}
 	}
 	opt = option[0];
@@ -2696,7 +2715,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 			*hash = '#';
 		}
 		specified_source = true;
-		return (value_from_next);
+		return value_from_next;
 	case 'c':
 		if ((*lookup)->rdclassset) {
 			fprintf(stderr, ";; Warning, extra class option\n");
@@ -2715,13 +2734,13 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 				"invalid class %s\n",
 				value);
 		}
-		return (value_from_next);
+		return value_from_next;
 	case 'f':
 		batchname = value;
-		return (value_from_next);
+		return value_from_next;
 	case 'k':
 		strlcpy(keyfile, value, sizeof(keyfile));
-		return (value_from_next);
+		return value_from_next;
 	case 'p':
 		result = parse_uint(&num, value, MAXPORT, "port number");
 		if (result != ISC_R_SUCCESS) {
@@ -2729,7 +2748,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		}
 		port = num;
 		port_set = true;
-		return (value_from_next);
+		return value_from_next;
 	case 'q':
 		if (!config_only) {
 			if (*need_clone) {
@@ -2748,7 +2767,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 			ISC_LIST_APPEND(lookup_list, (*lookup), link);
 			debug("looking up %s", (*lookup)->textname);
 		}
-		return (value_from_next);
+		return value_from_next;
 	case 't':
 		*open_type_class = false;
 		if (strncasecmp(value, "ixfr=", 5) == 0) {
@@ -2806,7 +2825,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 				"invalid type %s\n",
 				value);
 		}
-		return (value_from_next);
+		return value_from_next;
 	case 'y':
 		if ((ptr = strtok_r(value, ":", &last)) == NULL) {
 			usage();
@@ -2815,8 +2834,8 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 								    * secret */
 			usage();
 		}
-		if ((ptr3 = strtok_r(NULL, ":", &last)) != NULL) { /* secret or
-								    * NULL */
+		if ((ptr3 = strtok_r(NULL, "", &last)) != NULL) { /* secret or
+								   * NULL */
 			parse_hmac(ptr);
 			ptr = ptr2;
 			ptr2 = ptr3;
@@ -2827,7 +2846,11 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		/* XXXONDREJ: FIXME */
 		strlcpy(keynametext, ptr, sizeof(keynametext));
 		strlcpy(keysecret, ptr2, sizeof(keysecret));
-		return (value_from_next);
+		if (ptr3 != NULL) {
+			ptr[-1] = ':';
+		}
+		ptr2[-1] = ':';
+		return value_from_next;
 	case 'x':
 		if (*need_clone) {
 			*lookup = clone_lookup(default_lookup, true);
@@ -2857,14 +2880,14 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 			fprintf(stderr, "Invalid IP address %s\n", value);
 			exit(EXIT_FAILURE);
 		}
-		return (value_from_next);
+		return value_from_next;
 	invalid_option:
 	default:
 		fprintf(stderr, "Invalid option: -%s\n", option);
 		usage();
 	}
 	UNREACHABLE();
-	return (false);
+	return false;
 }

 /*%
@@ -2895,6 +2918,28 @@ preparse_args(int argc, char **argv) {
 				/* For debugging early startup */
 				debugging = true;
 				break;
+			case 'F':
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+				fips = OSSL_PROVIDER_load(NULL, "fips");
+				if (fips == NULL) {
+					ERR_clear_error();
+					fatal("Failed to load FIPS provider");
+				}
+				base = OSSL_PROVIDER_load(NULL, "base");
+				if (base == NULL) {
+					OSSL_PROVIDER_unload(fips);
+					ERR_clear_error();
+					fatal("Failed to load base provider");
+				}
+#endif
+				/* Already in FIPS mode?  */
+				if (isc_fips_mode()) {
+					break;
+				}
+				if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
+					fatal("setting FIPS mode failed");
+				}
+				break;
 			case 'm':
 				memdebugging = true;
 				isc_mem_debugging = ISC_MEM_DEBUGTRACE |
@@ -2958,7 +3003,7 @@ split_batchline(char *batchline, char **bargv, int len, const char *msg) {
 	{
 		debug("%s %d: %s", msg, bargc, bargv[bargc]);
 	}
-	return (bargc);
+	return bargc;
 }

 static void
@@ -3306,8 +3351,7 @@ dig_error(const char *format, ...) {
 	va_list args;

 	if (yaml) {
-		printf("-\n");
-		printf("  type: DIG_ERROR\n");
+		printf("- type: DIG_ERROR\n");

 		/*
 		 * Print an indent before a literal block quote.
@@ -3324,10 +3368,7 @@ dig_error(const char *format, ...) {
 	va_start(args, format);
 	vprintf(format, args);
 	va_end(args);
-
-	if (!yaml) {
-		printf("\n");
-	}
+	printf("\n"); /* We get the error without a newline */
 }

 static void
@@ -3423,5 +3464,14 @@ main(int argc, char **argv) {
 	dig_startup();
 	dig_shutdown();

-	return (exitcode);
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+	if (base != NULL) {
+		OSSL_PROVIDER_unload(base);
+	}
+	if (fips != NULL) {
+		OSSL_PROVIDER_unload(fips);
+	}
+#endif
+
+	return exitcode;
 }
@@ -20,7 +20,7 @@ dig - DNS lookup utility

 Synopsis
 ~~~~~~~~
-:program:`dig` [@server] [**-b** address] [**-c** class] [**-f** filename] [**-k** filename] [**-m**] [**-p** port#] [**-q** name] [**-t** type] [**-v**] [**-x** addr] [**-y** [hmac:]name:key] [ [**-4**] | [**-6**] ] [name] [type] [class] [queryopt...]
+:program:`dig` [@server] [**-b** address] [**-c** class] [**-f** filename] [**-F**] [**-k** filename] [**-m**] [**-p** port#] [**-q** name] [**-t** type] [**-v**] [**-x** addr] [**-y** [hmac:]name:key] [ [**-4**] | [**-6**] ] [name] [type] [class] [queryopt...]

 :program:`dig` [**-h**]

@@ -126,6 +126,10 @@ Options
   same way it would be presented as a query to :program:`dig` using the
   command-line interface.

+.. option:: -F
+
+   This option enables FIPS mode if supported by the cryptographic library in use.
+
 .. option:: -h

   Print a usage summary.
@@ -36,6 +36,7 @@
 #endif /* HAVE_LIBIDN2 */

 #include <isc/base64.h>
+#include <isc/crypto.h>
 #include <isc/file.h>
 #include <isc/getaddresses.h>
 #include <isc/hex.h>
@@ -61,7 +62,6 @@

 #include <dns/byaddr.h>
 #include <dns/fixedname.h>
-#include <dns/log.h>
 #include <dns/message.h>
 #include <dns/name.h>
 #include <dns/opcode.h>
@@ -93,14 +93,12 @@ static bool cancel_now = false;

 bool check_ra = false, have_ipv4 = false, have_ipv6 = false,
     specified_source = false, free_now = false, usesearch = false,
-     showsearch = false, is_dst_up = false, keep_open = false, verbose = false,
-     yaml = false;
+     showsearch = false, keep_open = false, verbose = false, yaml = false;
 in_port_t port = 53;
 bool port_set = false;
 unsigned int timeout = 0;
 unsigned int extrabytes;
 isc_mem_t *mctx = NULL;
-isc_log_t *lctx = NULL;
 isc_nm_t *netmgr = NULL;
 isc_loopmgr_t *loopmgr = NULL;
 isc_loop_t *mainloop = NULL;
@@ -236,7 +234,7 @@ count_dots(char *string) {
 		}
 		s++;
 	}
-	return (i);
+	return i;
 }

 static void
@@ -284,11 +282,11 @@ hex_dump(isc_buffer_t *b) {
 static isc_result_t
 append(const char *text, size_t len, char **p, char *end) {
 	if (*p + len > end) {
-		return (ISC_R_NOSPACE);
+		return ISC_R_NOSPACE;
 	}
 	memmove(*p, text, len);
 	*p += len;
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static isc_result_t
@@ -299,17 +297,17 @@ reverse_octets(const char *in, char **p, char *end) {
 		isc_result_t result;
 		result = reverse_octets(dot + 1, p, end);
 		if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
 		result = append(".", 1, p, end);
 		if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
 		len = (int)(dot - in);
 	} else {
 		len = (int)strlen(in);
 	}
-	return (append(in, len, p, end));
+	return append(in, len, p, end);
 }

 isc_result_t
@@ -328,10 +326,10 @@ get_reverse(char *reverse, size_t len, char *value, bool strict) {
 		name = dns_fixedname_initname(&fname);
 		result = dns_byaddr_createptrname(&addr, name);
 		if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
 		dns_name_format(name, reverse, (unsigned int)len);
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	} else {
 		/*
 		 * Not a valid IPv6 address.  Assume IPv4.
@@ -344,18 +342,18 @@ get_reverse(char *reverse, size_t len, char *value, bool strict) {
 		char *p = reverse;
 		char *end = reverse + len;
 		if (strict && inet_pton(AF_INET, value, &addr.type.in) != 1) {
-			return (DNS_R_BADDOTTEDQUAD);
+			return DNS_R_BADDOTTEDQUAD;
 		}
 		result = reverse_octets(value, &p, end);
 		if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
 		/* Append .in-addr.arpa. and a terminating NUL. */
 		result = append(".in-addr.arpa.", 15, &p, end);
 		if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}
 }

@@ -456,7 +454,7 @@ make_server(const char *servname, const char *userarg) {
 	strlcpy(srv->servername, servname, MXNAME);
 	strlcpy(srv->userarg, userarg, MXNAME);
 	ISC_LINK_INIT(srv, link);
-	return (srv);
+	return srv;
 }

 /*%
@@ -632,7 +630,7 @@ make_empty_lookup(void) {
 	debug("make_empty_lookup() = %p->references = %" PRIuFAST32, looknew,
 	      isc_refcount_current(&looknew->references));

-	return (looknew);
+	return looknew;
 }

 #define EDNSOPT_OPTIONS 100U
@@ -823,7 +821,7 @@ clone_lookup(dig_lookup_t *lookold, bool servers) {

 	looknew->magic = DIG_LOOKUP_MAGIC;

-	return (looknew);
+	return looknew;
 }

 /*%
@@ -853,7 +851,7 @@ requeue_lookup(dig_lookup_t *lookold, bool servers) {
 	ISC_LIST_PREPEND(lookup_list, looknew, link);
 	debug("after insertion, init -> %p, new = %p, new -> %p", lookold,
 	      looknew, looknew->link.next);
-	return (looknew);
+	return looknew;
 }

 void
@@ -914,20 +912,20 @@ parse_uint_helper(uint32_t *uip, const char *value, uint32_t max,
 	if (result != ISC_R_SUCCESS) {
 		printf("invalid %s '%s': %s\n", desc, value,
 		       isc_result_totext(result));
-		return (result);
+		return result;
 	}
 	*uip = n;
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 isc_result_t
 parse_uint(uint32_t *uip, const char *value, uint32_t max, const char *desc) {
-	return (parse_uint_helper(uip, value, max, desc, 10));
+	return parse_uint_helper(uip, value, max, desc, 10);
 }

 isc_result_t
 parse_xint(uint32_t *uip, const char *value, uint32_t max, const char *desc) {
-	return (parse_uint_helper(uip, value, max, desc, 0));
+	return parse_uint_helper(uip, value, max, desc, 0);
 }

 static uint32_t
@@ -940,7 +938,7 @@ parse_bits(char *arg, const char *desc, uint32_t max) {
 		fatal("couldn't parse digest bits");
 	}
 	tmp = (tmp + 7) & ~0x7U;
-	return (tmp);
+	return tmp;
 }

 isc_result_t
@@ -1018,7 +1016,7 @@ done:
 	sa->length = prefix_length;
 	*sap = sa;

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 /*
@@ -1094,10 +1092,10 @@ read_confkey(void) {
 	isc_result_t result;

 	if (!isc_file_exists(keyfile)) {
-		return (ISC_R_FILENOTFOUND);
+		return ISC_R_FILENOTFOUND;
 	}

-	result = cfg_parser_create(mctx, NULL, &pctx);
+	result = cfg_parser_create(mctx, &pctx);
 	if (result != ISC_R_SUCCESS) {
 		goto cleanup;
 	}
@@ -1135,7 +1133,7 @@ cleanup:
 		cfg_parser_destroy(&pctx);
 	}

-	return (result);
+	return result;
 }

 void
@@ -1205,7 +1203,7 @@ make_searchlist_entry(char *domain) {
 	strlcpy(search->origin, domain, MXNAME);
 	search->origin[MXNAME - 1] = 0;
 	ISC_LINK_INIT(search, link);
-	return (search);
+	return search;
 }

 static void
@@ -1362,22 +1360,15 @@ setup_libs(void) {

 	isc_managers_create(&mctx, 1, &loopmgr, &netmgr);

-	isc_log_create(mctx, &lctx, &logconfig);
-	isc_log_setcontext(lctx);
-	dns_log_init(lctx);
-	dns_log_setcontext(lctx);
-
-	result = isc_log_usechannel(logconfig, "default_debug", NULL, NULL);
-	check_result(result, "isc_log_usechannel");
-
-	isc_log_setdebuglevel(lctx, 0);
+	logconfig = isc_logconfig_get();
+	isc_log_createandusechannel(logconfig, "debug", ISC_LOG_TOFILEDESC,
+				    ISC_LOG_DYNAMIC, ISC_LOGDESTINATION_STDERR,
+				    ISC_LOG_PRINTTIME, ISC_LOGCATEGORY_DEFAULT,
+				    ISC_LOGMODULE_DEFAULT);
+	isc_log_setdebuglevel(0);

 	isc_mem_setname(mctx, "dig");
 	mainloop = isc_loop_main(loopmgr);
-
-	result = dst_lib_init(mctx, NULL);
-	check_result(result, "dst_lib_init");
-	is_dst_up = true;
 }

 typedef struct dig_ednsoptname {
@@ -1386,24 +1377,27 @@ typedef struct dig_ednsoptname {
 } dig_ednsoptname_t;

 dig_ednsoptname_t optnames[] = {
-	{ 1, "LLQ" },	       /* draft-sekar-dns-llq */
-	{ 2, "UL" },	       /* draft-ietf-dnssd-update-lease */
-	{ 3, "NSID" },	       /* RFC 5001 */
-	{ 5, "DAU" },	       /* RFC 6975 */
-	{ 6, "DHU" },	       /* RFC 6975 */
-	{ 7, "N3U" },	       /* RFC 6975 */
-	{ 8, "ECS" },	       /* RFC 7871 */
-	{ 9, "EXPIRE" },       /* RFC 7314 */
-	{ 10, "COOKIE" },      /* RFC 7873 */
-	{ 11, "KEEPALIVE" },   /* RFC 7828 */
-	{ 12, "PADDING" },     /* RFC 7830 */
-	{ 12, "PAD" },	       /* shorthand */
-	{ 13, "CHAIN" },       /* RFC 7901 */
-	{ 14, "KEY-TAG" },     /* RFC 8145 */
-	{ 15, "EDE" },	       /* ietf-dnsop-extended-error-16 */
-	{ 16, "CLIENT-TAG" },  /* draft-bellis-dnsop-edns-tags */
-	{ 17, "SERVER-TAG" },  /* draft-bellis-dnsop-edns-tags */
-	{ 26946, "DEVICEID" }, /* Brian Hartvigsen */
+	{ 1, "LLQ" },		  /* draft-sekar-dns-llq */
+	{ 2, "UL" },		  /* draft-ietf-dnssd-update-lease */
+	{ 3, "NSID" },		  /* RFC 5001 */
+	{ 5, "DAU" },		  /* RFC 6975 */
+	{ 6, "DHU" },		  /* RFC 6975 */
+	{ 7, "N3U" },		  /* RFC 6975 */
+	{ 8, "ECS" },		  /* RFC 7871 */
+	{ 9, "EXPIRE" },	  /* RFC 7314 */
+	{ 10, "COOKIE" },	  /* RFC 7873 */
+	{ 11, "KEEPALIVE" },	  /* RFC 7828 */
+	{ 12, "PADDING" },	  /* RFC 7830 */
+	{ 12, "PAD" },		  /* shorthand */
+	{ 13, "CHAIN" },	  /* RFC 7901 */
+	{ 14, "KEY-TAG" },	  /* RFC 8145 */
+	{ 15, "EDE" },		  /* ietf-dnsop-extended-error-16 */
+	{ 16, "CLIENT-TAG" },	  /* draft-bellis-dnsop-edns-tags */
+	{ 17, "SERVER-TAG" },	  /* draft-bellis-dnsop-edns-tags */
+	{ 18, "REPORT-CHANNEL" }, /* RFC 9567 */
+	{ 18, "RC" },		  /* shorthand */
+	{ 19, "ZONEVERSION" },	  /* RFC 9660 */
+	{ 26946, "DEVICEID" },	  /* Brian Hartvigsen */
 };

 #define N_EDNS_OPTNAMES (sizeof(optnames) / sizeof(optnames[0]))
@@ -1549,13 +1543,13 @@ check_if_queries_done(dig_lookup_t *l, dig_query_t *except_q) {
 		if (!q->started || isc_refcount_current(&q->references) > 1) {
 			if (!q->canceled && q != except_q) {
 				debug("there is a pending query %p", q);
-				return (false);
+				return false;
 			}
 		}
 		q = ISC_LIST_NEXT(q, link);
 	}

-	return (true);
+	return true;
 }

 static void
@@ -1865,7 +1859,7 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section) {
 			result = dns_message_findtype(name, dns_rdatatype_soa,
 						      0, &rdataset);
 			if (result == ISC_R_SUCCESS) {
-				return (0);
+				return 0;
 			}
 		}
 		rdataset = NULL;
@@ -1968,7 +1962,7 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section) {
 	if (lookup == NULL && section == DNS_SECTION_ANSWER &&
 	    (query->lookup->trace || query->lookup->ns_search_only))
 	{
-		return (followup_lookup(msg, query, DNS_SECTION_AUTHORITY));
+		return followup_lookup(msg, query, DNS_SECTION_AUTHORITY);
 	}

 	/*
@@ -2000,7 +1994,7 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section) {
 				    link);
 	}

-	return (numLookups);
+	return numLookups;
 }

 /*%
@@ -2027,7 +2021,7 @@ next_origin(dig_lookup_t *oldlookup) {
 		 * We're not using a search list, so don't even think
 		 * about finding the next entry.
 		 */
-		return (false);
+		return false;
 	}

 	/*
@@ -2039,14 +2033,14 @@ next_origin(dig_lookup_t *oldlookup) {
 	    (dns_name_isabsolute(name) ||
 	     (int)dns_name_countlabels(name) > ndots))
 	{
-		return (false);
+		return false;
 	}

 	if (oldlookup->origin == NULL && !oldlookup->need_search) {
 		/*
 		 * Then we just did rootorg; there's nothing left.
 		 */
-		return (false);
+		return false;
 	}
 	if (oldlookup->origin == NULL && oldlookup->need_search) {
 		newlookup = requeue_lookup(oldlookup, true);
@@ -2055,13 +2049,13 @@ next_origin(dig_lookup_t *oldlookup) {
 	} else {
 		search = ISC_LIST_NEXT(oldlookup->origin, link);
 		if (search == NULL && oldlookup->done_as_is) {
-			return (false);
+			return false;
 		}
 		newlookup = requeue_lookup(oldlookup, true);
 		newlookup->origin = search;
 	}
 	cancel_lookup(oldlookup);
-	return (true);
+	return true;
 }

 /*%
@@ -2164,7 +2158,7 @@ _new_query(dig_lookup_t *lookup, char *servname, char *userarg,
 	ISC_LINK_INIT(query, link);

 	query->magic = DIG_QUERY_MAGIC;
-	return (query);
+	return query;
 }

 /*%
@@ -2298,7 +2292,7 @@ setup_lookup(dig_lookup_t *lookup) {
 				dns_message_puttempname(lookup->sendmsg,
 							&lookup->oname);
 				if (result == DNS_R_NAMETOOLONG) {
-					return (false);
+					return false;
 				}
 				fatal("'%s' is not in legal name syntax (%s)",
 				      lookup->textname,
@@ -2325,7 +2319,7 @@ setup_lookup(dig_lookup_t *lookup) {
 				     isc_result_totext(result));
 #if TARGET_OS_IPHONE
 				clear_current_lookup();
-				return (false);
+				return false;
 #else  /* if TARGET_OS_IPHONE */
 				cleanup_openssl_refs();
 				digexit();
@@ -2658,7 +2652,7 @@ setup_lookup(dig_lookup_t *lookup) {
 		ISC_LIST_ENQUEUE(lookup->q, query, link);
 	}

-	return (true);
+	return true;
 }

 /*%
@@ -2803,7 +2797,7 @@ get_create_tls_context(dig_query_t *query, const bool is_https,

 	if (query->lookup->tls_key_file_set != query->lookup->tls_cert_file_set)
 	{
-		return (NULL);
+		return NULL;
 	}

 	isc_sockaddr_format(&query->sockaddr, tlsctxname, sizeof(tlsctxname));
@@ -2882,7 +2876,7 @@ get_create_tls_context(dig_query_t *query, const bool is_https,
 			INSIST(*psess_cache == NULL);
 			*psess_cache = sess_cache;
 		}
-		return (ctx);
+		return ctx;
 	}

 	if (psess_cache != NULL) {
@@ -2891,7 +2885,7 @@ get_create_tls_context(dig_query_t *query, const bool is_https,
 	}

 	INSIST(!query->lookup->tls_ca_set || found_store != NULL);
-	return (found_ctx);
+	return found_ctx;
 failure:
 	if (ctx != NULL) {
 		isc_tlsctx_free(&ctx);
@@ -2906,7 +2900,7 @@ failure:
 	if (store != NULL && store != found_store) {
 		isc_tls_cert_store_free(&store);
 	}
-	return (NULL);
+	return NULL;
 }

 static void
@@ -3231,7 +3225,7 @@ udp_ready(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
 			start_udp(next);
 			check_if_done();
 		} else {
-			dighost_error("no servers could be reached\n");
+			dighost_error("no servers could be reached");
 			clear_current_lookup();
 		}

@@ -3288,6 +3282,10 @@ start_udp(dig_query_t *query) {
 		return;
 	}

+	if (!port_set) {
+		port = 53;
+	}
+
 	result = get_address(query->servname, port, &query->sockaddr);
 	if (result != ISC_R_SUCCESS) {
 		/* This servname doesn't have an address. */
@@ -3356,12 +3354,12 @@ try_next_server(dig_lookup_t *lookup) {

 	current_query = lookup->current_query;
 	if (current_query == NULL || !ISC_LINK_LINKED(current_query, link)) {
-		return (false);
+		return false;
 	}

 	next_query = ISC_LIST_NEXT(current_query, link);
 	if (next_query == NULL) {
-		return (false);
+		return false;
 	}

 	debug("trying next server...");
@@ -3372,7 +3370,7 @@ try_next_server(dig_lookup_t *lookup) {
 		start_udp(next_query);
 	}

-	return (true);
+	return true;
 }

 static void
@@ -3423,10 +3421,10 @@ force_next(dig_query_t *query) {
 		isc_netaddr_fromsockaddr(&netaddr, &query->sockaddr);
 		isc_netaddr_format(&netaddr, buf, sizeof(buf));

-		dighost_error("no response from %s\n", buf);
+		dighost_error("no response from %s", buf);
 	} else {
 		printf("%s", l->cmdline);
-		dighost_error("no servers could be reached\n");
+		dighost_error("no servers could be reached");
 	}

 	if (exitcode < 9) {
@@ -3650,7 +3648,7 @@ tcp_connected(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
 			start_tcp(next);
 			check_if_done();
 		} else {
-			dighost_error("no servers could be reached\n");
+			dighost_error("no servers could be reached");
 			clear_current_lookup();
 		}

@@ -3711,7 +3709,7 @@ check_for_more_data(dig_lookup_t *lookup, dig_query_t *query,
 	result = dns_message_firstname(msg, DNS_SECTION_ANSWER);
 	if (result != ISC_R_SUCCESS) {
 		puts("; Transfer failed.");
-		return (true);
+		return true;
 	}
 	do {
 		dns_name_t *name;
@@ -3737,7 +3735,7 @@ check_for_more_data(dig_lookup_t *lookup, dig_query_t *query,
 				{
 					puts("; Transfer failed.  "
 					     "Didn't start with SOA answer.");
-					return (true);
+					return true;
 				}
 				if ((!query->second_rr_rcvd) &&
 				    (rdata.type != dns_rdatatype_soa))
@@ -3817,10 +3815,10 @@ check_for_more_data(dig_lookup_t *lookup, dig_query_t *query,
 	isc_nmhandle_detach(&query->readhandle);
 	launch_next_query(query);
 	query_detach(&query);
-	return (false);
+	return false;
 doexit:
 	dighost_received(len, peer, query);
-	return (true);
+	return true;
 }

 static void
@@ -3914,7 +3912,7 @@ process_opt(dig_lookup_t *l, dns_message_t *msg) {

 static int
 ednsvers(dns_rdataset_t *opt) {
-	return ((opt->ttl >> 16) & 0xff);
+	return (opt->ttl >> 16) & 0xff;
 }

 /*%
@@ -4103,7 +4101,7 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
 			 * and cancel the lookup.
 			 */
 			printf("%s", l->cmdline);
-			dighost_error("no servers could be reached\n");
+			dighost_error("no servers could be reached");

 			if (exitcode < 9) {
 				exitcode = 9;
@@ -4128,8 +4126,7 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
 		if (l->tcp_mode) {
 			bool fail = true;
 			if (result == ISC_R_SUCCESS) {
-				if ((!query->first_soa_rcvd || query->warn_id))
-				{
+				if (!query->first_soa_rcvd || query->warn_id) {
 					dighost_warning("%s: ID mismatch: "
 							"expected ID %u, got "
 							"%u",
@@ -4237,7 +4234,15 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
 		goto keep_query;
 	}

-	if (msg->counts[DNS_SECTION_QUESTION] != 0) {
+	if (msg->counts[DNS_SECTION_QUESTION] == 0) {
+		if (l->doing_xfr) {
+			if (query->msg_count == 0) {
+				dighost_warning("missing question section");
+			}
+		} else if (!l->header_only && msg->opcode == dns_opcode_query) {
+			dighost_warning("missing question section");
+		}
+	} else {
 		match = true;
 		for (result = dns_message_firstname(msg, DNS_SECTION_QUESTION);
 		     result == ISC_R_SUCCESS && match;
@@ -4577,12 +4582,12 @@ get_address(char *host, in_port_t myport, isc_sockaddr_t *sockaddr) {
 	result = isc_getaddresses(host, myport, sockaddr, 1, &count);
 	isc_loopmgr_nonblocking(loopmgr);
 	if (result != ISC_R_SUCCESS) {
-		return (result);
+		return result;
 	}

 	INSIST(count == 1);

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 int
@@ -4604,7 +4609,7 @@ getaddresses(dig_lookup_t *lookup, const char *host, isc_result_t *resultp) {
 			fatal("couldn't get address for '%s': %s", host,
 			      isc_result_totext(result));
 		}
-		return (0);
+		return 0;
 	}

 	for (i = 0; i < count; i++) {
@@ -4614,7 +4619,7 @@ getaddresses(dig_lookup_t *lookup, const char *host, isc_result_t *resultp) {
 		ISC_LIST_APPEND(lookup->my_server_list, srv, link);
 	}

-	return (count);
+	return count;
 }

 /*%
@@ -4714,12 +4719,6 @@ cleanup_openssl_refs(void) {
 		debug("freeing SIG(0) key %p", sig0key);
 		dst_key_free(&sig0key);
 	}
-
-	if (is_dst_up) {
-		debug("destroy DST lib");
-		dst_lib_destroy();
-		is_dst_up = false;
-	}
 }

 /*%
@@ -4750,9 +4749,6 @@ destroy_libs(void) {
 		isc_buffer_free(&namebuf);
 	}

-	debug("Removing log context");
-	isc_log_destroy(&lctx);
-
 	debug("Destroy memory");
 	if (memdebugging != 0) {
 		isc_mem_stats(mctx, stderr);
@@ -4761,7 +4757,7 @@ destroy_libs(void) {
 	isc_managers_destroy(&mctx, &loopmgr, &netmgr);

 #if ENABLE_LEAK_DETECTION
-	isc__tls_setdestroycheck(true);
+	isc__crypto_setdestroycheck(true);
 	isc__uv_setdestroycheck(true);
 	isc__xml_setdestroycheck(true);
 #endif
@@ -4796,7 +4792,7 @@ idn_filter(isc_buffer_t *buffer, unsigned int start) {
 	}
 	resetlocale(LC_ALL);
 	if (res != IDN2_OK) {
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	/*
@@ -4804,14 +4800,14 @@ idn_filter(isc_buffer_t *buffer, unsigned int start) {
 	 */
 	dstlen = strlen(dst);
 	if (isc_buffer_length(buffer) < start + dstlen) {
-		return (ISC_R_NOSPACE);
+		return ISC_R_NOSPACE;
 	}
 	isc_buffer_subtract(buffer, srclen);
 	memmove(isc_buffer_used(buffer), dst, dstlen);
 	isc_buffer_add(buffer, dstlen);

 	idn2_free(dst);
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 /*%
@@ -4877,8 +4873,8 @@ dig_idnsetup(dig_lookup_t *lookup, bool active) {
 bool
 dig_lookup_is_tls(const dig_lookup_t *lookup) {
 	if (lookup->tls_mode || (lookup->tls_ca_set && !lookup->https_mode)) {
-		return (true);
+		return true;
 	}

-	return (false);
+	return false;
 }
@@ -293,13 +293,13 @@ getaddresses(dig_lookup_t *lookup, const char *host, isc_result_t *resultp);
 isc_result_t
 get_reverse(char *reverse, size_t len, char *value, bool strict);

-noreturn void
+ISC_NORETURN void
 fatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);

 void
 warn(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);

-noreturn void
+ISC_NORETURN void
 digexit(void);

 void
@@ -96,10 +96,10 @@ rcode_totext(dns_rcode_t rcode) {
 	} else {
 		totext.consttext = rcodetext[rcode];
 	}
-	return (totext.deconsttext);
+	return totext.deconsttext;
 }

-noreturn static void
+ISC_NORETURN static void
 show_usage(void);

 static void
@@ -183,6 +183,7 @@ retry:
 	result = dns_rdata_totext(rdata, NULL, b);
 	if (result == ISC_R_NOSPACE) {
 		isc_buffer_free(&b);
+		INSIST(bufsize <= (UINT_MAX / 2));
 		bufsize *= 2;
 		goto retry;
 	}
@@ -221,9 +222,9 @@ printsection(dns_message_t *msg, dns_section_t sectionid,

 	result = dns_message_firstname(msg, sectionid);
 	if (result == ISC_R_NOMORE) {
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	} else if (result != ISC_R_SUCCESS) {
-		return (result);
+		return result;
 	}

 	for (;;) {
@@ -261,7 +262,7 @@ printsection(dns_message_t *msg, dns_section_t sectionid,
 							     print_name, false,
 							     no_rdata, &target);
 				if (result != ISC_R_SUCCESS) {
-					return (result);
+					return result;
 				}
 #ifdef USEINITALWS
 				if (first) {
@@ -316,11 +317,11 @@ printsection(dns_message_t *msg, dns_section_t sectionid,
 		if (result == ISC_R_NOMORE) {
 			break;
 		} else if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
 	}

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static isc_result_t
@@ -340,12 +341,12 @@ printrdata(dns_message_t *msg, dns_rdataset_t *rdataset,

 	result = dns_rdataset_totext(rdataset, owner, false, false, &target);
 	if (result != ISC_R_SUCCESS) {
-		return (result);
+		return result;
 	}
 	isc_buffer_usedregion(&target, &r);
 	printf("%.*s", (int)r.length, (char *)r.base);

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static void
@@ -422,7 +423,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 				       : query->lookup->textname,
 			       msg->rcode, rcode_totext(msg->rcode));
 		}
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	if (default_lookups && query->lookup->rdtype == dns_rdatatype_a) {
@@ -516,7 +517,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		result = printsection(msg, DNS_SECTION_QUESTION, "QUESTION",
 				      true, query);
 		if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
 	}
 	if (!ISC_LIST_EMPTY(msg->sections[DNS_SECTION_ANSWER])) {
@@ -526,7 +527,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		result = printsection(msg, DNS_SECTION_ANSWER, "ANSWER",
 				      !short_form, query);
 		if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
 	}

@@ -537,7 +538,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		result = printsection(msg, DNS_SECTION_AUTHORITY, "AUTHORITY",
 				      true, query);
 		if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
 	}
 	if (!ISC_LIST_EMPTY(msg->sections[DNS_SECTION_ADDITIONAL]) &&
@@ -547,7 +548,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		result = printsection(msg, DNS_SECTION_ADDITIONAL, "ADDITIONAL",
 				      true, query);
 		if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
 	}
 	if ((tsig != NULL) && !short_form) {
@@ -555,7 +556,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		result = printrdata(msg, tsig, tsigname, "PSEUDOSECTION TSIG",
 				    true);
 		if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
 	}
 	if (!short_form) {
@@ -573,7 +574,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		printf("%s has no %s record\n", namestr, typestr);
 	}
 	seen_error = force_error;
-	return (result);
+	return result;
 }

 static const char *optstring = "46aAc:dilnm:p:rst:vVwCDN:R:TUW:";
@@ -916,5 +917,5 @@ main(int argc, char **argv) {
 	cancel_all();
 	destroy_libs();

-	return ((seen_error == 0) ? 0 : 1);
+	return (seen_error == 0) ? 0 : 1;
 }
@@ -128,7 +128,7 @@ rcode_totext(dns_rcode_t rcode) {
 	} else {
 		totext.consttext = rcodetext[rcode];
 	}
-	return (totext.deconsttext);
+	return totext.deconsttext;
 }

 static void
@@ -189,6 +189,7 @@ printrdata(dns_rdata_t *rdata) {
 			check_result(result, "dns_rdata_totext");
 		}
 		isc_buffer_free(&b);
+		INSIST(size <= (UINT_MAX / 2));
 		size *= 2;
 	}
 }
@@ -209,9 +210,9 @@ printsection(dig_query_t *query, dns_message_t *msg, bool headers,

 	result = dns_message_firstname(msg, section);
 	if (result == ISC_R_NOMORE) {
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	} else if (result != ISC_R_SUCCESS) {
-		return (result);
+		return result;
 	}
 	for (;;) {
 		name = NULL;
@@ -255,10 +256,10 @@ printsection(dig_query_t *query, dns_message_t *msg, bool headers,
 		if (result == ISC_R_NOMORE) {
 			break;
 		} else if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
 	}
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static isc_result_t
@@ -293,9 +294,9 @@ detailsection(dig_query_t *query, dns_message_t *msg, bool headers,

 	result = dns_message_firstname(msg, section);
 	if (result == ISC_R_NOMORE) {
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	} else if (result != ISC_R_SUCCESS) {
-		return (result);
+		return result;
 	}
 	for (;;) {
 		name = NULL;
@@ -337,10 +338,10 @@ detailsection(dig_query_t *query, dns_message_t *msg, bool headers,
 		if (result == ISC_R_NOMORE) {
 			break;
 		} else if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
 	}
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static void
@@ -423,7 +424,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,

 		/* the lookup failed */
 		print_error |= 1;
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	if (default_lookups && query->lookup->rdtype == dns_rdatatype_a) {
@@ -477,7 +478,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		printsection(query, msg, headers, DNS_SECTION_AUTHORITY);
 		printsection(query, msg, headers, DNS_SECTION_ADDITIONAL);
 	}
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static void
@@ -536,10 +537,10 @@ testtype(char *typetext) {
 	tr.length = strlen(typetext);
 	result = dns_rdatatype_fromtext(&rdtype, &tr);
 	if (result == ISC_R_SUCCESS) {
-		return (true);
+		return true;
 	} else {
 		printf("unknown query type: %s\n", typetext);
-		return (false);
+		return false;
 	}
 }

@@ -553,10 +554,10 @@ testclass(char *typetext) {
 	tr.length = strlen(typetext);
 	result = dns_rdataclass_fromtext(&rdclass, &tr);
 	if (result == ISC_R_SUCCESS) {
-		return (true);
+		return true;
 	} else {
 		printf("unknown query class: %s\n", typetext);
-		return (false);
+		return false;
 	}
 }

@@ -835,7 +836,7 @@ fgets_next_command(void *arg) {
 	cmdline = fgets(cmdlinebuf, COMMSIZE, stdin);
 }

-noreturn static void
+ISC_NORETURN static void
 usage(void);

 static void
@@ -974,5 +975,5 @@ main(int argc, char **argv) {
 	cancel_all();
 	destroy_libs();

-	return (query_error | print_error);
+	return query_error | print_error;
 }
@@ -48,10 +48,10 @@ readline(const char *prompt) {
 	line = fgets(buf, RL_MAXCMD, stdin);
 	if (line == NULL) {
 		free(buf);
-		return (NULL);
+		return NULL;
 	}
-	return (buf);
-};
+	return buf;
+}

 #define add_history(line)

@@ -29,6 +29,7 @@
 #include <isc/dir.h>
 #include <isc/file.h>
 #include <isc/hash.h>
+#include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
 #include <isc/serial.h>
@@ -43,7 +44,6 @@
 #include <dns/ds.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
-#include <dns/log.h>
 #include <dns/master.h>
 #include <dns/name.h>
 #include <dns/rdata.h>
@@ -63,7 +63,6 @@ const char *program = "dnssec-cds";
 /*
 * Infrastructure
 */
-static isc_log_t *lctx = NULL;
 static isc_mem_t *mctx = NULL;

 /*
@@ -144,7 +143,6 @@ static dns_dbnode_t *parent_node = NULL;
 static dns_db_t *update_db = NULL;
 static dns_dbnode_t *update_node = NULL;
 static dns_dbversion_t *update_version = NULL;
-static bool cleanup_dst = false;
 static bool print_mem_stats = false;

 static void
@@ -395,7 +393,7 @@ formatset(dns_rdataset_t *rdataset) {
 	}

 	isc_buffer_putuint8(buf, 0);
-	return (buf);
+	return buf;
 }

 static void
@@ -505,14 +503,14 @@ match_key_dsset(keyinfo_t *ki, dns_rdataset_t *dsset, strictness_t strictness) {
 			vbprintf(1, "found matching %s %d %d %d\n",
 				 c ? "CDS" : "DS", ds.key_tag, ds.algorithm,
 				 ds.digest_type);
-			return (true);
+			return true;
 		} else if (strictness == TIGHT) {
 			vbprintf(0,
 				 "key does not match %s %d %d %d "
 				 "when it looks like it should\n",
 				 c ? "CDS" : "DS", ds.key_tag, ds.algorithm,
 				 ds.digest_type);
-			return (false);
+			return false;
 		}
 	}

@@ -521,7 +519,7 @@ match_key_dsset(keyinfo_t *ki, dns_rdataset_t *dsset, strictness_t strictness) {
 		 ki->rdata.type == dns_rdatatype_cdnskey ? "CDNSKEY" : "DNSKEY",
 		 ki->tag, ki->algo);

-	return (false);
+	return false;
 }

 /*
@@ -575,7 +573,7 @@ match_keyset_dsset(dns_rdataset_t *keyset, dns_rdataset_t *dsset,
 		}
 	}

-	return (keytable);
+	return keytable;
 }

 static void
@@ -681,7 +679,7 @@ matching_sigs(keyinfo_t *keytbl, dns_rdataset_t *rdataset,
 		}
 	}

-	return (algo);
+	return algo;
 }

 /*
@@ -698,7 +696,7 @@ signed_loose(dns_secalg_t *algo) {
 		}
 	}
 	isc_mem_cput(mctx, algo, nkey, sizeof(algo[0]));
-	return (ok);
+	return ok;
 }

 /*
@@ -740,7 +738,7 @@ signed_strict(dns_rdataset_t *dsset, dns_secalg_t *algo) {
 	}

 	isc_mem_cput(mctx, algo, nkey, sizeof(algo[0]));
-	return (all_ok);
+	return all_ok;
 }

 /*
@@ -761,10 +759,10 @@ ds_from_cds(isc_buffer_t *buf, dns_rdata_t *rds, dns_dsdigest_t dt,
 	ds.common.rdtype = dns_rdatatype_ds;

 	if (ds.digest_type != dt) {
-		return (ISC_R_IGNORE);
+		return ISC_R_IGNORE;
 	}

-	return (dns_rdata_fromstruct(rds, rdclass, dns_rdatatype_ds, &ds, buf));
+	return dns_rdata_fromstruct(rds, rdclass, dns_rdatatype_ds, &ds, buf);
 }

 static isc_result_t
@@ -777,7 +775,7 @@ ds_from_cdnskey(isc_buffer_t *buf, dns_rdata_t *ds, dns_dsdigest_t dt,

 	isc_buffer_availableregion(buf, &r);
 	if (r.length < DNS_DS_BUFFERSIZE) {
-		return (ISC_R_NOSPACE);
+		return ISC_R_NOSPACE;
 	}

 	result = dns_ds_buildrdata(name, cdnskey, dt, r.base, ds);
@@ -785,7 +783,7 @@ ds_from_cdnskey(isc_buffer_t *buf, dns_rdata_t *ds, dns_dsdigest_t dt,
 		isc_buffer_add(buf, DNS_DS_BUFFERSIZE);
 	}

-	return (result);
+	return result;
 }

 static isc_result_t
@@ -816,14 +814,14 @@ append_new_ds_set(ds_maker_func_t *ds_from_rdata, isc_buffer_t *buf,
 			continue;
 		case ISC_R_NOSPACE:
 			isc_mem_put(mctx, ds, sizeof(*ds));
-			return (result);
+			return result;
 		default:
 			isc_mem_put(mctx, ds, sizeof(*ds));
 			check_result(result, "ds_from_rdata()");
 		}
 	}

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static void
@@ -868,8 +866,8 @@ make_new_ds_set(ds_maker_func_t *ds_from_rdata, uint32_t ttl,

 static int
 rdata_cmp(const void *rdata1, const void *rdata2) {
-	return (dns_rdata_compare((const dns_rdata_t *)rdata1,
-				  (const dns_rdata_t *)rdata2));
+	return dns_rdata_compare((const dns_rdata_t *)rdata1,
+				 (const dns_rdata_t *)rdata2);
 }

 /*
@@ -950,7 +948,7 @@ consistent_digests(dns_rdataset_t *dsset) {
 	isc_mem_cput(mctx, ds, n, sizeof(dns_rdata_ds_t));
 	isc_mem_cput(mctx, arrdata, n, sizeof(dns_rdata_t));

-	return (match);
+	return match;
 }

 static void
@@ -1029,7 +1027,7 @@ nsdiff(uint32_t ttl, dns_rdataset_t *oldset, dns_rdataset_t *newset) {
 	}
 }

-noreturn static void
+ISC_NORETURN static void
 usage(void);

 static void
@@ -1071,12 +1069,6 @@ cleanup(void) {
 		free_keytable(&new_key_tbl);
 	}
 	free_all_sets();
-	if (lctx != NULL) {
-		cleanup_logging(&lctx);
-	}
-	if (cleanup_dst) {
-		dst_lib_destroy();
-	}
 	if (mctx != NULL) {
 		if (print_mem_stats && verbose > 10) {
 			isc_mem_stats(mctx, stdout);
@@ -1090,7 +1082,6 @@ main(int argc, char *argv[]) {
 	const char *child_path = NULL;
 	const char *ds_path = NULL;
 	const char *inplace = NULL;
-	isc_result_t result;
 	bool prefer_cdnskey = false;
 	bool nsupdate = false;
 	uint32_t ttl = 0;
@@ -1178,14 +1169,7 @@ main(int argc, char *argv[]) {
 		dtype[0] = DNS_DSDIGEST_SHA256;
 	}

-	setup_logging(mctx, &lctx);
-
-	result = dst_lib_init(mctx, NULL);
-	if (result != ISC_R_SUCCESS) {
-		fatal("could not initialize dst: %s",
-		      isc_result_totext(result));
-	}
-	cleanup_dst = true;
+	setup_logging();

 	if (ds_path == NULL) {
 		fatal("missing -d DS pathname");
@@ -1355,5 +1339,5 @@ cleanup:
 	print_mem_stats = true;
 	cleanup();

-	return (0);
+	return 0;
 }
@@ -22,6 +22,7 @@
 #include <isc/commandline.h>
 #include <isc/dir.h>
 #include <isc/hash.h>
+#include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
 #include <isc/string.h>
@@ -33,7 +34,6 @@
 #include <dns/ds.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
-#include <dns/log.h>
 #include <dns/master.h>
 #include <dns/name.h>
 #include <dns/rdata.h>
@@ -66,7 +66,7 @@ initname(char *setname) {
 	isc_buffer_init(&buf, setname, strlen(setname));
 	isc_buffer_add(&buf, strlen(setname));
 	result = dns_name_fromtext(name, &buf, dns_rootname, 0, NULL);
-	return (result);
+	return result;
 }

 static void
@@ -138,7 +138,7 @@ loadset(const char *filename, dns_rdataset_t *rdataset) {
 	if (db != NULL) {
 		dns_db_detach(&db);
 	}
-	return (result);
+	return result;
 }

 static isc_result_t
@@ -153,7 +153,7 @@ loadkeyset(char *dirname, dns_rdataset_t *rdataset) {
 	if (dirname != NULL) {
 		/* allow room for a trailing slash */
 		if (strlen(dirname) >= isc_buffer_availablelength(&buf)) {
-			return (ISC_R_NOSPACE);
+			return ISC_R_NOSPACE;
 		}
 		isc_buffer_putstr(&buf, dirname);
 		if (dirname[strlen(dirname) - 1] != '/') {
@@ -162,18 +162,18 @@ loadkeyset(char *dirname, dns_rdataset_t *rdataset) {
 	}

 	if (isc_buffer_availablelength(&buf) < 7) {
-		return (ISC_R_NOSPACE);
+		return ISC_R_NOSPACE;
 	}
 	isc_buffer_putstr(&buf, "keyset-");

 	result = dns_name_tofilenametext(name, false, &buf);
 	check_result(result, "dns_name_tofilenametext()");
 	if (isc_buffer_availablelength(&buf) == 0) {
-		return (ISC_R_NOSPACE);
+		return ISC_R_NOSPACE;
 	}
 	isc_buffer_putuint8(&buf, 0);

-	return (loadset(filename, rdataset));
+	return loadset(filename, rdataset);
 }

 static void
@@ -324,7 +324,7 @@ emits(bool showall, bool cds, dns_rdata_t *rdata) {
 	}
 }

-noreturn static void
+ISC_NORETURN static void
 usage(void);

 static void
@@ -368,7 +368,6 @@ main(int argc, char **argv) {
 	bool usekeyset = false;
 	bool showall = false;
 	isc_result_t result;
-	isc_log_t *log = NULL;
 	dns_rdataset_t rdataset;
 	dns_rdata_t rdata;

@@ -489,13 +488,7 @@ main(int argc, char **argv) {
 		fatal("extraneous arguments");
 	}

-	result = dst_lib_init(mctx, NULL);
-	if (result != ISC_R_SUCCESS) {
-		fatal("could not initialize dst: %s",
-		      isc_result_totext(result));
-	}
-
-	setup_logging(mctx, &log);
+	setup_logging();

 	dns_rdataset_init(&rdataset);

@@ -548,8 +541,6 @@ main(int argc, char **argv) {
 	if (dns_rdataset_isassociated(&rdataset)) {
 		dns_rdataset_disassociate(&rdataset);
 	}
-	cleanup_logging(&log);
-	dst_lib_destroy();
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
@@ -558,8 +549,8 @@ main(int argc, char **argv) {
 	fflush(stdout);
 	if (ferror(stdout)) {
 		fprintf(stderr, "write error\n");
-		return (1);
+		return 1;
 	} else {
-		return (0);
+		return 0;
 	}
 }
@@ -20,6 +20,7 @@
 #include <isc/buffer.h>
 #include <isc/commandline.h>
 #include <isc/hash.h>
+#include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
 #include <isc/string.h>
@@ -31,7 +32,6 @@
 #include <dns/ds.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
-#include <dns/log.h>
 #include <dns/master.h>
 #include <dns/name.h>
 #include <dns/rdata.h>
@@ -68,7 +68,7 @@ initname(char *setname) {
 	isc_buffer_init(&buf, setname, strlen(setname));
 	isc_buffer_add(&buf, strlen(setname));
 	result = dns_name_fromtext(name, &buf, dns_rootname, 0, NULL);
-	return (result);
+	return result;
 }

 static void
@@ -141,7 +141,7 @@ loadset(const char *filename, dns_rdataset_t *rdataset) {
 	if (db != NULL) {
 		dns_db_detach(&db);
 	}
-	return (result);
+	return result;
 }

 static void
@@ -262,7 +262,7 @@ emit(const char *dir, dns_rdata_t *rdata) {
 	dst_key_free(&key);
 }

-noreturn static void
+ISC_NORETURN static void
 usage(void);

 static void
@@ -299,7 +299,6 @@ main(int argc, char **argv) {
 	char *endp;
 	int ch;
 	isc_result_t result;
-	isc_log_t *log = NULL;
 	dns_rdataset_t rdataset;
 	dns_rdata_t rdata;
 	isc_stdtime_t now = isc_stdtime_now();
@@ -408,13 +407,7 @@ main(int argc, char **argv) {
 		fatal("extraneous arguments");
 	}

-	result = dst_lib_init(mctx, NULL);
-	if (result != ISC_R_SUCCESS) {
-		fatal("could not initialize dst: %s",
-		      isc_result_totext(result));
-	}
-
-	setup_logging(mctx, &log);
+	setup_logging();

 	dns_rdataset_init(&rdataset);

@@ -458,8 +451,6 @@ main(int argc, char **argv) {
 	if (dns_rdataset_isassociated(&rdataset)) {
 		dns_rdataset_disassociate(&rdataset);
 	}
-	cleanup_logging(&log);
-	dst_lib_destroy();
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
@@ -468,8 +459,8 @@ main(int argc, char **argv) {
 	fflush(stdout);
 	if (ferror(stdout)) {
 		fprintf(stderr, "write error\n");
-		return (1);
+		return 1;
 	} else {
-		return (0);
+		return 0;
 	}
 }
@@ -21,6 +21,7 @@
 #include <isc/attributes.h>
 #include <isc/buffer.h>
 #include <isc/commandline.h>
+#include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/region.h>
 #include <isc/result.h>
@@ -30,7 +31,6 @@
 #include <dns/dnssec.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
-#include <dns/log.h>
 #include <dns/name.h>
 #include <dns/rdataclass.h>
 #include <dns/secalg.h>
@@ -43,7 +43,9 @@

 const char *program = "dnssec-keyfromlabel";

-noreturn static void
+static uint16_t tag_min = 0, tag_max = 0xffff;
+
+ISC_NORETURN static void
 usage(void);

 static void
@@ -63,13 +65,12 @@ usage(void) {
 			"        ED25519 | ED448\n");
 	fprintf(stderr, "    -3: use NSEC3-capable algorithm\n");
 	fprintf(stderr, "    -c class (default: IN)\n");
-	fprintf(stderr, "    -E <engine>:\n");
-	fprintf(stderr, "        name of an OpenSSL engine to use\n");
 	fprintf(stderr, "    -f keyflag: KSK | REVOKE\n");
 	fprintf(stderr, "    -K directory: directory in which to place "
 			"key files\n");
 	fprintf(stderr, "    -k: generate a TYPE=KEY key\n");
 	fprintf(stderr, "    -L ttl: default key TTL\n");
+	fprintf(stderr, "    -M <min>:<max>: allowed Key ID range\n");
 	fprintf(stderr, "    -n nametype: ZONE | HOST | ENTITY | USER | "
 			"OTHER\n");
 	fprintf(stderr, "        (DNSKEY generation defaults to ZONE\n");
@@ -112,7 +113,6 @@ main(int argc, char **argv) {
 	const char *directory = NULL;
 	const char *predecessor = NULL;
 	dst_key_t *prevkey = NULL;
-	const char *engine = NULL;
 	char *classname = NULL;
 	char *endp;
 	dst_key_t *key = NULL;
@@ -128,7 +128,6 @@ main(int argc, char **argv) {
 	isc_textregion_t r;
 	char filename[255];
 	isc_buffer_t buf;
-	isc_log_t *log = NULL;
 	dns_rdataclass_t rdclass;
 	int options = DST_TYPE_PRIVATE | DST_TYPE_PUBLIC;
 	char *label = NULL;
@@ -160,7 +159,7 @@ main(int argc, char **argv) {

 	isc_commandline_errprint = false;

-#define CMDLINE_FLAGS "3A:a:Cc:D:E:Ff:GhI:i:kK:L:l:n:P:p:R:S:t:v:Vy"
+#define CMDLINE_FLAGS "3A:a:Cc:D:E:Ff:GhI:i:kK:L:l:M:n:P:p:R:S:t:v:Vy"
 	while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (ch) {
 		case '3':
@@ -176,7 +175,7 @@ main(int argc, char **argv) {
 			classname = isc_commandline_argument;
 			break;
 		case 'E':
-			engine = isc_commandline_argument;
+			fatal("%s", isc_result_totext(DST_R_NOENGINE));
 			break;
 		case 'f':
 			c = (unsigned char)(isc_commandline_argument[0]);
@@ -207,6 +206,20 @@ main(int argc, char **argv) {
 		case 'l':
 			label = isc_mem_strdup(mctx, isc_commandline_argument);
 			break;
+		case 'M': {
+			unsigned long ul;
+			tag_min = ul = strtoul(isc_commandline_argument, &endp,
+					       10);
+			if (*endp != ':' || ul > 0xffff) {
+				fatal("-M range invalid");
+			}
+			tag_max = ul = strtoul(endp + 1, &endp, 10);
+			if (*endp != '\0' || ul > 0xffff || tag_max <= tag_min)
+			{
+				fatal("-M range invalid");
+			}
+			break;
+		}
 		case 'n':
 			nametype = isc_commandline_argument;
 			break;
@@ -335,12 +348,7 @@ main(int argc, char **argv) {
 		}
 	}

-	ret = dst_lib_init(mctx, engine);
-	if (ret != ISC_R_SUCCESS) {
-		fatal("could not initialize dst: %s", isc_result_totext(ret));
-	}
-
-	setup_logging(mctx, &log);
+	setup_logging();

 	if (predecessor == NULL) {
 		if (label == NULL) {
@@ -595,8 +603,8 @@ main(int argc, char **argv) {
 	isc_buffer_init(&buf, filename, sizeof(filename) - 1);

 	/* associate the key */
-	ret = dst_key_fromlabel(name, alg, flags, protocol, rdclass, engine,
-				label, NULL, mctx, &key);
+	ret = dst_key_fromlabel(name, alg, flags, protocol, rdclass, label,
+				NULL, mctx, &key);

 	if (ret != ISC_R_SUCCESS) {
 		char namestr[DNS_NAME_FORMATSIZE];
@@ -686,7 +694,8 @@ main(int argc, char **argv) {
 	 * is a risk of ID collision due to this key or another key
 	 * being revoked.
 	 */
-	if (key_collision(key, name, directory, mctx, &exact)) {
+	if (key_collision(key, name, directory, mctx, tag_min, tag_max, &exact))
+	{
 		isc_buffer_clear(&buf);
 		ret = dst_key_buildfilename(key, 0, directory, &buf);
 		if (ret != ISC_R_SUCCESS) {
@@ -731,8 +740,6 @@ main(int argc, char **argv) {
 		dst_key_free(&prevkey);
 	}

-	cleanup_logging(&log);
-	dst_lib_destroy();
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
@@ -743,5 +750,5 @@ main(int argc, char **argv) {
 		free(freeit);
 	}

-	return (0);
+	return 0;
 }
@@ -21,7 +21,7 @@ dnssec-keyfromlabel - DNSSEC key generation tool
 Synopsis
 ~~~~~~~~

-:program:`dnssec-keyfromlabel` {**-l** label} [**-3**] [**-a** algorithm] [**-A** date/offset] [**-c** class] [**-D** date/offset] [**-D** sync date/offset] [**-E** engine] [**-f** flag] [**-G**] [**-I** date/offset] [**-i** interval] [**-k**] [**-K** directory] [**-L** ttl] [**-n** nametype] [**-P** date/offset] [**-P** sync date/offset] [**-p** protocol] [**-R** date/offset] [**-S** key] [**-t** type] [**-v** level] [**-V**] [**-y**] {name}
+:program:`dnssec-keyfromlabel` {**-l** label} [**-3**] [**-a** algorithm] [**-A** date/offset] [**-c** class] [**-D** date/offset] [**-D** sync date/offset] [**-f** flag] [**-G**] [**-I** date/offset] [**-i** interval] [**-k**] [**-K** directory] [**-L** ttl] [**-M** tag_min:tag_max] [**-n** nametype] [**-P** date/offset] [**-P** sync date/offset] [**-p** protocol] [**-R** date/offset] [**-S** key] [**-t** type] [**-v** level] [**-V**] [**-y**] {name}

 Description
 ~~~~~~~~~~~
@@ -63,22 +63,12 @@ Options
   versions, then the NSEC3 version is used; for example,
   ``dnssec-keygen -3a RSASHA1`` specifies the NSEC3RSASHA1 algorithm.

-.. option:: -E engine
-
-   This option specifies the cryptographic hardware to use.
-
-   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
-   engine identifier that drives the cryptographic accelerator or
-   hardware service module (usually ``pkcs11``).
-
 .. option:: -l label

   This option specifies the label for a key pair in the crypto hardware.

   When BIND 9 is built with OpenSSL-based PKCS#11 support, the label is
-   an arbitrary string that identifies a particular key. It may be
-   preceded by an optional OpenSSL engine name, followed by a colon, as
-   in ``pkcs11:keylabel``.
+   an arbitrary string that identifies a particular key.

 .. option:: -n nametype

@@ -133,6 +123,18 @@ Options
   place, in which case the existing TTL would take precedence. Setting
   the default TTL to ``0`` or ``none`` removes it.

+.. option:: -M tag_min:tag_max
+
+   This option sets the range of key tag values
+   that ``dnssec-keyfromlabel`` will accept. If the key tag of the new
+   key or the key tag of the revoked version of the new key is
+   outside this range, the new key will be rejected.  This is
+   designed to be used when generating keys in a multi-signer
+   scenario, where each operator is given a range of key tags to
+   prevent collisions among different operators.  The valid
+   values for ``tag_min`` and ``tag_max`` are [0..65535].  The
+   default allows all key tag values to be accepted.
+
 .. option:: -p protocol

   This option sets the protocol value for the key. The protocol is a number between
@@ -39,6 +39,7 @@
 #include <isc/buffer.h>
 #include <isc/commandline.h>
 #include <isc/fips.h>
+#include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/region.h>
 #include <isc/result.h>
@@ -49,14 +50,13 @@
 #include <dns/fixedname.h>
 #include <dns/kasp.h>
 #include <dns/keyvalues.h>
-#include <dns/log.h>
 #include <dns/name.h>
 #include <dns/rdataclass.h>
 #include <dns/secalg.h>

 #include <dst/dst.h>

-#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
 #include <openssl/err.h>
 #include <openssl/provider.h>
 #endif
@@ -72,9 +72,7 @@ const char *program = "dnssec-keygen";
 static int min_rsa = 1024;
 static int min_dh = 128;

-isc_log_t *lctx = NULL;
-
-noreturn static void
+ISC_NORETURN static void
 usage(void);

 static void
@@ -91,6 +89,8 @@ struct keygen_ctx {
 	char *type;
 	int protocol;
 	int size;
+	uint16_t tag_min;
+	uint16_t tag_max;
 	int signatory;
 	dns_rdataclass_t rdclass;
 	int options;
@@ -176,11 +176,10 @@ usage(void) {
 	fprintf(stderr, "        (DNSKEY generation defaults to ZONE)\n");
 	fprintf(stderr, "    -c <class>: (default: IN)\n");
 	fprintf(stderr, "    -d <digest bits> (0 => max, default)\n");
-	fprintf(stderr, "    -E <engine>:\n");
-	fprintf(stderr, "        name of an OpenSSL engine to use\n");
 	fprintf(stderr, "    -f <keyflag>: ZSK | KSK | REVOKE\n");
 	fprintf(stderr, "    -F: FIPS mode\n");
 	fprintf(stderr, "    -L <ttl>: default key TTL\n");
+	fprintf(stderr, "    -M <min>:<max>: allowed Key ID range\n");
 	fprintf(stderr, "    -p <protocol>: (default: 3 [dnssec])\n");
 	fprintf(stderr, "    -s <strength>: strength value this key signs DNS "
 			"records with (default: 0)\n");
@@ -191,7 +190,7 @@ usage(void) {
 			"(default: AUTHCONF)\n");
 	fprintf(stderr, "    -h: print usage and exit\n");
 	fprintf(stderr, "    -m <memory debugging mode>:\n");
-	fprintf(stderr, "       usage | trace | record | size | mctx\n");
+	fprintf(stderr, "       usage | trace | record\n");
 	fprintf(stderr, "    -v <level>: set verbosity level (0 - 10)\n");
 	fprintf(stderr, "    -V: print version information\n");
 	fprintf(stderr, "Timing options:\n");
@@ -253,7 +252,6 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 	char filename[255];
 	char algstr[DNS_SECALG_FORMATSIZE];
 	uint16_t flags = 0;
-	int param = 0;
 	bool null_key = false;
 	bool conflict = false;
 	bool show_progress = false;
@@ -614,12 +612,12 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 				ctx->keystore, name, ctx->policy, ctx->rdclass,
 				mctx, ctx->alg, ctx->size, flags, &key);
 		} else if (!ctx->quiet && show_progress) {
-			ret = dst_key_generate(name, ctx->alg, ctx->size, param,
+			ret = dst_key_generate(name, ctx->alg, ctx->size, 0,
 					       flags, ctx->protocol,
 					       ctx->rdclass, NULL, mctx, &key,
 					       &progress);
 		} else {
-			ret = dst_key_generate(name, ctx->alg, ctx->size, param,
+			ret = dst_key_generate(name, ctx->alg, ctx->size, 0,
 					       flags, ctx->protocol,
 					       ctx->rdclass, NULL, mctx, &key,
 					       NULL);
@@ -758,7 +756,9 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 		 * if there is a risk of ID collision due to this key
 		 * or another key being revoked.
 		 */
-		if (key_collision(key, name, ctx->directory, mctx, NULL)) {
+		if (key_collision(key, name, ctx->directory, mctx, ctx->tag_min,
+				  ctx->tag_max, NULL))
+		{
 			conflict = true;
 			if (null_key) {
 				dst_key_free(&key);
@@ -843,11 +843,10 @@ main(int argc, char **argv) {
 	isc_mem_t *mctx = NULL;
 	isc_result_t ret;
 	isc_textregion_t r;
-	const char *engine = NULL;
 	unsigned char c;
 	int ch;
 	bool set_fips_mode = false;
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
 	OSSL_PROVIDER *fips = NULL, *base = NULL;
 #endif

@@ -868,8 +867,8 @@ main(int argc, char **argv) {
 	/*
 	 * Process memory debugging argument first.
 	 */
-#define CMDLINE_FLAGS                                        \
-	"3A:a:b:Cc:D:d:E:Ff:GhI:i:K:k:L:l:m:n:P:p:qR:r:S:s:" \
+#define CMDLINE_FLAGS                                          \
+	"3A:a:b:Cc:D:d:E:Ff:GhI:i:K:k:L:l:M:m:n:P:p:qR:r:S:s:" \
 	"T:t:v:V"
 	while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (ch) {
@@ -922,7 +921,7 @@ main(int argc, char **argv) {
 			}
 			break;
 		case 'E':
-			engine = isc_commandline_argument;
+			fatal("%s", isc_result_totext(DST_R_NOENGINE));
 			break;
 		case 'f':
 			c = (unsigned char)(isc_commandline_argument[0]);
@@ -958,6 +957,21 @@ main(int argc, char **argv) {
 		case 'n':
 			ctx.nametype = isc_commandline_argument;
 			break;
+		case 'M': {
+			unsigned long ul;
+			ctx.tag_min = ul = strtoul(isc_commandline_argument,
+						   &endp, 10);
+			if (*endp != ':' || ul > 0xffff) {
+				fatal("-M range invalid");
+			}
+			ctx.tag_max = ul = strtoul(endp + 1, &endp, 10);
+			if (*endp != '\0' || ul > 0xffff ||
+			    ctx.tag_max <= ctx.tag_min)
+			{
+				fatal("-M range invalid");
+			}
+			break;
+		}
 		case 'm':
 			break;
 		case 'p':
@@ -1121,7 +1135,7 @@ main(int argc, char **argv) {
 	}

 	if (set_fips_mode) {
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
 		fips = OSSL_PROVIDER_load(NULL, "fips");
 		if (fips == NULL) {
 			ERR_clear_error();
@@ -1141,20 +1155,15 @@ main(int argc, char **argv) {
 		}
 	}

-	ret = dst_lib_init(mctx, engine);
-	if (ret != ISC_R_SUCCESS) {
-		fatal("could not initialize dst: %s", isc_result_totext(ret));
-	}
-
 	/*
-	 * After dst_lib_init which will set FIPS mode if requested
-	 * at build time.  The minumums are both raised to 2048.
+	 * The DST subsystem will set FIPS mode if requested at build time.
+	 * The minimum sizes are both raised to 2048.
 	 */
 	if (isc_fips_mode()) {
 		min_rsa = min_dh = 2048;
 	}

-	setup_logging(mctx, &lctx);
+	setup_logging();

 	ctx.rdclass = strtoclass(classname);

@@ -1226,6 +1235,8 @@ main(int argc, char **argv) {
 			ctx.ksk = true;
 			ctx.zsk = true;
 			ctx.lifetime = 0;
+			ctx.tag_min = 0;
+			ctx.tag_max = 0xffff;

 			keygen(&ctx, mctx, argc, argv);
 		} else {
@@ -1234,7 +1245,7 @@ main(int argc, char **argv) {
 			dns_kasp_t *kasp = NULL;
 			dns_kasp_key_t *kaspkey = NULL;

-			RUNTIME_CHECK(cfg_parser_create(mctx, lctx, &parser) ==
+			RUNTIME_CHECK(cfg_parser_create(mctx, &parser) ==
 				      ISC_R_SUCCESS);
 			if (cfg_parse_file(parser, ctx.configfile,
 					   &cfg_type_namedconf,
@@ -1245,8 +1256,8 @@ main(int argc, char **argv) {
 				      ctx.policy, ctx.configfile);
 			}

-			kasp_from_conf(config, mctx, lctx, ctx.policy,
-				       ctx.directory, engine, &kasp);
+			kasp_from_conf(config, mctx, ctx.policy, ctx.directory,
+				       &kasp);
 			if (kasp == NULL) {
 				fatal("failed to load dnssec-policy '%s'",
 				      ctx.policy);
@@ -1274,6 +1285,8 @@ main(int argc, char **argv) {
 				if (ctx.keystore != NULL) {
 					check_keystore_options(&ctx);
 				}
+				ctx.tag_min = dns_kasp_key_tagmin(kaspkey);
+				ctx.tag_max = dns_kasp_key_tagmax(kaspkey);
 				if ((ctx.ksk && !ctx.wantksk && ctx.wantzsk) ||
 				    (ctx.zsk && !ctx.wantzsk && ctx.wantksk))
 				{
@@ -1290,14 +1303,12 @@ main(int argc, char **argv) {
 		keygen(&ctx, mctx, argc, argv);
 	}

-	cleanup_logging(&lctx);
-	dst_lib_destroy();
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
 	isc_mem_destroy(&mctx);

-#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
 	if (base != NULL) {
 		OSSL_PROVIDER_unload(base);
 	}
@@ -1309,5 +1320,5 @@ main(int argc, char **argv) {
 		free(freeit);
 	}

-	return (0);
+	return 0;
 }
@@ -21,7 +21,7 @@ dnssec-keygen: DNSSEC key generation tool
 Synopsis
 ~~~~~~~~

-:program:`dnssec-keygen` [**-3**] [**-A** date/offset] [**-a** algorithm] [**-b** keysize] [**-C**] [**-c** class] [**-D** date/offset] [**-d** bits] [**-D** sync date/offset] [**-E** engine] [**-f** flag] [**-F**] [**-G**] [**-h**] [**-I** date/offset] [**-i** interval] [**-K** directory] [**-k** policy] [**-L** ttl] [**-l** file] [**-n** nametype] [**-P** date/offset] [**-P** sync date/offset] [**-p** protocol] [**-q**] [**-R** date/offset] [**-S** key] [**-s** strength] [**-T** rrtype] [**-t** type] [**-V**] [**-v** level] {name}
+:program:`dnssec-keygen` [**-3**] [**-A** date/offset] [**-a** algorithm] [**-b** keysize] [**-C**] [**-c** class] [**-D** date/offset] [**-d** bits] [**-D** sync date/offset] [**-f** flag] [**-F**] [**-G**] [**-h**] [**-I** date/offset] [**-i** interval] [**-K** directory] [**-k** policy] [**-L** ttl] [**-l** file] [**-M** tag_min:tag_max] [**-n** nametype] [**-P** date/offset] [**-P** sync date/offset] [**-p** protocol] [**-q**] [**-R** date/offset] [**-S** key] [**-s** strength] [**-T** rrtype] [**-t** type] [**-V**] [**-v** level] {name}

 Description
 ~~~~~~~~~~~
@@ -94,14 +94,6 @@ Options
   and 4096 bits. This option is ignored for algorithms ECDSAP256SHA256,
   ECDSAP384SHA384, ED25519, and ED448.

-.. option:: -E engine
-
-   This option specifies the cryptographic hardware to use, when applicable.
-
-   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
-   engine identifier that drives the cryptographic accelerator or
-   hardware service module (usually ``pkcs11``).
-
 .. option:: -f flag

   This option sets the specified flag in the flag field of the KEY/DNSKEY record.
@@ -158,6 +150,19 @@ Options
   This option provides a configuration file that contains a ``dnssec-policy`` statement
   (matching the policy set with :option:`-k`).

+.. option:: -M tag_min:tag_max
+
+   This option sets the range of acceptable key tag values that ``dnssec-keygen``
+   will produce. If the key tag of the new key or the key tag of
+   the revoked version of the new key is outside this range,
+   the new key will be rejected and another new key will be generated.
+   This is designed to be used when generating keys in a multi-signer
+   scenario, where each operator is given a range of key tags to
+   prevent collisions among different operators.  The valid values
+   for ``tag_min`` and ``tag_max`` are [0..65535].  The default allows all
+   key tag values to be produced.  This option is ignored when ``-k policy``
+   is specified.
+
 .. option:: -n nametype

   This option specifies the owner type of the key. The value of ``nametype`` must
@@ -25,6 +25,7 @@
 #include <dns/callbacks.h>
 #include <dns/dnssec.h>
 #include <dns/fixedname.h>
+#include <dns/keymgr.h>
 #include <dns/keyvalues.h>
 #include <dns/rdataclass.h>
 #include <dns/rdatalist.h>
@@ -39,9 +40,7 @@ const char *program = "dnssec-ksr";
 /*
 * Infrastructure
 */
-static isc_log_t *lctx = NULL;
 static isc_mem_t *mctx = NULL;
-const char *engine = NULL;
 /*
 * The domain we are working on
 */
@@ -63,16 +62,19 @@ struct ksr_ctx {
 	bool setstart;
 	bool setend;
 	/* keygen */
+	bool ksk;
 	dns_ttl_t ttl;
 	dns_secalg_t alg;
 	int size;
 	time_t lifetime;
+	time_t parentpropagation;
 	time_t propagation;
 	time_t publishsafety;
 	time_t retiresafety;
 	time_t sigrefresh;
 	time_t sigvalidity;
 	time_t signdelay;
+	time_t ttlds;
 	time_t ttlsig;
 };
 typedef struct ksr_ctx ksr_ctx_t;
@@ -122,7 +124,6 @@ usage(int ret) {
 	fprintf(stderr, "Version: %s\n", PACKAGE_VERSION);
 	fprintf(stderr, "\n");
 	fprintf(stderr, "Options:\n");
-	fprintf(stderr, "    -E <engine>: name of an OpenSSL engine to use\n");
 	fprintf(stderr, "    -e <date/offset>: end date\n");
 	fprintf(stderr, "    -F: FIPS mode\n");
 	fprintf(stderr, "    -f: KSR file to sign\n");
@@ -142,6 +143,15 @@ usage(int ret) {
 	exit(ret);
 }

+static isc_stdtime_t
+between(isc_stdtime_t t, isc_stdtime_t start, isc_stdtime_t end) {
+	isc_stdtime_t r = end;
+	if (t > 0 && t > start && t < end) {
+		r = t;
+	}
+	return r;
+}
+
 static void
 checkparams(ksr_ctx_t *ksr, const char *command) {
 	if (ksr->configfile == NULL) {
@@ -166,15 +176,14 @@ getkasp(ksr_ctx_t *ksr, dns_kasp_t **kasp) {
 	cfg_parser_t *parser = NULL;
 	cfg_obj_t *config = NULL;

-	RUNTIME_CHECK(cfg_parser_create(mctx, lctx, &parser) == ISC_R_SUCCESS);
+	RUNTIME_CHECK(cfg_parser_create(mctx, &parser) == ISC_R_SUCCESS);
 	if (cfg_parse_file(parser, ksr->configfile, &cfg_type_namedconf,
 			   &config) != ISC_R_SUCCESS)
 	{
 		fatal("unable to load dnssec-policy '%s' from '%s'",
 		      ksr->policy, ksr->configfile);
 	}
-	kasp_from_conf(config, mctx, lctx, ksr->policy, ksr->keydir, engine,
-		       kasp);
+	kasp_from_conf(config, mctx, ksr->policy, ksr->keydir, kasp);
 	if (*kasp == NULL) {
 		fatal("failed to load dnssec-policy '%s'", ksr->policy);
 	}
@@ -186,15 +195,19 @@ getkasp(ksr_ctx_t *ksr, dns_kasp_t **kasp) {
 }

 static int
-keytag_cmp(const void *k1, const void *k2) {
+keyalgtag_cmp(const void *k1, const void *k2) {
 	dns_dnsseckey_t **key1 = (dns_dnsseckey_t **)k1;
 	dns_dnsseckey_t **key2 = (dns_dnsseckey_t **)k2;
-	if (dst_key_id((*key1)->key) < dst_key_id((*key2)->key)) {
-		return (-1);
+	if (dst_key_alg((*key1)->key) < dst_key_alg((*key2)->key)) {
+		return -1;
+	} else if (dst_key_alg((*key1)->key) > dst_key_alg((*key2)->key)) {
+		return 1;
+	} else if (dst_key_id((*key1)->key) < dst_key_id((*key2)->key)) {
+		return -1;
 	} else if (dst_key_id((*key1)->key) > dst_key_id((*key2)->key)) {
-		return (1);
+		return 1;
 	}
-	return (0);
+	return 0;
 }

 static void
@@ -224,7 +237,7 @@ get_dnskeys(ksr_ctx_t *ksr, dns_dnsseckeylist_t *keys) {
 	{
 		keys_sorted[i] = dk;
 	}
-	qsort(keys_sorted, n, sizeof(dns_dnsseckey_t *), keytag_cmp);
+	qsort(keys_sorted, n, sizeof(dns_dnsseckey_t *), keyalgtag_cmp);
 	while (!ISC_LIST_EMPTY(keys_read)) {
 		dns_dnsseckey_t *key = ISC_LIST_HEAD(keys_read);
 		ISC_LIST_UNLINK(keys_read, key, link);
@@ -239,6 +252,7 @@ get_dnskeys(ksr_ctx_t *ksr, dns_dnsseckeylist_t *keys) {

 static void
 setcontext(ksr_ctx_t *ksr, dns_kasp_t *kasp) {
+	ksr->parentpropagation = dns_kasp_parentpropagationdelay(kasp);
 	ksr->propagation = dns_kasp_zonepropagationdelay(kasp);
 	ksr->publishsafety = dns_kasp_publishsafety(kasp);
 	ksr->retiresafety = dns_kasp_retiresafety(kasp);
@@ -246,6 +260,7 @@ setcontext(ksr_ctx_t *ksr, dns_kasp_t *kasp) {
 	ksr->sigrefresh = dns_kasp_sigrefresh(kasp);
 	ksr->signdelay = dns_kasp_signdelay(kasp);
 	ksr->ttl = dns_kasp_dnskeyttl(kasp);
+	ksr->ttlds = dns_kasp_dsttl(kasp);
 	ksr->ttlsig = dns_kasp_zonemaxttl(kasp, true);
 }

@@ -313,9 +328,9 @@ freerrset(dns_rdataset_t *rdataset) {
 }

 static void
-create_zsk(ksr_ctx_t *ksr, dns_kasp_key_t *kaspkey, dns_dnsseckeylist_t *keys,
-	   isc_stdtime_t inception, isc_stdtime_t active,
-	   isc_stdtime_t *expiration) {
+create_key(ksr_ctx_t *ksr, dns_kasp_t *kasp, dns_kasp_key_t *kaspkey,
+	   dns_dnsseckeylist_t *keys, isc_stdtime_t inception,
+	   isc_stdtime_t active, isc_stdtime_t *expiration) {
 	bool conflict = false;
 	bool freekey = false;
 	bool show_progress = true;
@@ -327,9 +342,15 @@ create_zsk(ksr_ctx_t *ksr, dns_kasp_key_t *kaspkey, dns_dnsseckeylist_t *keys,
 	isc_buffer_t buf;
 	isc_result_t ret;
 	isc_stdtime_t prepub;
+	uint16_t flags = DNS_KEYOWNER_ZONE;

 	isc_stdtime_tostring(inception, timestr, sizeof(timestr));

+	/* ZSK or KSK? */
+	if (ksr->ksk) {
+		flags |= DNS_KEYFLAG_KSK;
+	}
+
 	/* Check algorithm and size. */
 	dns_secalg_format(ksr->alg, algstr, sizeof(algstr));
 	if (!dst_algorithm_supported(ksr->alg)) {
@@ -420,18 +441,18 @@ create_zsk(ksr_ctx_t *ksr, dns_kasp_key_t *kaspkey, dns_dnsseckeylist_t *keys,
 			ret = dns_keystore_keygen(
 				ksr->keystore, name, ksr->policy,
 				dns_rdataclass_in, mctx, ksr->alg, ksr->size,
-				DNS_KEYOWNER_ZONE, &key);
+				flags, &key);
 		} else if (show_progress) {
-			ret = dst_key_generate(
-				name, ksr->alg, ksr->size, 0, DNS_KEYOWNER_ZONE,
-				DNS_KEYPROTO_DNSSEC, dns_rdataclass_in, NULL,
-				mctx, &key, &progress);
+			ret = dst_key_generate(name, ksr->alg, ksr->size, 0,
+					       flags, DNS_KEYPROTO_DNSSEC,
+					       dns_rdataclass_in, NULL, mctx,
+					       &key, &progress);
 			fflush(stderr);
 		} else {
-			ret = dst_key_generate(
-				name, ksr->alg, ksr->size, 0, DNS_KEYOWNER_ZONE,
-				DNS_KEYPROTO_DNSSEC, dns_rdataclass_in, NULL,
-				mctx, &key, NULL);
+			ret = dst_key_generate(name, ksr->alg, ksr->size, 0,
+					       flags, DNS_KEYPROTO_DNSSEC,
+					       dns_rdataclass_in, NULL, mctx,
+					       &key, NULL);
 		}

 		if (ret != ISC_R_SUCCESS) {
@@ -440,7 +461,10 @@ create_zsk(ksr_ctx_t *ksr, dns_kasp_key_t *kaspkey, dns_dnsseckeylist_t *keys,
 		}

 		/* Do not overwrite an existing key. */
-		if (key_collision(key, name, ksr->keydir, mctx, NULL)) {
+		if (key_collision(key, name, ksr->keydir, mctx,
+				  dns_kasp_key_tagmin(kaspkey),
+				  dns_kasp_key_tagmax(kaspkey), NULL))
+		{
 			conflict = true;
 			if (verbose > 0) {
 				isc_buffer_clear(&buf);
@@ -465,15 +489,28 @@ create_zsk(ksr_ctx_t *ksr, dns_kasp_key_t *kaspkey, dns_dnsseckeylist_t *keys,
 	prepub = ksr->ttl + ksr->publishsafety + ksr->propagation;
 	dst_key_setttl(key, ksr->ttl);
 	dst_key_setnum(key, DST_NUM_LIFETIME, ksr->lifetime);
-	dst_key_setbool(key, DST_BOOL_KSK, false);
-	dst_key_setbool(key, DST_BOOL_ZSK, true);
+	dst_key_setbool(key, DST_BOOL_KSK, ksr->ksk);
+	dst_key_setbool(key, DST_BOOL_ZSK, !ksr->ksk);
 	dst_key_settime(key, DST_TIME_CREATED, ksr->now);
 	dst_key_settime(key, DST_TIME_PUBLISH, (active - prepub));
 	dst_key_settime(key, DST_TIME_ACTIVATE, active);
+	if (ksr->ksk) {
+		dns_keymgr_settime_syncpublish(key, kasp,
+					       (inception == ksr->start));
+	}
+
 	if (ksr->lifetime > 0) {
 		isc_stdtime_t inactive = (active + ksr->lifetime);
-		isc_stdtime_t remove = ksr->ttlsig + ksr->propagation +
-				       ksr->retiresafety + ksr->signdelay;
+		isc_stdtime_t remove;
+
+		if (ksr->ksk) {
+			remove = ksr->ttlds + ksr->parentpropagation +
+				 ksr->retiresafety;
+			dst_key_settime(key, DST_TIME_SYNCDELETE, inactive);
+		} else {
+			remove = ksr->ttlsig + ksr->propagation +
+				 ksr->retiresafety + ksr->signdelay;
+		}
 		dst_key_settime(key, DST_TIME_INACTIVE, inactive);
 		dst_key_settime(key, DST_TIME_DELETE, (inactive + remove));
 		*expiration = inactive;
@@ -604,15 +641,16 @@ fail:
 		      namestr, algstr, timestr);
 	}

-	return (next_bundle);
+	return next_bundle;
 }

-static void
+static isc_stdtime_t
 sign_rrset(ksr_ctx_t *ksr, isc_stdtime_t inception, isc_stdtime_t expiration,
 	   dns_rdataset_t *rrset, dns_dnsseckeylist_t *keys) {
 	dns_rdatalist_t *rrsiglist = NULL;
 	dns_rdataset_t rrsigset = DNS_RDATASET_INIT;
 	isc_result_t ret;
+	isc_stdtime_t next_bundle = expiration;

 	UNUSED(ksr);

@@ -656,6 +694,25 @@ sign_rrset(ksr_ctx_t *ksr, isc_stdtime_t inception, isc_stdtime_t expiration,
 		unsigned char rdatabuf[SIG_FORMATSIZE];
 		isc_stdtime_t clockskew = inception - 3600;

+		isc_stdtime_t pub = 0, act = 0, inact = 0, del = 0;
+
+		/* Determine next bundle. */
+		(void)dst_key_gettime(dk->key, DST_TIME_PUBLISH, &pub);
+		(void)dst_key_gettime(dk->key, DST_TIME_ACTIVATE, &act);
+		(void)dst_key_gettime(dk->key, DST_TIME_INACTIVE, &inact);
+		(void)dst_key_gettime(dk->key, DST_TIME_DELETE, &del);
+		next_bundle = between(pub, inception, next_bundle);
+		next_bundle = between(act, inception, next_bundle);
+		next_bundle = between(inact, inception, next_bundle);
+		next_bundle = between(del, inception, next_bundle);
+
+		if (act > inception) {
+			continue;
+		}
+		if (inact != 0 && inception >= inact) {
+			continue;
+		}
+
 		rrsig = isc_mem_get(mctx, sizeof(*rrsig));
 		dns_rdata_init(rrsig);
 		isc_buffer_init(&buf, rdatabuf, sizeof(rdatabuf));
@@ -677,21 +734,25 @@ sign_rrset(ksr_ctx_t *ksr, isc_stdtime_t inception, isc_stdtime_t expiration,
 	dns_rdatalist_tordataset(rrsiglist, &rrsigset);
 	print_rdata(&rrsigset);
 	freerrset(&rrsigset);
+
+	return next_bundle;
 }

 /*
 * Create the DNSKEY, CDS, and CDNSKEY records beloing to the KSKs
 * listed in 'keys'.
 */
-static void
-create_ksk(ksr_ctx_t *ksr, dns_kasp_t *kasp, dns_dnsseckeylist_t *keys,
-	   dns_rdataset_t *dnskeyset, dns_rdataset_t *cdnskeyset,
-	   dns_rdataset_t *cdsset) {
+static isc_stdtime_t
+get_keymaterial(ksr_ctx_t *ksr, dns_kasp_t *kasp, isc_stdtime_t inception,
+		isc_stdtime_t next_inception, dns_dnsseckeylist_t *keys,
+		dns_rdataset_t *dnskeyset, dns_rdataset_t *cdnskeyset,
+		dns_rdataset_t *cdsset) {
+	dns_kasp_digestlist_t digests = dns_kasp_digests(kasp);
 	dns_rdatalist_t *dnskeylist = isc_mem_get(mctx, sizeof(*dnskeylist));
 	dns_rdatalist_t *cdnskeylist = isc_mem_get(mctx, sizeof(*cdnskeylist));
 	dns_rdatalist_t *cdslist = isc_mem_get(mctx, sizeof(*cdslist));
 	isc_result_t ret = ISC_R_SUCCESS;
-	dns_kasp_digestlist_t digests = dns_kasp_digests(kasp);
+	isc_stdtime_t next_bundle = next_inception;

 	dns_rdatalist_init(dnskeylist);
 	dnskeylist->rdclass = dns_rdataclass_in;
@@ -711,31 +772,73 @@ create_ksk(ksr_ctx_t *ksr, dns_kasp_t *kasp, dns_dnsseckeylist_t *keys,
 	for (dns_dnsseckey_t *dk = ISC_LIST_HEAD(*keys); dk != NULL;
 	     dk = ISC_LIST_NEXT(dk, link))
 	{
+		bool published = true;
 		isc_buffer_t buf;
 		isc_buffer_t *newbuf;
 		dns_rdata_t *rdata;
 		isc_region_t r;
 		isc_region_t rcds;
+		isc_stdtime_t pub = 0, del = 0;
 		unsigned char kskbuf[DST_KEY_MAXSIZE];
 		unsigned char cdnskeybuf[DST_KEY_MAXSIZE];
 		unsigned char cdsbuf[DNS_DS_BUFFERSIZE];

 		/* KSK */
-		newbuf = NULL;
-		rdata = isc_mem_get(mctx, sizeof(*rdata));
-		dns_rdata_init(rdata);
+		(void)dst_key_gettime(dk->key, DST_TIME_PUBLISH, &pub);
+		(void)dst_key_gettime(dk->key, DST_TIME_DELETE, &del);
+		next_bundle = between(pub, inception, next_bundle);
+		next_bundle = between(del, inception, next_bundle);

-		isc_buffer_init(&buf, kskbuf, sizeof(kskbuf));
-		CHECK(dst_key_todns(dk->key, &buf));
-		isc_buffer_usedregion(&buf, &r);
-		isc_buffer_allocate(mctx, &newbuf, r.length);
-		isc_buffer_putmem(newbuf, r.base, r.length);
-		isc_buffer_usedregion(newbuf, &r);
-		dns_rdata_fromregion(rdata, dns_rdataclass_in,
-				     dns_rdatatype_dnskey, &r);
-		ISC_LIST_APPEND(dnskeylist->rdata, rdata, link);
-		ISC_LIST_APPEND(cleanup_list, newbuf, link);
-		isc_buffer_clear(newbuf);
+		if (pub > inception) {
+			published = false;
+		}
+		if (del != 0 && inception >= del) {
+			published = false;
+		}
+
+		if (published) {
+			newbuf = NULL;
+			rdata = isc_mem_get(mctx, sizeof(*rdata));
+			dns_rdata_init(rdata);
+
+			isc_buffer_init(&buf, kskbuf, sizeof(kskbuf));
+			CHECK(dst_key_todns(dk->key, &buf));
+			isc_buffer_usedregion(&buf, &r);
+			isc_buffer_allocate(mctx, &newbuf, r.length);
+			isc_buffer_putmem(newbuf, r.base, r.length);
+			isc_buffer_usedregion(newbuf, &r);
+			dns_rdata_fromregion(rdata, dns_rdataclass_in,
+					     dns_rdatatype_dnskey, &r);
+			ISC_LIST_APPEND(dnskeylist->rdata, rdata, link);
+			ISC_LIST_APPEND(cleanup_list, newbuf, link);
+			isc_buffer_clear(newbuf);
+		}
+
+		published = true;
+		if (dns_kasp_cdnskey(kasp) || !ISC_LIST_EMPTY(digests)) {
+			pub = 0;
+			del = 0;
+			(void)dst_key_gettime(dk->key, DST_TIME_SYNCPUBLISH,
+					      &pub);
+			(void)dst_key_gettime(dk->key, DST_TIME_SYNCDELETE,
+					      &del);
+
+			next_bundle = between(pub, inception, next_bundle);
+			next_bundle = between(del, inception, next_bundle);
+
+			if (pub != 0 && pub > inception) {
+				published = false;
+			}
+			if (del != 0 && inception >= del) {
+				published = false;
+			}
+		} else {
+			published = false;
+		}
+
+		if (!published) {
+			continue;
+		}

 		/* CDNSKEY */
 		newbuf = NULL;
@@ -789,35 +892,98 @@ create_ksk(ksr_ctx_t *ksr, dns_kasp_t *kasp, dns_dnsseckeylist_t *keys,
 	dns_rdatalist_tordataset(dnskeylist, dnskeyset);
 	dns_rdatalist_tordataset(cdnskeylist, cdnskeyset);
 	dns_rdatalist_tordataset(cdslist, cdsset);
-	return;
+
+	return next_bundle;

 fail:
 	fatal("failed to create KSK/CDS/CDNSKEY");
+	return 0;
 }

 static void
-sign_bundle(ksr_ctx_t *ksr, isc_stdtime_t inception,
-	    isc_stdtime_t next_inception, dns_rdatalist_t *rdatalist,
-	    dns_rdataset_t *cds, dns_rdataset_t *cdnskey,
+sign_bundle(ksr_ctx_t *ksr, dns_kasp_t *kasp, isc_stdtime_t inception,
+	    isc_stdtime_t next_inception, dns_rdatalist_t *zsklist,
 	    dns_dnsseckeylist_t *keys) {
-	dns_rdataset_t rrset = DNS_RDATASET_INIT;
-	isc_stdtime_t expiration;
+	isc_stdtime_t expiration = inception + ksr->sigvalidity;
+	isc_stdtime_t next_bundle = next_inception;
+	dns_rdataset_t zsk;
+
+	dns_rdataset_init(&zsk);
+	dns_rdatalist_tordataset(zsklist, &zsk);

-	dns_rdataset_init(&rrset);
-	dns_rdatalist_tordataset(rdatalist, &rrset);
-	expiration = inception + ksr->sigvalidity;
 	while (inception <= next_inception) {
-		sign_rrset(ksr, inception, expiration, &rrset, keys);
-		if (dns_rdataset_count(cdnskey) > 0) {
-			sign_rrset(ksr, inception, expiration, cdnskey, keys);
+		isc_stdtime_t next_time = next_bundle;
+
+		/* DNSKEY RRset */
+		dns_rdatalist_t *dnskeylist;
+		dnskeylist = isc_mem_get(mctx, sizeof(*dnskeylist));
+		dns_rdatalist_init(dnskeylist);
+		dnskeylist->rdclass = dns_rdataclass_in;
+		dnskeylist->type = dns_rdatatype_dnskey;
+		dnskeylist->ttl = ksr->ttl;
+
+		dns_rdataset_t ksk, cdnskey, cds, rrset;
+		dns_rdataset_init(&ksk);
+		dns_rdataset_init(&cdnskey);
+		dns_rdataset_init(&cds);
+		dns_rdataset_init(&rrset);
+		next_time = get_keymaterial(ksr, kasp, inception, next_time,
+					    keys, &ksk, &cdnskey, &cds);
+		if (next_bundle > next_time) {
+			next_bundle = next_time;
 		}
-		if (dns_rdataset_count(cds) > 0) {
-			sign_rrset(ksr, inception, expiration, cds, keys);
+
+		for (isc_result_t r = dns_rdatalist_first(&ksk);
+		     r == ISC_R_SUCCESS; r = dns_rdatalist_next(&ksk))
+		{
+			dns_rdata_t *clone = isc_mem_get(mctx, sizeof(*clone));
+			dns_rdata_init(clone);
+			dns_rdatalist_current(&ksk, clone);
+			ISC_LIST_APPEND(dnskeylist->rdata, clone, link);
 		}
+
+		for (isc_result_t r = dns_rdatalist_first(&zsk);
+		     r == ISC_R_SUCCESS; r = dns_rdatalist_next(&zsk))
+		{
+			dns_rdata_t *clone = isc_mem_get(mctx, sizeof(*clone));
+			dns_rdata_init(clone);
+			dns_rdatalist_current(&zsk, clone);
+			ISC_LIST_APPEND(dnskeylist->rdata, clone, link);
+		}
+
+		dns_rdatalist_tordataset(dnskeylist, &rrset);
+		next_time = sign_rrset(ksr, inception, expiration, &rrset,
+				       keys);
+		if (next_bundle > next_time) {
+			next_bundle = next_time;
+		}
+		freerrset(&ksk);
+		freerrset(&rrset);
+
+		/* CDNSKEY */
+		if (dns_rdataset_count(&cdnskey) > 0) {
+			(void)sign_rrset(ksr, inception, expiration, &cdnskey,
+					 keys);
+		}
+		freerrset(&cdnskey);
+
+		/* CDS */
+		if (dns_rdataset_count(&cds) > 0) {
+			(void)sign_rrset(ksr, inception, expiration, &cds,
+					 keys);
+		}
+		freerrset(&cds);
+
+		/* Next response bundle. */
 		inception = expiration - ksr->sigrefresh;
+		if (inception > next_bundle) {
+			inception = next_bundle;
+		}
 		expiration = inception + ksr->sigvalidity;
+		next_bundle = expiration;
 	}
-	freerrset(&rrset);
+
+	freerrset(&zsk);
 }

 static isc_result_t
@@ -842,10 +1008,10 @@ parse_dnskey(isc_lex_t *lex, char *owner, isc_buffer_t *buf, dns_ttl_t *ttl) {
 	isc_buffer_add(&b, strlen(owner));
 	ret = dns_name_fromtext(dname, &b, dns_rootname, 0, NULL);
 	if (ret != ISC_R_SUCCESS) {
-		return (ret);
+		return ret;
 	}
 	if (dns_name_compare(dname, name) != 0) {
-		return (DNS_R_BADOWNERNAME);
+		return DNS_R_BADOWNERNAME;
 	}
 	isc_buffer_clear(&b);

@@ -883,7 +1049,7 @@ parse_dnskey(isc_lex_t *lex, char *owner, isc_buffer_t *buf, dns_ttl_t *ttl) {

 cleanup:
 	isc_lex_setcomments(lex, 0);
-	return (ret);
+	return ret;
 }

 static void
@@ -904,9 +1070,12 @@ keygen(ksr_ctx_t *ksr) {
 	for (dns_kasp_key_t *kk = ISC_LIST_HEAD(dns_kasp_keys(kasp));
 	     kk != NULL; kk = ISC_LIST_NEXT(kk, link))
 	{
-		if (dns_kasp_key_ksk(kk)) {
+		if (dns_kasp_key_ksk(kk) && !ksr->ksk) {
 			/* only ZSKs allowed */
 			continue;
+		} else if (dns_kasp_key_zsk(kk) && ksr->ksk) {
+			/* only KSKs allowed */
+			continue;
 		}
 		ksr->alg = dns_kasp_key_algorithm(kk);
 		ksr->lifetime = dns_kasp_key_lifetime(kk);
@@ -917,7 +1086,7 @@ keygen(ksr_ctx_t *ksr) {
 		for (isc_stdtime_t inception = ksr->start, act = ksr->start;
 		     inception < ksr->end; inception += ksr->lifetime)
 		{
-			create_zsk(ksr, kk, &keys, inception, act, &act);
+			create_key(ksr, kasp, kk, &keys, inception, act, &act);
 			if (ksr->lifetime == 0) {
 				/* unlimited lifetime, but not infinite loop */
 				break;
@@ -925,7 +1094,7 @@ keygen(ksr_ctx_t *ksr) {
 		}
 	}
 	if (noop) {
-		fatal("policy '%s' has no zsks", ksr->policy);
+		fatal("no keys created for policy '%s'", ksr->policy);
 	}
 	/* Cleanup */
 	cleanup(&keys, kasp);
@@ -1004,9 +1173,6 @@ sign(ksr_ctx_t *ksr) {
 	dns_dnsseckeylist_t keys;
 	dns_kasp_t *kasp = NULL;
 	dns_rdatalist_t *rdatalist = NULL;
-	dns_rdataset_t ksk = DNS_RDATASET_INIT;
-	dns_rdataset_t cdnskey = DNS_RDATASET_INIT;
-	dns_rdataset_t cds = DNS_RDATASET_INIT;
 	isc_result_t ret;
 	isc_stdtime_t inception;
 	isc_lex_t *lex = NULL;
@@ -1039,9 +1205,6 @@ sign(ksr_ctx_t *ksr) {
 		      isc_result_totext(ret));
 	}

-	/* KSK, CDS and CDNSKEY */
-	create_ksk(ksr, kasp, &keys, &ksk, &cdnskey, &cds);
-
 	for (ret = isc_lex_gettoken(lex, opt, &token); ret == ISC_R_SUCCESS;
 	     ret = isc_lex_gettoken(lex, opt, &token))
 	{
@@ -1091,8 +1254,8 @@ sign(ksr_ctx_t *ksr) {

 			if (have_bundle) {
 				/* Sign previous bundle */
-				sign_bundle(ksr, inception, next_inception,
-					    rdatalist, &cds, &cdnskey, &keys);
+				sign_bundle(ksr, kasp, inception,
+					    next_inception, rdatalist, &keys);
 				fprintf(stdout, "\n");
 			}

@@ -1102,15 +1265,7 @@ sign(ksr_ctx_t *ksr) {
 			rdatalist->rdclass = dns_rdataclass_in;
 			rdatalist->type = dns_rdatatype_dnskey;
 			rdatalist->ttl = ksr->ttl;
-			for (isc_result_t r = dns_rdatalist_first(&ksk);
-			     r == ISC_R_SUCCESS; r = dns_rdatalist_next(&ksk))
-			{
-				dns_rdata_t *clone =
-					isc_mem_get(mctx, sizeof(*clone));
-				dns_rdata_init(clone);
-				dns_rdatalist_current(&ksk, clone);
-				ISC_LIST_APPEND(rdatalist->rdata, clone, link);
-			}
+
 			inception = next_inception;
 			have_bundle = true;

@@ -1169,8 +1324,7 @@ sign(ksr_ctx_t *ksr) {

 	/* Final bundle */
 	if (have_bundle && rdatalist != NULL) {
-		sign_bundle(ksr, inception, ksr->end, rdatalist, &cds, &cdnskey,
-			    &keys);
+		sign_bundle(ksr, kasp, inception, ksr->end, rdatalist, &keys);
 	} else {
 		fatal("bad KSR file %s(%lu): no bundles", ksr->file,
 		      isc_lex_getsourceline(lex));
@@ -1182,11 +1336,6 @@ sign(ksr_ctx_t *ksr) {
 		timestr, PACKAGE_VERSION);

 fail:
-	/* Clean up */
-	freerrset(&ksk);
-	freerrset(&cdnskey);
-	freerrset(&cds);
-
 	isc_lex_destroy(&lex);
 	cleanup(&keys, kasp);
 }
@@ -1198,7 +1347,7 @@ main(int argc, char *argv[]) {
 	int ch;
 	char *endp;
 	bool set_fips_mode = false;
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
 	OSSL_PROVIDER *fips = NULL, *base = NULL;
 #endif
 	ksr_ctx_t ksr = {
@@ -1209,11 +1358,11 @@ main(int argc, char *argv[]) {

 	isc_commandline_errprint = false;

-#define OPTIONS "E:e:Ff:hi:K:k:l:v:V"
+#define OPTIONS "E:e:Ff:hi:K:k:l:ov:V"
 	while ((ch = isc_commandline_parse(argc, argv, OPTIONS)) != -1) {
 		switch (ch) {
 		case 'E':
-			engine = isc_commandline_argument;
+			fatal("%s", isc_result_totext(DST_R_NOENGINE));
 			break;
 		case 'e':
 			ksr.end = strtotime(isc_commandline_argument, ksr.now,
@@ -1246,6 +1395,9 @@ main(int argc, char *argv[]) {
 		case 'l':
 			ksr.configfile = isc_commandline_argument;
 			break;
+		case 'o':
+			ksr.ksk = true;
+			break;
 		case 'V':
 			version(program);
 			break;
@@ -1267,23 +1419,18 @@ main(int argc, char *argv[]) {
 		fatal("must provide a command and zone name");
 	}

-	ret = dst_lib_init(mctx, engine);
-	if (ret != ISC_R_SUCCESS) {
-		fatal("could not initialize dst: %s", isc_result_totext(ret));
-	}
-
 	/*
-	 * After dst_lib_init which will set FIPS mode if requested
-	 * at build time.  The minumums are both raised to 2048.
+	 * The DST subsystem will set FIPS mode if requested at build time.
+	 * The minimum sizes are both raised to 2048.
 	 */
 	if (isc_fips_mode()) {
 		min_rsa = min_dh = 2048;
 	}

-	setup_logging(mctx, &lctx);
+	setup_logging();

 	if (set_fips_mode) {
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
 		fips = OSSL_PROVIDER_load(NULL, "fips");
 		if (fips == NULL) {
 			fatal("Failed to load FIPS provider");
@@ -21,7 +21,7 @@ dnssec-ksr - Create signed key response (SKR) files for offline KSK setups
 Synopsis
 ~~~~~~~~

-:program:`dnssec-ksr` [**-E** engine] [**-e** date/offset] [**-F**] [**-h**] [**-i** date/offset] [**-K** directory] [**-k** policy] [**-l** file] [**-V**] [**-v** level] {command} {zone}
+:program:`dnssec-ksr` [**-e** date/offset] [**-F**] [**-f** file] [**-h**] [**-i** date/offset] [**-K** directory] [**-k** policy] [**-l** file] [**-o**] [**-V**] [**-v** level] {command} {zone}

 Description
 ~~~~~~~~~~~
@@ -40,14 +40,6 @@ server.
 Options
 ~~~~~~~

-.. option:: -E engine
-
-   This option specifies the cryptographic hardware to use, when applicable.
-
-   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
-   engine identifier that drives the cryptographic accelerator or
-   hardware service module (usually ``pkcs11``).
-
 .. option:: -e date/offset

   This option sets the end date for which keys or SKRs need to be generated
@@ -59,6 +51,10 @@ Options
   mode if the underlying crytographic library supports running in FIPS
   mode.

+.. option:: -f
+
+   This option sets the SKR file to be signed when issuing a ``sign`` command.
+
 .. option:: -h

   This option prints a short summary of the options and arguments to
@@ -84,6 +80,11 @@ Options
   This option provides a configuration file that contains a ``dnssec-policy``
   statement (matching the policy set with :option:`-k`).

+.. option:: -o
+
+   Normally when pregenerating keys, ZSKs are created. When this option is
+   set, create KSKs instead.
+
 .. option:: -V

   This option prints version information.
@@ -106,9 +107,8 @@ Commands

 .. option:: keygen

-  Pregenerate a number of zone signing keys (ZSKs), given a DNSSEC policy and
-  an interval. The number of generated keys depends on the interval and the
-  ZSK lifetime.
+  Pregenerate a number of keys, given a DNSSEC policy and an interval. The
+  number of generated keys depends on the interval and the key lifetime.

 .. option:: request

@@ -131,7 +131,7 @@ occurred.
 Examples
 ~~~~~~~~

-When you need to generate keys for the zone "example.com" for the next year,
+When you need to generate ZSKs for the zone "example.com" for the next year,
 given a ``dnssec-policy`` named "mypolicy":

 ::
@@ -144,7 +144,8 @@ Creating a KSR for the same zone and period can be done with:

    dnssec-ksr -i now -e +1y -k mypolicy -l named.conf request example.com > ksr.txt

-Typically you would now transfer the KSR to the system that has access to the KSK.
+Typically you would now transfer the KSR to the system that has access to
+the KSK.

 Signing the KSR created above can be done with:

@@ -152,7 +153,8 @@ Signing the KSR created above can be done with:

    dnssec-ksr -i now -e +1y -k kskpolicy -l named.conf -f ksr.txt sign example.com

-Make sure that the DNSSEC parameters in ``kskpolicy`` match those in ``mypolicy``.
+Make sure that the DNSSEC parameters in ``kskpolicy`` match those
+in ``mypolicy``.

 See Also
 ~~~~~~~~
@@ -38,7 +38,7 @@ const char *program = "dnssec-revoke";

 static isc_mem_t *mctx = NULL;

-noreturn static void
+ISC_NORETURN static void
 usage(void);

 static void
@@ -46,7 +46,6 @@ usage(void) {
 	fprintf(stderr, "Usage:\n");
 	fprintf(stderr, "    %s [options] keyfile\n\n", program);
 	fprintf(stderr, "Version: %s\n", PACKAGE_VERSION);
-	fprintf(stderr, "    -E engine:    specify OpenSSL engine\n");
 	fprintf(stderr, "    -f:           force overwrite\n");
 	fprintf(stderr, "    -h:           help\n");
 	fprintf(stderr, "    -K directory: use directory for key files\n");
@@ -64,7 +63,6 @@ usage(void) {
 int
 main(int argc, char **argv) {
 	isc_result_t result;
-	const char *engine = NULL;
 	char const *filename = NULL;
 	char *dir = NULL;
 	char newname[1024], oldname[1024];
@@ -89,7 +87,7 @@ main(int argc, char **argv) {
 	while ((ch = isc_commandline_parse(argc, argv, "E:fK:rRhv:V")) != -1) {
 		switch (ch) {
 		case 'E':
-			engine = isc_commandline_argument;
+			fatal("%s", isc_result_totext(DST_R_NOENGINE));
 			break;
 		case 'f':
 			force = true;
@@ -159,12 +157,6 @@ main(int argc, char **argv) {
 		}
 	}

-	result = dst_lib_init(mctx, engine);
-	if (result != ISC_R_SUCCESS) {
-		fatal("Could not initialize dst: %s",
-		      isc_result_totext(result));
-	}
-
 	result = dst_key_fromnamedfile(
 		filename, dir, DST_TYPE_PUBLIC | DST_TYPE_PRIVATE, mctx, &key);
 	if (result != ISC_R_SUCCESS) {
@@ -248,7 +240,6 @@ main(int argc, char **argv) {

 cleanup:
 	dst_key_free(&key);
-	dst_lib_destroy();
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
@@ -257,5 +248,5 @@ cleanup:
 	}
 	isc_mem_destroy(&mctx);

-	return (0);
+	return 0;
 }
@@ -21,7 +21,7 @@ dnssec-revoke - set the REVOKED bit on a DNSSEC key
 Synopsis
 ~~~~~~~~

-:program:`dnssec-revoke` [**-hr**] [**-v** level] [**-V**] [**-K** directory] [**-E** engine] [**-f**] [**-R**] {keyfile}
+:program:`dnssec-revoke` [**-hr**] [**-v** level] [**-V**] [**-K** directory] [**-f**] [**-R**] {keyfile}

 Description
 ~~~~~~~~~~~
@@ -53,14 +53,6 @@ Options

   This option prints version information.

-.. option:: -E engine
-
-   This option specifies the cryptographic hardware to use, when applicable.
-
-   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
-   engine identifier that drives the cryptographic accelerator or
-   hardware service module (usually ``pkcs11``).
-
 .. option:: -f

   This option indicates a forced overwrite and causes :program:`dnssec-revoke` to write the new key pair,
@@ -25,6 +25,7 @@
 #include <isc/commandline.h>
 #include <isc/file.h>
 #include <isc/hash.h>
+#include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
 #include <isc/string.h>
@@ -32,7 +33,6 @@
 #include <isc/util.h>

 #include <dns/keyvalues.h>
-#include <dns/log.h>

 #include <dst/dst.h>

@@ -42,7 +42,7 @@ const char *program = "dnssec-settime";

 static isc_mem_t *mctx = NULL;

-noreturn static void
+ISC_NORETURN static void
 usage(void);

 static void
@@ -51,7 +51,6 @@ usage(void) {
 	fprintf(stderr, "    %s [options] keyfile\n\n", program);
 	fprintf(stderr, "Version: %s\n", PACKAGE_VERSION);
 	fprintf(stderr, "General options:\n");
-	fprintf(stderr, "    -E engine:          specify OpenSSL engine\n");
 	fprintf(stderr, "    -f:                 force update of old-style "
 			"keys\n");
 	fprintf(stderr, "    -K directory:       set key file location\n");
@@ -186,7 +185,6 @@ writekey(dst_key_t *key, const char *directory, bool write_state) {
 int
 main(int argc, char **argv) {
 	isc_result_t result;
-	const char *engine = NULL;
 	const char *filename = NULL;
 	char *directory = NULL;
 	char keystr[DST_KEY_FORMATSIZE];
@@ -228,7 +226,6 @@ main(int argc, char **argv) {
 	bool epoch = false;
 	bool changed = false;
 	bool write_state = false;
-	isc_log_t *log = NULL;
 	isc_stdtime_t syncadd = 0, syncdel = 0;
 	bool unsetsyncadd = false, setsyncadd = false;
 	bool unsetsyncdel = false, setsyncdel = false;
@@ -247,7 +244,7 @@ main(int argc, char **argv) {

 	isc_mem_create(&mctx);

-	setup_logging(mctx, &log);
+	setup_logging();

 	isc_commandline_errprint = false;

@@ -314,7 +311,7 @@ main(int argc, char **argv) {
 					   &setdstime);
 			break;
 		case 'E':
-			engine = isc_commandline_argument;
+			fatal("%s", isc_result_totext(DST_R_NOENGINE));
 			break;
 		case 'f':
 			force = true;
@@ -555,12 +552,6 @@ main(int argc, char **argv) {
 		fatal("Options -g, -d, -k, -r and -z require -s to be set");
 	}

-	result = dst_lib_init(mctx, engine);
-	if (result != ISC_R_SUCCESS) {
-		fatal("Could not initialize dst: %s",
-		      isc_result_totext(result));
-	}
-
 	if (predecessor != NULL) {
 		int major, minor;

@@ -952,13 +943,11 @@ main(int argc, char **argv) {
 		dst_key_free(&prevkey);
 	}
 	dst_key_free(&key);
-	dst_lib_destroy();
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
-	cleanup_logging(&log);
 	isc_mem_free(mctx, directory);
 	isc_mem_destroy(&mctx);

-	return (0);
+	return 0;
 }
@@ -21,7 +21,7 @@ dnssec-settime: set the key timing metadata for a DNSSEC key
 Synopsis
 ~~~~~~~~

-:program:`dnssec-settime` [**-f**] [**-K** directory] [**-L** ttl] [**-P** date/offset] [**-P** ds date/offset] [**-P** sync date/offset] [**-A** date/offset] [**-R** date/offset] [**-I** date/offset] [**-D** date/offset] [**-D** ds date/offset] [**-D** sync date/offset] [**-S** key] [**-i** interval] [**-h**] [**-V**] [**-v** level] [**-E** engine] {keyfile} [**-s**] [**-g** state] [**-d** state date/offset] [**-k** state date/offset] [**-r** state date/offset] [**-z** state date/offset]
+:program:`dnssec-settime` [**-f**] [**-K** directory] [**-L** ttl] [**-P** date/offset] [**-P** ds date/offset] [**-P** sync date/offset] [**-A** date/offset] [**-R** date/offset] [**-I** date/offset] [**-D** date/offset] [**-D** ds date/offset] [**-D** sync date/offset] [**-S** key] [**-i** interval] [**-h**] [**-V**] [**-v** level] {keyfile} [**-s**] [**-g** state] [**-d** state date/offset] [**-k** state date/offset] [**-r** state date/offset] [**-z** state date/offset]

 Description
 ~~~~~~~~~~~
@@ -97,14 +97,6 @@ Options

   This option sets the debugging level.

-.. option:: -E engine
-
-   This option specifies the cryptographic hardware to use, when applicable.
-
-   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
-   engine identifier that drives the cryptographic accelerator or
-   hardware service module (usually ``pkcs11``).
-
 Timing Options
 ~~~~~~~~~~~~~~

@@ -45,6 +45,7 @@
 #include <isc/fips.h>
 #include <isc/hash.h>
 #include <isc/hex.h>
+#include <isc/log.h>
 #include <isc/loop.h>
 #include <isc/managers.h>
 #include <isc/md.h>
@@ -70,7 +71,6 @@
 #include <dns/fixedname.h>
 #include <dns/kasp.h>
 #include <dns/keyvalues.h>
-#include <dns/log.h>
 #include <dns/master.h>
 #include <dns/masterdump.h>
 #include <dns/nsec.h>
@@ -88,7 +88,7 @@
 #include <dns/zoneverify.h>

 #include <dst/dst.h>
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
 #include <openssl/err.h>
 #include <openssl/provider.h>
 #endif
@@ -140,10 +140,10 @@ static dns_masterformat_t inputformat = dns_masterformat_text;
 static dns_masterformat_t outputformat = dns_masterformat_text;
 static uint32_t rawversion = 1, serialnum = 0;
 static bool snset = false;
-static unsigned int nsigned = 0, nretained = 0, ndropped = 0;
-static unsigned int nverified = 0, nverifyfailed = 0;
+static atomic_uint_fast32_t nsigned = 0, nretained = 0, ndropped = 0;
+static atomic_uint_fast32_t nverified = 0, nverifyfailed = 0;
 static const char *directory = NULL, *dsdir = NULL;
-static isc_mutex_t namelock, statslock;
+static isc_mutex_t namelock;
 static isc_nm_t *netmgr = NULL;
 static isc_loopmgr_t *loopmgr = NULL;
 static dns_db_t *gdb;		  /* The database */
@@ -182,11 +182,9 @@ static dns_ttl_t maxttl = 0;
 static bool no_max_check = false;
 static const char *sync_records = "cdnskey,cds:sha-256";

-#define INCSTAT(counter)            \
-	if (printstats) {           \
-		LOCK(&statslock);   \
-		counter++;          \
-		UNLOCK(&statslock); \
+#define INCSTAT(counter)                               \
+	if (printstats) {                              \
+		atomic_fetch_add_relaxed(&counter, 1); \
 	}

 /*%
@@ -199,7 +197,7 @@ savezonecut(dns_fixedname_t *fzonecut, dns_name_t *name) {
 	result = dns_fixedname_initname(fzonecut);
 	dns_name_copy(name, result);

-	return (result);
+	return result;
 }

 static void
@@ -320,36 +318,35 @@ signwithkey(dns_name_t *name, dns_rdataset_t *rdataset, dst_key_t *key,
 	}

 	tuple = NULL;
-	result = dns_difftuple_create(mctx, DNS_DIFFOP_ADDRESIGN, name, ttl,
-				      &trdata, &tuple);
-	check_result(result, "dns_difftuple_create");
+	dns_difftuple_create(mctx, DNS_DIFFOP_ADDRESIGN, name, ttl, &trdata,
+			     &tuple);
 	dns_diff_append(add, &tuple);
 }

 static bool
 issigningkey(dns_dnsseckey_t *key) {
-	return (key->force_sign || key->hint_sign);
+	return key->force_sign || key->hint_sign;
 }

 static bool
 ispublishedkey(dns_dnsseckey_t *key) {
-	return ((key->force_publish || key->hint_publish) && !key->hint_remove);
+	return (key->force_publish || key->hint_publish) && !key->hint_remove;
 }

 static bool
 iszonekey(dns_dnsseckey_t *key) {
-	return (dns_name_equal(dst_key_name(key->key), gorigin) &&
-		dst_key_iszonekey(key->key));
+	return dns_name_equal(dst_key_name(key->key), gorigin) &&
+	       dst_key_iszonekey(key->key);
 }

 static bool
 isksk(dns_dnsseckey_t *key) {
-	return (key->ksk);
+	return key->ksk;
 }

 static bool
 iszsk(dns_dnsseckey_t *key) {
-	return (ignore_kskflag || !key->ksk);
+	return ignore_kskflag || !key->ksk;
 }

 /*%
@@ -369,10 +366,10 @@ keythatsigned_unlocked(dns_rdata_rrsig_t *rrsig) {
 		    rrsig->algorithm == dst_key_alg(key->key) &&
 		    dns_name_equal(&rrsig->signer, dst_key_name(key->key)))
 		{
-			return (key);
+			return key;
 		}
 	}
-	return (NULL);
+	return NULL;
 }

 /*%
@@ -389,7 +386,7 @@ keythatsigned(dns_rdata_rrsig_t *rrsig) {
 	key = keythatsigned_unlocked(rrsig);
 	RWUNLOCK(&keylist_lock, isc_rwlocktype_read);
 	if (key != NULL) {
-		return (key);
+		return key;
 	}

 	/*
@@ -403,7 +400,7 @@ keythatsigned(dns_rdata_rrsig_t *rrsig) {
 	key = keythatsigned_unlocked(rrsig);
 	if (key != NULL) {
 		isc_rwlock_unlock(&keylist_lock, isc_rwlocktype_write);
-		return (key);
+		return key;
 	}

 	result = dst_key_fromfile(&rrsig->signer, rrsig->keyid,
@@ -411,7 +408,7 @@ keythatsigned(dns_rdata_rrsig_t *rrsig) {
 				  mctx, &pubkey);
 	if (result != ISC_R_SUCCESS) {
 		isc_rwlock_unlock(&keylist_lock, isc_rwlocktype_write);
-		return (NULL);
+		return NULL;
 	}

 	result = dst_key_fromfile(
@@ -430,7 +427,7 @@ keythatsigned(dns_rdata_rrsig_t *rrsig) {
 	ISC_LIST_APPEND(keylist, key, link);

 	isc_rwlock_unlock(&keylist_lock, isc_rwlocktype_write);
-	return (key);
+	return key;
 }

 /*%
@@ -452,11 +449,11 @@ expecttofindkey(dns_name_t *name) {
 	case ISC_R_SUCCESS:
 	case DNS_R_NXDOMAIN:
 	case DNS_R_NXRRSET:
-		return (true);
+		return true;
 	case DNS_R_DELEGATION:
 	case DNS_R_CNAME:
 	case DNS_R_DNAME:
-		return (false);
+		return false;
 	default:
 		break;
 	}
@@ -464,7 +461,7 @@ expecttofindkey(dns_name_t *name) {
 	fatal("failure looking for '%s DNSKEY' in database: %s", namestr,
 	      isc_result_totext(result));
 	UNREACHABLE();
-	return (false); /* removes a warning */
+	return false; /* removes a warning */
 }

 static bool
@@ -474,10 +471,10 @@ setverifies(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
 	result = dns_dnssec_verify(name, set, key, false, 0, mctx, rrsig, NULL);
 	if (result == ISC_R_SUCCESS || result == DNS_R_FROMWILDCARD) {
 		INCSTAT(nverified);
-		return (true);
+		return true;
 	} else {
 		INCSTAT(nverifyfailed);
-		return (false);
+		return false;
 	}
 }

@@ -634,24 +631,20 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 			if (sigset.ttl != ttl) {
 				vbprintf(2, "\tfixing ttl %s\n", sigstr);
 				tuple = NULL;
-				result = dns_difftuple_create(
-					mctx, DNS_DIFFOP_DELRESIGN, name,
-					sigset.ttl, &sigrdata, &tuple);
-				check_result(result, "dns_difftuple_create");
+				dns_difftuple_create(mctx, DNS_DIFFOP_DELRESIGN,
+						     name, sigset.ttl,
+						     &sigrdata, &tuple);
 				dns_diff_append(del, &tuple);
-				result = dns_difftuple_create(
-					mctx, DNS_DIFFOP_ADDRESIGN, name, ttl,
-					&sigrdata, &tuple);
-				check_result(result, "dns_difftuple_create");
+				dns_difftuple_create(mctx, DNS_DIFFOP_ADDRESIGN,
+						     name, ttl, &sigrdata,
+						     &tuple);
 				dns_diff_append(add, &tuple);
 			}
 		} else {
 			tuple = NULL;
 			vbprintf(2, "\tremoving signature by %s\n", sigstr);
-			result = dns_difftuple_create(
-				mctx, DNS_DIFFOP_DELRESIGN, name, sigset.ttl,
-				&sigrdata, &tuple);
-			check_result(result, "dns_difftuple_create");
+			dns_difftuple_create(mctx, DNS_DIFFOP_DELRESIGN, name,
+					     sigset.ttl, &sigrdata, &tuple);
 			dns_diff_append(del, &tuple);
 			INCSTAT(ndropped);
 		}
@@ -680,6 +673,10 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 	for (key = ISC_LIST_HEAD(keylist); key != NULL;
 	     key = ISC_LIST_NEXT(key, link))
 	{
+		if (REVOKE(key->key) && set->type != dns_rdatatype_dnskey) {
+			continue;
+		}
+
 		if (nowsignedby[key->index]) {
 			continue;
 		}
@@ -862,7 +859,7 @@ hashlist_add_dns_name(hashlist_t *l,

 static int
 hashlist_comp(const void *a, const void *b) {
-	return (memcmp(a, b, hash_length + 1));
+	return memcmp(a, b, hash_length + 1);
 }

 static void
@@ -894,11 +891,11 @@ hashlist_hasdup(hashlist_t *l) {
 			continue;
 		}
 		if (isc_safe_memequal(current, next, l->length - 1)) {
-			return (true);
+			return true;
 		}
 		current = next;
 	}
-	return (false);
+	return false;
 }

 static const unsigned char *
@@ -920,16 +917,16 @@ hashlist_findnext(const hashlist_t *l,
 		}
 	} while (entries-- > 1U);
 	INSIST(entries != 0U);
-	return (next);
+	return next;
 }

 static bool
 hashlist_exists(const hashlist_t *l,
 		const unsigned char hash[NSEC3_MAX_HASH_LENGTH]) {
 	if (bsearch(hash, l->hashbuf, l->entries, l->length, hashlist_comp)) {
-		return (true);
+		return true;
 	} else {
-		return (false);
+		return false;
 	}
 }

@@ -1038,7 +1035,7 @@ loadds(dns_name_t *name, uint32_t ttl, dns_rdataset_t *dsset) {
 				vbprintf(2, "found DS records\n");
 				dsset->ttl = ttl;
 				dns_db_detach(&db);
-				return (result);
+				return result;
 			}
 		}
 		dns_db_detach(&db);
@@ -1047,13 +1044,13 @@ loadds(dns_name_t *name, uint32_t ttl, dns_rdataset_t *dsset) {
 	/* No DS records found; try again, looking for DNSKEY records */
 	opendb("keyset-", name, gclass, &db);
 	if (db == NULL) {
-		return (ISC_R_NOTFOUND);
+		return ISC_R_NOTFOUND;
 	}

 	result = dns_db_findnode(db, name, false, &node);
 	if (result != ISC_R_SUCCESS) {
 		dns_db_detach(&db);
-		return (result);
+		return result;
 	}

 	dns_rdataset_init(&keyset);
@@ -1062,7 +1059,7 @@ loadds(dns_name_t *name, uint32_t ttl, dns_rdataset_t *dsset) {
 	if (result != ISC_R_SUCCESS) {
 		dns_db_detachnode(db, &node);
 		dns_db_detach(&db);
-		return (result);
+		return result;
 	}
 	vbprintf(2, "found DNSKEY records\n");

@@ -1080,9 +1077,8 @@ loadds(dns_name_t *name, uint32_t ttl, dns_rdataset_t *dsset) {
 					   dsbuf, &ds);
 		check_result(result, "dns_ds_buildrdata");

-		result = dns_difftuple_create(mctx, DNS_DIFFOP_ADDRESIGN, name,
-					      ttl, &ds, &tuple);
-		check_result(result, "dns_difftuple_create");
+		dns_difftuple_create(mctx, DNS_DIFFOP_ADDRESIGN, name, ttl, &ds,
+				     &tuple);
 		dns_diff_append(&diff, &tuple);
 	}

@@ -1099,7 +1095,7 @@ loadds(dns_name_t *name, uint32_t ttl, dns_rdataset_t *dsset) {
 	dns_rdataset_disassociate(&keyset);
 	dns_db_detachnode(db, &node);
 	dns_db_detach(&db);
-	return (result);
+	return result;
 }

 static bool
@@ -1108,7 +1104,7 @@ secure(dns_name_t *name, dns_dbnode_t *node) {
 	isc_result_t result;

 	if (dns_name_equal(name, gorigin)) {
-		return (false);
+		return false;
 	}

 	dns_rdataset_init(&dsset);
@@ -1118,7 +1114,7 @@ secure(dns_name_t *name, dns_dbnode_t *node) {
 		dns_rdataset_disassociate(&dsset);
 	}

-	return (result == ISC_R_SUCCESS);
+	return result == ISC_R_SUCCESS;
 }

 static bool
@@ -1128,7 +1124,7 @@ is_delegation(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *origin,
 	isc_result_t result;

 	if (dns_name_equal(name, origin)) {
-		return (false);
+		return false;
 	}

 	dns_rdataset_init(&nsset);
@@ -1141,7 +1137,7 @@ is_delegation(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *origin,
 		dns_rdataset_disassociate(&nsset);
 	}

-	return ((result == ISC_R_SUCCESS));
+	return result == ISC_R_SUCCESS;
 }

 /*%
@@ -1160,7 +1156,7 @@ has_dname(dns_db_t *db, dns_dbversion_t *ver, dns_dbnode_t *node) {
 		dns_rdataset_disassociate(&dnameset);
 	}

-	return ((result == ISC_R_SUCCESS));
+	return result == ISC_R_SUCCESS;
 }

 /*%
@@ -1378,7 +1374,7 @@ active_node(dns_dbnode_t *node) {
 	}
 	dns_rdatasetiter_destroy(&rdsiter);

-	return (active);
+	return active;
 }

 /*%
@@ -1427,7 +1423,7 @@ setsoaserial(uint32_t serial, dns_updatemethod_t method) {

 	result = dns_db_getoriginnode(gdb, &node);
 	if (result != ISC_R_SUCCESS) {
-		return (result);
+		return result;
 	}

 	dns_rdataset_init(&rdataset);
@@ -1501,7 +1497,7 @@ cleanup:
 	}
 	dns_rdata_reset(&rdata);

-	return (result);
+	return result;
 }

 /*%
@@ -2201,10 +2197,9 @@ rrset_cleanup(dns_name_t *name, dns_rdataset_t *rdataset, dns_diff_t *add,
 			{
 				vbprintf(2, "removing duplicate at %s/%s\n",
 					 namestr, typestr);
-				result = dns_difftuple_create(
-					mctx, DNS_DIFFOP_DELRESIGN, name,
-					rdataset->ttl, &rdata2, &tuple);
-				check_result(result, "dns_difftuple_create");
+				dns_difftuple_create(mctx, DNS_DIFFOP_DELRESIGN,
+						     name, rdataset->ttl,
+						     &rdata2, &tuple);
 				dns_diff_append(del, &tuple);
 			} else if (set_maxttl && rdataset->ttl > maxttl) {
 				vbprintf(2,
@@ -2212,16 +2207,14 @@ rrset_cleanup(dns_name_t *name, dns_rdataset_t *rdataset, dns_diff_t *add,
 					 "from %d to %d\n",
 					 namestr, typestr, rdataset->ttl,
 					 maxttl);
-				result = dns_difftuple_create(
-					mctx, DNS_DIFFOP_DELRESIGN, name,
-					rdataset->ttl, &rdata2, &tuple);
-				check_result(result, "dns_difftuple_create");
+				dns_difftuple_create(mctx, DNS_DIFFOP_DELRESIGN,
+						     name, rdataset->ttl,
+						     &rdata2, &tuple);
 				dns_diff_append(del, &tuple);
 				tuple = NULL;
-				result = dns_difftuple_create(
-					mctx, DNS_DIFFOP_ADDRESIGN, name,
-					maxttl, &rdata2, &tuple);
-				check_result(result, "dns_difftuple_create");
+				dns_difftuple_create(mctx, DNS_DIFFOP_ADDRESIGN,
+						     name, maxttl, &rdata2,
+						     &tuple);
 				dns_diff_append(add, &tuple);
 			}
 		}
@@ -3154,15 +3147,13 @@ writeset(const char *prefix, dns_rdatatype_t type) {
 						   DNS_DSDIGEST_SHA256, dsbuf,
 						   &ds);
 			check_result(result, "dns_ds_buildrdata");
-			result = dns_difftuple_create(mctx,
-						      DNS_DIFFOP_ADDRESIGN,
-						      name, 0, &ds, &tuple);
+			dns_difftuple_create(mctx, DNS_DIFFOP_ADDRESIGN, name,
+					     0, &ds, &tuple);
 		} else {
-			result = dns_difftuple_create(
-				mctx, DNS_DIFFOP_ADDRESIGN, gorigin,
-				zone_soa_min_ttl, &rdata, &tuple);
+			dns_difftuple_create(mctx, DNS_DIFFOP_ADDRESIGN,
+					     gorigin, zone_soa_min_ttl, &rdata,
+					     &tuple);
 		}
-		check_result(result, "dns_difftuple_create");
 		dns_diff_append(&diff, &tuple);
 	}

@@ -3212,7 +3203,7 @@ print_version(FILE *fp) {
 	fprintf(fp, "; %s version %s\n", program, PACKAGE_VERSION);
 }

-noreturn static void
+ISC_NORETURN static void
 usage(void);

 static void
@@ -3274,8 +3265,6 @@ usage(void) {
 	fprintf(stderr, "\t-a:\t");
 	fprintf(stderr, "verify generated signatures\n");
 	fprintf(stderr, "\t-c class (IN)\n");
-	fprintf(stderr, "\t-E engine:\n");
-	fprintf(stderr, "\t\tname of an OpenSSL engine to use\n");
 	fprintf(stderr, "\t-P:\t");
 	fprintf(stderr, "disable post-sign verification\n");
 	fprintf(stderr, "\t-Q:\t");
@@ -3322,21 +3311,24 @@ print_stats(isc_time_t *timer_start, isc_time_t *timer_finish,
 	uint64_t sig_ms;  /* Signatures per millisecond */
 	FILE *out = output_stdout ? stderr : stdout;

-	fprintf(out, "Signatures generated:               %10u\n", nsigned);
-	fprintf(out, "Signatures retained:                %10u\n", nretained);
-	fprintf(out, "Signatures dropped:                 %10u\n", ndropped);
-	fprintf(out, "Signatures successfully verified:   %10u\n", nverified);
-	fprintf(out,
-		"Signatures unsuccessfully "
-		"verified: %10u\n",
-		nverifyfailed);
+	fprintf(out, "Signatures generated:               %10" PRIuFAST32 "\n",
+		atomic_load(&nsigned));
+	fprintf(out, "Signatures retained:                %10" PRIuFAST32 "\n",
+		atomic_load(&nretained));
+	fprintf(out, "Signatures dropped:                 %10" PRIuFAST32 "\n",
+		atomic_load(&ndropped));
+	fprintf(out, "Signatures successfully verified:   %10" PRIuFAST32 "\n",
+		atomic_load(&nverified));
+	fprintf(out, "Signatures unsuccessfully verified: %10" PRIuFAST32 "\n",
+		atomic_load(&nverifyfailed));

 	time_us = isc_time_microdiff(sign_finish, sign_start);
 	time_ms = time_us / 1000;
 	fprintf(out, "Signing time in seconds:           %7u.%03u\n",
 		(unsigned int)(time_ms / 1000), (unsigned int)(time_ms % 1000));
 	if (time_us > 0) {
-		sig_ms = ((uint64_t)nsigned * 1000000000) / time_us;
+		sig_ms = ((uint64_t)atomic_load(&nsigned) * 1000000000) /
+			 time_us;
 		fprintf(out, "Signatures per second:             %7u.%03u\n",
 			(unsigned int)sig_ms / 1000,
 			(unsigned int)sig_ms % 1000);
@@ -3363,8 +3355,6 @@ main(int argc, char *argv[]) {
 	isc_time_t sign_start, sign_finish;
 	dns_dnsseckey_t *key;
 	isc_result_t result, vresult;
-	isc_log_t *log = NULL;
-	const char *engine = NULL;
 	bool free_output = false;
 	int tempfilelen = 0;
 	dns_rdataclass_t rdclass;
@@ -3375,7 +3365,7 @@ main(int argc, char *argv[]) {
 	bool set_iter = false;
 	bool nonsecify = false;
 	bool set_fips_mode = false;
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
 	OSSL_PROVIDER *fips = NULL, *base = NULL;
 #endif

@@ -3472,7 +3462,7 @@ main(int argc, char *argv[]) {
 			break;

 		case 'E':
-			engine = isc_commandline_argument;
+			fatal("%s", isc_result_totext(DST_R_NOENGINE));
 			break;

 		case 'e':
@@ -3739,7 +3729,7 @@ main(int argc, char *argv[]) {
 	isc_managers_create(&mctx, nloops, &loopmgr, &netmgr);

 	if (set_fips_mode) {
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
 		fips = OSSL_PROVIDER_load(NULL, "fips");
 		if (fips == NULL) {
 			ERR_clear_error();
@@ -3759,13 +3749,7 @@ main(int argc, char *argv[]) {
 		}
 	}

-	result = dst_lib_init(mctx, engine);
-	if (result != ISC_R_SUCCESS) {
-		fatal("could not initialize dst: %s",
-		      isc_result_totext(result));
-	}
-
-	setup_logging(mctx, &log);
+	setup_logging();

 	argc -= isc_commandline_index;
 	argv += isc_commandline_index;
@@ -4047,10 +4031,6 @@ main(int argc, char *argv[]) {

 	isc_mutex_init(&namelock);

-	if (printstats) {
-		isc_mutex_init(&statslock);
-	}
-
 	presign();
 	sign_start = isc_time_now();
 	signapex();
@@ -4136,13 +4116,11 @@ main(int argc, char *argv[]) {

 	dns_master_styledestroy(&dsstyle, mctx);

-	cleanup_logging(&log);
-	dst_lib_destroy();
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}

-#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
 	if (base != NULL) {
 		OSSL_PROVIDER_unload(base);
 	}
@@ -4157,9 +4135,8 @@ main(int argc, char *argv[]) {
 		timer_finish = isc_time_now();
 		print_stats(&timer_start, &timer_finish, &sign_start,
 			    &sign_finish);
-		isc_mutex_destroy(&statslock);
 	}
 	isc_mutex_destroy(&namelock);

-	return (vresult == ISC_R_SUCCESS ? 0 : 1);
+	return vresult == ISC_R_SUCCESS ? 0 : 1;
 }
@@ -21,7 +21,7 @@ dnssec-signzone - DNSSEC zone signing tool
 Synopsis
 ~~~~~~~~

-:program:`dnssec-signzone` [**-a**] [**-c** class] [**-d** directory] [**-D**] [**-E** engine] [**-e** end-time] [**-f** output-file] [**-F**] [**-g**] [**-G sync-records**] [**-h**] [**-i** interval] [**-I** input-format] [**-j** jitter] [**-J** filename] [**-K** directory] [**-k** key] [**-L** serial] [**-M** maxttl] [**-N** soa-serial-format] [**-o** origin] [**-O** output-format] [**-P**] [**-Q**] [**-q**] [**-R**] [**-S**] [**-s** start-time] [**-T** ttl] [**-t**] [**-u**] [**-v** level] [**-V**] [**-X** extended end-time] [**-x**] [**-z**] [**-3** salt] [**-H** iterations] [**-A**] {zonefile} [key...]
+:program:`dnssec-signzone` [**-a**] [**-c** class] [**-d** directory] [**-D**] [**-e** end-time] [**-f** output-file] [**-F**] [**-g**] [**-G sync-records**] [**-h**] [**-i** interval] [**-I** input-format] [**-j** jitter] [**-J** filename] [**-K** directory] [**-k** key] [**-L** serial] [**-M** maxttl] [**-N** soa-serial-format] [**-o** origin] [**-O** output-format] [**-P**] [**-Q**] [**-q**] [**-R**] [**-S**] [**-s** start-time] [**-T** ttl] [**-t**] [**-u**] [**-v** level] [**-V**] [**-X** extended end-time] [**-x**] [**-z**] [**-3** salt] [**-H** iterations] [**-A**] {zonefile} [key...]

 Description
 ~~~~~~~~~~~
@@ -62,15 +62,6 @@ Options
   ``$INCLUDE``. This option cannot be combined with :option:`-O raw <-O>`
   or serial-number updating.

-.. option:: -E engine
-
-   This option specifies the hardware to use for cryptographic
-   operations, such as a secure key store used for signing, when applicable.
-
-   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
-   engine identifier that drives the cryptographic accelerator or
-   hardware service module (usually ``pkcs11``).
-
 .. option:: -F

   This options turns on FIPS (US Federal Information Processing Standards)
@@ -23,6 +23,7 @@
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/hex.h>
+#include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/mutex.h>
 #include <isc/os.h>
@@ -42,7 +43,6 @@
 #include <dns/ds.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
-#include <dns/log.h>
 #include <dns/master.h>
 #include <dns/masterdump.h>
 #include <dns/nsec.h>
@@ -136,7 +136,7 @@ loadzone(char *file, char *origin, dns_rdataclass_t rdclass, dns_db_t **db) {
 	}
 }

-noreturn static void
+ISC_NORETURN static void
 usage(void);

 static void
@@ -157,8 +157,6 @@ usage(void) {
 	fprintf(stderr, "\t-I format:\n");
 	fprintf(stderr, "\t\tfile format of input zonefile (text)\n");
 	fprintf(stderr, "\t-c class (IN)\n");
-	fprintf(stderr, "\t-E engine:\n");
-	fprintf(stderr, "\t\tname of an OpenSSL engine to use\n");
 	fprintf(stderr, "\t-x:\tDNSKEY record signed with KSKs only, "
 			"not ZSKs\n");
 	fprintf(stderr, "\t-z:\tAll records signed with KSKs\n");
@@ -170,8 +168,6 @@ main(int argc, char *argv[]) {
 	char *origin = NULL, *file = NULL;
 	char *inputformatstr = NULL;
 	isc_result_t result;
-	isc_log_t *log = NULL;
-	const char *engine = NULL;
 	char *classname = NULL;
 	dns_rdataclass_t rdclass;
 	char *endp;
@@ -215,7 +211,7 @@ main(int argc, char *argv[]) {
 			break;

 		case 'E':
-			engine = isc_commandline_argument;
+			fatal("%s", isc_result_totext(DST_R_NOENGINE));
 			break;

 		case 'I':
@@ -275,17 +271,11 @@ main(int argc, char *argv[]) {
 		}
 	}

-	result = dst_lib_init(mctx, engine);
-	if (result != ISC_R_SUCCESS) {
-		fatal("could not initialize dst: %s",
-		      isc_result_totext(result));
-	}
-
 	now = isc_stdtime_now();

 	rdclass = strtoclass(classname);

-	setup_logging(mctx, &log);
+	setup_logging();

 	argc -= isc_commandline_index;
 	argv += isc_commandline_index;
@@ -335,12 +325,10 @@ main(int argc, char *argv[]) {
 	dns_db_closeversion(gdb, &gversion, false);
 	dns_db_detach(&gdb);

-	cleanup_logging(&log);
-	dst_lib_destroy();
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
 	isc_mem_destroy(&mctx);

-	return (result == ISC_R_SUCCESS ? 0 : 1);
+	return result == ISC_R_SUCCESS ? 0 : 1;
 }
@@ -21,7 +21,7 @@ dnssec-verify - DNSSEC zone verification tool
 Synopsis
 ~~~~~~~~

-:program:`dnssec-verify` [**-c** class] [**-E** engine] [**-I** input-format] [**-J** filename] [**-o** origin] [**-q**] [**-v** level] [**-V**] [**-x**] [**-z**] {zonefile}
+:program:`dnssec-verify` [**-c** class] [**-I** input-format] [**-J** filename] [**-o** origin] [**-q**] [**-v** level] [**-V**] [**-x**] [**-z**] {zonefile}

 Description
 ~~~~~~~~~~~
@@ -37,14 +37,6 @@ Options

   This option specifies the DNS class of the zone.

-.. option:: -E engine
-
-   This option specifies the cryptographic hardware to use, when applicable.
-
-   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
-   engine identifier that drives the cryptographic accelerator or
-   hardware service module (usually ``pkcs11``).
-
 .. option:: -I input-format

   This option sets the format of the input zone file. Possible formats are ``text``
@@ -29,6 +29,7 @@
 #include <isc/file.h>
 #include <isc/heap.h>
 #include <isc/list.h>
+#include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
 #include <isc/string.h>
@@ -43,7 +44,6 @@
 #include <dns/fixedname.h>
 #include <dns/journal.h>
 #include <dns/keyvalues.h>
-#include <dns/log.h>
 #include <dns/name.h>
 #include <dns/nsec.h>
 #include <dns/nsec3.h>
@@ -128,10 +128,8 @@ sig_format(dns_rdata_rrsig_t *sig, char *cp, unsigned int size) {
 }

 void
-setup_logging(isc_mem_t *mctx, isc_log_t **logp) {
-	isc_logdestination_t destination;
+setup_logging(void) {
 	isc_logconfig_t *logconfig = NULL;
-	isc_log_t *log = NULL;
 	int level;

 	if (verbose < 0) {
@@ -153,10 +151,8 @@ setup_logging(isc_mem_t *mctx, isc_log_t **logp) {
 		break;
 	}

-	isc_log_create(mctx, &log, &logconfig);
-	isc_log_setcontext(log);
-	dns_log_init(log);
-	dns_log_setcontext(log);
+	logconfig = isc_logconfig_get();
+
 	isc_log_settag(logconfig, program);

 	/*
@@ -165,36 +161,11 @@ setup_logging(isc_mem_t *mctx, isc_log_t **logp) {
 	 *  - the program name and logging level are printed
 	 *  - no time stamp is printed
 	 */
-	destination.file.stream = stderr;
-	destination.file.name = NULL;
-	destination.file.versions = ISC_LOG_ROLLNEVER;
-	destination.file.maximum_size = 0;
-	isc_log_createchannel(logconfig, "stderr", ISC_LOG_TOFILEDESC, level,
-			      &destination,
-			      ISC_LOG_PRINTTAG | ISC_LOG_PRINTLEVEL);
-
-	RUNTIME_CHECK(isc_log_usechannel(logconfig, "stderr", NULL, NULL) ==
-		      ISC_R_SUCCESS);
-
-	*logp = log;
-}
-
-void
-cleanup_logging(isc_log_t **logp) {
-	isc_log_t *log;
-
-	REQUIRE(logp != NULL);
-
-	log = *logp;
-	*logp = NULL;
-
-	if (log == NULL) {
-		return;
-	}
-
-	isc_log_destroy(&log);
-	isc_log_setcontext(NULL);
-	dns_log_setcontext(NULL);
+	isc_log_createandusechannel(
+		logconfig, "default_stderr", ISC_LOG_TOFILEDESC, level,
+		ISC_LOGDESTINATION_STDERR,
+		ISC_LOG_PRINTTAG | ISC_LOG_PRINTLEVEL, ISC_LOGCATEGORY_DEFAULT,
+		ISC_LOGMODULE_DEFAULT);
 }

 static isc_stdtime_t
@@ -202,16 +173,16 @@ time_units(isc_stdtime_t offset, char *suffix, const char *str) {
 	switch (suffix[0]) {
 	case 'Y':
 	case 'y':
-		return (offset * (365 * 24 * 3600));
+		return offset * (365 * 24 * 3600);
 	case 'M':
 	case 'm':
 		switch (suffix[1]) {
 		case 'O':
 		case 'o':
-			return (offset * (30 * 24 * 3600));
+			return offset * (30 * 24 * 3600);
 		case 'I':
 		case 'i':
-			return (offset * 60);
+			return offset * 60;
 		case '\0':
 			fatal("'%s' ambiguous: use 'mi' for minutes "
 			      "or 'mo' for months",
@@ -223,29 +194,29 @@ time_units(isc_stdtime_t offset, char *suffix, const char *str) {
 		break;
 	case 'W':
 	case 'w':
-		return (offset * (7 * 24 * 3600));
+		return offset * (7 * 24 * 3600);
 	case 'D':
 	case 'd':
-		return (offset * (24 * 3600));
+		return offset * (24 * 3600);
 	case 'H':
 	case 'h':
-		return (offset * 3600);
+		return offset * 3600;
 	case 'S':
 	case 's':
 	case '\0':
-		return (offset);
+		return offset;
 	default:
 		fatal("time value %s is invalid", str);
 	}
 	UNREACHABLE();
-	return (0); /* silence compiler warning */
+	return 0; /* silence compiler warning */
 }

 static bool
 isnone(const char *str) {
-	return ((strcasecmp(str, "none") == 0) ||
-		(strcasecmp(str, "never") == 0) ||
-		(strcasecmp(str, "unset") == 0));
+	return (strcasecmp(str, "none") == 0) ||
+	       (strcasecmp(str, "never") == 0) ||
+	       (strcasecmp(str, "unset") == 0);
 }

 dns_ttl_t
@@ -255,7 +226,7 @@ strtottl(const char *str) {
 	char *endp;

 	if (isnone(str)) {
-		return ((dns_ttl_t)0);
+		return (dns_ttl_t)0;
 	}

 	ttl = strtol(str, &endp, 0);
@@ -263,19 +234,19 @@ strtottl(const char *str) {
 		fatal("TTL must be numeric");
 	}
 	ttl = time_units(ttl, endp, orig);
-	return (ttl);
+	return ttl;
 }

 dst_key_state_t
 strtokeystate(const char *str) {
 	if (isnone(str)) {
-		return (DST_KEY_STATE_NA);
+		return DST_KEY_STATE_NA;
 	}

 	for (int i = 0; i < KEYSTATES_NVALUES; i++) {
 		if (keystates[i] != NULL && strcasecmp(str, keystates[i]) == 0)
 		{
-			return ((dst_key_state_t)i);
+			return (dst_key_state_t)i;
 		}
 	}
 	fatal("unknown key state %s", str);
@@ -292,13 +263,13 @@ strtotime(const char *str, int64_t now, int64_t base, bool *setp) {

 	if (isnone(str)) {
 		SET_IF_NOT_NULL(setp, false);
-		return ((isc_stdtime_t)0);
+		return (isc_stdtime_t)0;
 	}

 	SET_IF_NOT_NULL(setp, true);

 	if ((str[0] == '0' || str[0] == '-') && str[1] == '\0') {
-		return ((isc_stdtime_t)0);
+		return (isc_stdtime_t)0;
 	}

 	/*
@@ -347,7 +318,7 @@ strtotime(const char *str, int64_t now, int64_t base, bool *setp) {
 	}

 	if (str[0] == '\0') {
-		return ((isc_stdtime_t)base);
+		return (isc_stdtime_t)base;
 	} else if (str[0] == '+') {
 		offset = strtol(str + 1, &endp, 0);
 		offset = time_units((isc_stdtime_t)offset, endp, orig);
@@ -360,7 +331,7 @@ strtotime(const char *str, int64_t now, int64_t base, bool *setp) {
 		fatal("time value %s is invalid", orig);
 	}

-	return ((isc_stdtime_t)val);
+	return (isc_stdtime_t)val;
 }

 dns_rdataclass_t
@@ -370,7 +341,7 @@ strtoclass(const char *str) {
 	isc_result_t result;

 	if (str == NULL) {
-		return (dns_rdataclass_in);
+		return dns_rdataclass_in;
 	}
 	r.base = UNCONST(str);
 	r.length = strlen(str);
@@ -378,7 +349,7 @@ strtoclass(const char *str) {
 	if (result != ISC_R_SUCCESS) {
 		fatal("unknown class %s", str);
 	}
-	return (rdclass);
+	return rdclass;
 }

 unsigned int
@@ -393,14 +364,14 @@ strtodsdigest(const char *str) {
 	if (result != ISC_R_SUCCESS) {
 		fatal("unknown DS algorithm %s", str);
 	}
-	return (alg);
+	return alg;
 }

 static int
 cmp_dtype(const void *ap, const void *bp) {
 	int a = *(const uint8_t *)ap;
 	int b = *(const uint8_t *)bp;
-	return (a - b);
+	return a - b;
 }

 void
@@ -432,7 +403,7 @@ try_dir(const char *dirname) {
 	if (result == ISC_R_SUCCESS) {
 		isc_dir_close(&d);
 	}
-	return (result);
+	return result;
 }

 /*
@@ -479,7 +450,7 @@ set_keyversion(dst_key_t *key) {

 bool
 key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
-	      isc_mem_t *mctx, bool *exact) {
+	      isc_mem_t *mctx, uint16_t min, uint16_t max, bool *exact) {
 	isc_result_t result;
 	bool conflict = false;
 	dns_dnsseckeylist_t matchkeys;
@@ -497,11 +468,26 @@ key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
 	rid = dst_key_rid(dstkey);
 	alg = dst_key_alg(dstkey);

+	if (min != max) {
+		if (id < min || id > max) {
+			fprintf(stderr, "Key ID %d outside of [%u..%u]\n", id,
+				min, max);
+			return true;
+		}
+		if (rid < min || rid > max) {
+			fprintf(stderr,
+				"Revoked Key ID %d (for tag %d) outside of "
+				"[%u..%u]\n",
+				rid, id, min, max);
+			return true;
+		}
+	}
+
 	ISC_LIST_INIT(matchkeys);
 	result = dns_dnssec_findmatchingkeys(name, NULL, dir, NULL, now, mctx,
 					     &matchkeys);
 	if (result == ISC_R_NOTFOUND) {
-		return (false);
+		return false;
 	}

 	while (!ISC_LIST_EMPTY(matchkeys) && !conflict) {
@@ -545,7 +531,7 @@ key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
 		dns_dnsseckey_destroy(mctx, &key);
 	}

-	return (conflict);
+	return conflict;
 }

 bool
@@ -560,9 +546,9 @@ isoptarg(const char *arg, char **argv, void (*usage)(void)) {
 		isc_commandline_argument = argv[isc_commandline_index];
 		/* skip to next argument */
 		isc_commandline_index++;
-		return (true);
+		return true;
 	}
-	return (false);
+	return false;
 }

 void
@@ -604,9 +590,8 @@ cleanup:
 }

 void
-kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, isc_log_t *lctx,
-	       const char *name, const char *keydir, const char *engine,
-	       dns_kasp_t **kaspp) {
+kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
+	       const char *keydir, dns_kasp_t **kaspp) {
 	isc_result_t result = ISC_R_NOTFOUND;
 	const cfg_listelt_t *element;
 	const cfg_obj_t *kasps = NULL;
@@ -625,8 +610,7 @@ kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, isc_log_t *lctx,
 	{
 		cfg_obj_t *kconfig = cfg_listelt_value(element);
 		ks = NULL;
-		result = cfg_keystore_fromconfig(kconfig, mctx, lctx, engine,
-						 &kslist, NULL);
+		result = cfg_keystore_fromconfig(kconfig, mctx, &kslist, NULL);
 		if (result != ISC_R_SUCCESS) {
 			fatal("failed to configure key-store '%s': %s",
 			      cfg_obj_asstring(cfg_tuple_get(kconfig, "name")),
@@ -635,7 +619,7 @@ kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, isc_log_t *lctx,
 	}
 	/* Default key-directory key store. */
 	ks = NULL;
-	(void)cfg_keystore_fromconfig(NULL, mctx, lctx, engine, &kslist, &ks);
+	(void)cfg_keystore_fromconfig(NULL, mctx, &kslist, &ks);
 	INSIST(ks != NULL);
 	if (keydir != NULL) {
 		/* '-K keydir' takes priority */
@@ -655,8 +639,8 @@ kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, isc_log_t *lctx,
 			continue;
 		}

-		result = cfg_kasp_fromconfig(kconfig, NULL, true, mctx, lctx,
-					     &kslist, &kasplist, &kasp);
+		result = cfg_kasp_fromconfig(kconfig, NULL, true, mctx, &kslist,
+					     &kasplist, &kasp);
 		if (result != ISC_R_SUCCESS) {
 			fatal("failed to configure dnssec-policy '%s': %s",
 			      cfg_obj_asstring(cfg_tuple_get(kconfig, "name")),
@@ -54,7 +54,7 @@ extern uint8_t dtype[8];

 typedef void(fatalcallback_t)(void);

-noreturn void
+ISC_NORETURN void
 fatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);

 void
@@ -66,7 +66,7 @@ check_result(isc_result_t result, const char *message);
 void
 vbprintf(int level, const char *fmt, ...) ISC_FORMAT_PRINTF(2, 3);

-noreturn void
+ISC_NORETURN void
 version(const char *program);

 void
@@ -75,10 +75,7 @@ sig_format(dns_rdata_rrsig_t *sig, char *cp, unsigned int size);
 	(DNS_NAME_FORMATSIZE + DNS_SECALG_FORMATSIZE + sizeof("65535"))

 void
-setup_logging(isc_mem_t *mctx, isc_log_t **logp);
-
-void
-cleanup_logging(isc_log_t **logp);
+setup_logging(void);

 dns_ttl_t
 strtottl(const char *str);
@@ -109,7 +106,7 @@ set_keyversion(dst_key_t *key);

 bool
 key_collision(dst_key_t *key, dns_name_t *name, const char *dir,
-	      isc_mem_t *mctx, bool *exact);
+	      isc_mem_t *mctx, uint16_t min, uint16_t max, bool *exact);

 bool
 isoptarg(const char *arg, char **argv, void (*usage)(void));
@@ -118,6 +115,5 @@ void
 loadjournal(isc_mem_t *mctx, dns_db_t *db, const char *journal);

 void
-kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, isc_log_t *lctx,
-	       const char *name, const char *keydir, const char *engine,
-	       dns_kasp_t **kaspp);
+kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
+	       const char *keydir, dns_kasp_t **kaspp);
@@ -120,7 +120,7 @@ putrdata(bdbnode_t *node, dns_rdatatype_t typeval, dns_ttl_t ttl,
 		rdatalist->ttl = ttl;
 		ISC_LIST_APPEND(node->lists, rdatalist, link);
 	} else if (rdatalist->ttl != ttl) {
-		return (DNS_R_BADTTL);
+		return DNS_R_BADTTL;
 	}

 	rdata = isc_mem_get(mctx, sizeof(dns_rdata_t));
@@ -136,7 +136,7 @@ putrdata(bdbnode_t *node, dns_rdatatype_t typeval, dns_ttl_t ttl,
 	ISC_LIST_APPEND(rdatalist->rdata, rdata, link);
 	ISC_LIST_APPEND(node->buffers, rdatabuf, link);

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static isc_result_t
@@ -159,7 +159,7 @@ putrr(bdbnode_t *node, const char *type, dns_ttl_t ttl, const char *data) {
 	isc_constregion_t r = { .base = type, .length = strlen(type) };
 	result = dns_rdatatype_fromtext(&typeval, (isc_textregion_t *)&r);
 	if (result != ISC_R_SUCCESS) {
-		return (result);
+		return result;
 	}

 	isc_lex_create(mctx, 64, &lex);
@@ -170,7 +170,7 @@ putrr(bdbnode_t *node, const char *type, dns_ttl_t ttl, const char *data) {

 	result = isc_lex_openbuffer(lex, &b);
 	if (result != ISC_R_SUCCESS) {
-		return (result);
+		return result;
 	}

 	isc_buffer_allocate(mctx, &rb, DNS_RDATA_MAXLENGTH);
@@ -185,7 +185,7 @@ putrr(bdbnode_t *node, const char *type, dns_ttl_t ttl, const char *data) {

 	isc_buffer_free(&rb);

-	return (result);
+	return result;
 }

 /* Reasonable default SOA values */
@@ -207,9 +207,9 @@ putsoa(bdbnode_t *node, const char *mname, const char *rname, uint32_t serial) {
 		     serial, DEFAULT_REFRESH, DEFAULT_RETRY, DEFAULT_EXPIRE,
 		     DEFAULT_MINIMUM);
 	if (n >= (int)sizeof(str) || n < 0) {
-		return (ISC_R_NOSPACE);
+		return ISC_R_NOSPACE;
 	}
-	return (putrr(node, "SOA", DEFAULT_TTL, str));
+	return putrr(node, "SOA", DEFAULT_TTL, str);
 }

 static isc_result_t
@@ -222,7 +222,7 @@ puttxt(bdbnode_t *node, const char *text) {
 	}
 	buf[0] = len;
 	memmove(&buf[1], text, len);
-	return (putrdata(node, dns_rdatatype_txt, 0, buf, len + 1));
+	return putrdata(node, dns_rdatatype_txt, 0, buf, len + 1);
 }

 /*
@@ -279,7 +279,7 @@ dns64_rdata(unsigned char *v, size_t start, unsigned char *rdata) {
 		}
 	}
 	memmove(&rdata[j], "\07in-addr\04arpa", 14);
-	return (j + 14);
+	return j + 14;
 }

 static isc_result_t
@@ -301,7 +301,7 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 	zlen = zone->length;
 	nlen = name->length;
 	if ((zlen + nlen) > 74U || zlen < 10U || (nlen % 2) != 0U) {
-		return (ISC_R_NOTFOUND);
+		return ISC_R_NOTFOUND;
 	}

 	/*
@@ -320,11 +320,11 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 	while (j != 0U) {
 		INSIST((i / 2) < sizeof(v));
 		if (ndata[0] != 1) {
-			return (ISC_R_NOTFOUND);
+			return ISC_R_NOTFOUND;
 		}
 		n = hex16[ndata[1] & 0xff];
 		if (n == 1) {
-			return (ISC_R_NOTFOUND);
+			return ISC_R_NOTFOUND;
 		}
 		v[i / 2] = n | (v[i / 2] >> 4);
 		j -= 2;
@@ -346,14 +346,14 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 		 * to exist in the zone.
 		 */
 		if (nlen > 16U && v[(nlen - 1) / 4 - 4] != 0) {
-			return (ISC_R_NOTFOUND);
+			return ISC_R_NOTFOUND;
 		}
 		/*
 		 * If the total length is not 74 then this is a empty node
 		 * so return success.
 		 */
 		if (nlen + zlen != 74U) {
-			return (ISC_R_SUCCESS);
+			return ISC_R_SUCCESS;
 		}
 		len = dns64_rdata(v, 8, rdata);
 		break;
@@ -363,14 +363,14 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 		 * to exist in the zone.
 		 */
 		if (nlen > 12U && v[(nlen - 1) / 4 - 3] != 0) {
-			return (ISC_R_NOTFOUND);
+			return ISC_R_NOTFOUND;
 		}
 		/*
 		 * If the total length is not 74 then this is a empty node
 		 * so return success.
 		 */
 		if (nlen + zlen != 74U) {
-			return (ISC_R_SUCCESS);
+			return ISC_R_SUCCESS;
 		}
 		len = dns64_rdata(v, 6, rdata);
 		break;
@@ -380,14 +380,14 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 		 * to exist in the zone.
 		 */
 		if (nlen > 8U && v[(nlen - 1) / 4 - 2] != 0) {
-			return (ISC_R_NOTFOUND);
+			return ISC_R_NOTFOUND;
 		}
 		/*
 		 * If the total length is not 74 then this is a empty node
 		 * so return success.
 		 */
 		if (nlen + zlen != 74U) {
-			return (ISC_R_SUCCESS);
+			return ISC_R_SUCCESS;
 		}
 		len = dns64_rdata(v, 5, rdata);
 		break;
@@ -397,14 +397,14 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 		 * to exist in the zone.
 		 */
 		if (nlen > 4U && v[(nlen - 1) / 4 - 1] != 0) {
-			return (ISC_R_NOTFOUND);
+			return ISC_R_NOTFOUND;
 		}
 		/*
 		 * If the total length is not 74 then this is a empty node
 		 * so return success.
 		 */
 		if (nlen + zlen != 74U) {
-			return (ISC_R_SUCCESS);
+			return ISC_R_SUCCESS;
 		}
 		len = dns64_rdata(v, 4, rdata);
 		break;
@@ -414,14 +414,14 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 		 * to exist in the zone.
 		 */
 		if (v[(nlen - 1) / 4] != 0) {
-			return (ISC_R_NOTFOUND);
+			return ISC_R_NOTFOUND;
 		}
 		/*
 		 * If the total length is not 74 then this is a empty node
 		 * so return success.
 		 */
 		if (nlen + zlen != 74U) {
-			return (ISC_R_SUCCESS);
+			return ISC_R_SUCCESS;
 		}
 		len = dns64_rdata(v, 3, rdata);
 		break;
@@ -431,7 +431,7 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 		 * so return success.
 		 */
 		if (nlen + zlen != 74U) {
-			return (ISC_R_SUCCESS);
+			return ISC_R_SUCCESS;
 		}
 		len = dns64_rdata(v, 0, rdata);
 		break;
@@ -440,7 +440,7 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 		 * This should never be reached unless someone adds a
 		 * zone declaration with this internal type to named.conf.
 		 */
-		return (ISC_R_NOTFOUND);
+		return ISC_R_NOTFOUND;
 	}

 	/*
@@ -449,22 +449,22 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 	if ((v[0] == 170 || v[0] == 171) && v[1] == 0 && v[2] == 0 &&
 	    v[3] == 192)
 	{
-		return (putrdata(node, dns_rdatatype_ptr, 3600, ipv4only,
-				 sizeof(ipv4only)));
+		return putrdata(node, dns_rdatatype_ptr, 3600, ipv4only,
+				sizeof(ipv4only));
 	}

-	return (putrdata(node, dns_rdatatype_cname, 600, rdata,
-			 (unsigned int)len));
+	return putrdata(node, dns_rdatatype_cname, 600, rdata,
+			(unsigned int)len);
 }

 static isc_result_t
 builtin_lookup(bdb_t *bdb, const dns_name_t *name, bdbnode_t *node) {
 	if (name->labels == 0 && name->length == 0) {
-		return (bdb->lookup(node));
+		return bdb->lookup(node);
 	} else if ((node->bdb->implementation->flags & BDB_DNS64) != 0) {
-		return (dns64_cname(&bdb->common.origin, name, node));
+		return dns64_cname(&bdb->common.origin, name, node);
 	} else {
-		return (ISC_R_NOTFOUND);
+		return ISC_R_NOTFOUND;
 	}
 }

@@ -483,27 +483,27 @@ builtin_authority(bdb_t *bdb, bdbnode_t *node) {

 	result = putsoa(node, server, contact, 0);
 	if (result != ISC_R_SUCCESS) {
-		return (ISC_R_FAILURE);
+		return ISC_R_FAILURE;
 	}

 	result = putrr(node, "NS", 0, server);
 	if (result != ISC_R_SUCCESS) {
-		return (ISC_R_FAILURE);
+		return ISC_R_FAILURE;
 	}

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static isc_result_t
 version_lookup(bdbnode_t *node) {
 	if (named_g_server->version_set) {
 		if (named_g_server->version == NULL) {
-			return (ISC_R_SUCCESS);
+			return ISC_R_SUCCESS;
 		} else {
-			return (puttxt(node, named_g_server->version));
+			return puttxt(node, named_g_server->version);
 		}
 	} else {
-		return (puttxt(node, PACKAGE_VERSION));
+		return puttxt(node, PACKAGE_VERSION);
 	}
 }

@@ -511,16 +511,16 @@ static isc_result_t
 hostname_lookup(bdbnode_t *node) {
 	if (named_g_server->hostname_set) {
 		if (named_g_server->hostname == NULL) {
-			return (ISC_R_SUCCESS);
+			return ISC_R_SUCCESS;
 		} else {
-			return (puttxt(node, named_g_server->hostname));
+			return puttxt(node, named_g_server->hostname);
 		}
 	} else {
 		char buf[256];
 		if (gethostname(buf, sizeof(buf)) != 0) {
-			return (ISC_R_FAILURE);
+			return ISC_R_FAILURE;
 		}
-		return (puttxt(node, buf));
+		return puttxt(node, buf);
 	}
 }

@@ -546,16 +546,16 @@ authors_lookup(bdbnode_t *node) {
 	 * If a version string is specified, disable the authors.bind zone.
 	 */
 	if (named_g_server->version_set) {
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	for (p = authors; *p != NULL; p++) {
 		result = puttxt(node, *p);
 		if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
 	}
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static isc_result_t
@@ -563,13 +563,13 @@ id_lookup(bdbnode_t *node) {
 	if (named_g_server->sctx->usehostname) {
 		char buf[256];
 		if (gethostname(buf, sizeof(buf)) != 0) {
-			return (ISC_R_FAILURE);
+			return ISC_R_FAILURE;
 		}
-		return (puttxt(node, buf));
+		return puttxt(node, buf);
 	} else if (named_g_server->sctx->server_id != NULL) {
-		return (puttxt(node, named_g_server->sctx->server_id));
+		return puttxt(node, named_g_server->sctx->server_id);
 	} else {
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}
 }

@@ -577,7 +577,7 @@ static isc_result_t
 empty_lookup(bdbnode_t *node) {
 	UNUSED(node);

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static isc_result_t
@@ -588,10 +588,10 @@ ipv4only_lookup(bdbnode_t *node) {
 	for (int i = 0; i < 2; i++) {
 		result = putrdata(node, dns_rdatatype_a, 3600, data[i], 4);
 		if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
 	}
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static isc_result_t
@@ -600,7 +600,7 @@ ipv4reverse_lookup(bdbnode_t *node) {

 	result = putrdata(node, dns_rdatatype_ptr, 3600, ipv4only,
 			  sizeof(ipv4only));
-	return (result);
+	return result;
 }

 /*
@@ -670,10 +670,10 @@ rdatasetiter_first(dns_rdatasetiter_t *iterator DNS__DB_FLARG) {
 	bdbnode_t *bdbnode = (bdbnode_t *)iterator->node;

 	if (ISC_LIST_EMPTY(bdbnode->lists)) {
-		return (ISC_R_NOMORE);
+		return ISC_R_NOMORE;
 	}
 	bdbiterator->current = ISC_LIST_HEAD(bdbnode->lists);
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static isc_result_t
@@ -682,9 +682,9 @@ rdatasetiter_next(dns_rdatasetiter_t *iterator DNS__DB_FLARG) {

 	bdbiterator->current = ISC_LIST_NEXT(bdbiterator->current, link);
 	if (bdbiterator->current == NULL) {
-		return (ISC_R_NOMORE);
+		return ISC_R_NOMORE;
 	} else {
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}
 }

@@ -787,7 +787,7 @@ createnode(bdb_t *bdb, bdbnode_t **nodep) {
 	node->magic = BDBNODE_MAGIC;

 	*nodep = node;
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static void
@@ -844,23 +844,23 @@ getoriginnode(dns_db_t *db, dns_dbnode_t **nodep DNS__DB_FLARG) {

 	result = createnode(bdb, &node);
 	if (result != ISC_R_SUCCESS) {
-		return (result);
+		return result;
 	}

 	result = builtin_lookup(bdb, name, node);
 	if (result != ISC_R_SUCCESS && result != ISC_R_NOTFOUND) {
 		destroynode(node);
-		return (result);
+		return result;
 	}

 	result = builtin_authority(bdb, node);
 	if (result != ISC_R_SUCCESS) {
 		destroynode(node);
-		return (result);
+		return result;
 	}

-	*nodep = node;
-	return (ISC_R_SUCCESS);
+	*nodep = (dns_dbnode_t *)node;
+	return ISC_R_SUCCESS;
 }

 static isc_result_t
@@ -887,26 +887,26 @@ findnode(dns_db_t *db, const dns_name_t *name, bool create,

 	result = createnode(bdb, &node);
 	if (result != ISC_R_SUCCESS) {
-		return (result);
+		return result;
 	}

 	result = builtin_lookup(bdb, name, node);
 	if (result != ISC_R_SUCCESS && (!isorigin || result != ISC_R_NOTFOUND))
 	{
 		destroynode(node);
-		return (result);
+		return result;
 	}

 	if (isorigin) {
 		result = builtin_authority(bdb, node);
 		if (result != ISC_R_SUCCESS) {
 			destroynode(node);
-			return (result);
+			return result;
 		}
 	}

-	*nodep = node;
-	return (ISC_R_SUCCESS);
+	*nodep = (dns_dbnode_t *)node;
+	return ISC_R_SUCCESS;
 }

 static isc_result_t
@@ -925,10 +925,10 @@ find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,

 	REQUIRE(VALID_BDB(bdb));
 	REQUIRE(nodep == NULL || *nodep == NULL);
-	REQUIRE(version == NULL || version == (void *)&dummy);
+	REQUIRE(version == NULL || version == (dns_dbversion_t *)&dummy);

 	if (!dns_name_issubdomain(name, &db->origin)) {
-		return (DNS_R_NXDOMAIN);
+		return DNS_R_NXDOMAIN;
 	}

 	olabels = dns_name_countlabels(&db->origin);
@@ -954,13 +954,13 @@ find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
 			 * No data at zone apex?
 			 */
 			if (i == olabels) {
-				return (DNS_R_BADDB);
+				return DNS_R_BADDB;
 			}
 			result = DNS_R_NXDOMAIN;
 			continue;
 		}
 		if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}

 		/*
@@ -1015,7 +1015,7 @@ find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
 		 * and try again.
 		 */
 		if (i < nlabels) {
-			destroynode(node);
+			destroynode((bdbnode_t *)node);
 			node = NULL;
 			continue;
 		}
@@ -1069,7 +1069,7 @@ find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
 		detachnode(db, &node DNS__DB_FLARG_PASS);
 	}

-	return (result);
+	return result;
 }

 static void
@@ -1117,7 +1117,7 @@ findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	UNUSED(sigrdataset);

 	if (type == dns_rdatatype_rrsig) {
-		return (ISC_R_NOTIMPLEMENTED);
+		return ISC_R_NOTIMPLEMENTED;
 	}

 	list = ISC_LIST_HEAD(bdbnode->lists);
@@ -1128,12 +1128,12 @@ findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 		list = ISC_LIST_NEXT(list, link);
 	}
 	if (list == NULL) {
-		return (ISC_R_NOTFOUND);
+		return ISC_R_NOTFOUND;
 	}

 	new_rdataset(list, db, node, rdataset);

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static isc_result_t
@@ -1142,7 +1142,7 @@ allrdatasets(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	     dns_rdatasetiter_t **iteratorp DNS__DB_FLARG) {
 	bdb_rdatasetiter_t *iterator = NULL;

-	REQUIRE(version == NULL || version == &dummy);
+	REQUIRE(version == NULL || version == (dns_dbversion_t *)&dummy);

 	iterator = isc_mem_get(db->mctx, sizeof(bdb_rdatasetiter_t));
 	*iterator = (bdb_rdatasetiter_t){
@@ -1158,7 +1158,7 @@ allrdatasets(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,

 	*iteratorp = (dns_rdatasetiter_t *)iterator;

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static dns_dbmethods_t bdb_methods = {
@@ -1186,7 +1186,7 @@ create(isc_mem_t *mctx, const dns_name_t *origin, dns_dbtype_t type,
 	REQUIRE(implementation != NULL);

 	if (type != dns_dbtype_zone) {
-		return (ISC_R_NOTIMPLEMENTED);
+		return ISC_R_NOTIMPLEMENTED;
 	}

 	bdb = isc_mem_get(mctx, sizeof(*bdb));
@@ -1241,7 +1241,7 @@ create(isc_mem_t *mctx, const dns_name_t *origin, dns_dbtype_t type,

 	*dbp = (dns_db_t *)bdb;

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;

 cleanup:
 	dns_name_free(&bdb->common.origin, mctx);
@@ -1253,7 +1253,7 @@ cleanup:
 	}

 	isc_mem_putanddetach(&bdb->common.mctx, bdb, sizeof(bdb_t));
-	return (result);
+	return result;
 }

 /*
@@ -1269,17 +1269,17 @@ named_builtin_init(void) {
 	result = dns_db_register("_builtin", create, &builtin, named_g_mctx,
 				 &builtin.dbimp);
 	if (result != ISC_R_SUCCESS) {
-		return (result);
+		return result;
 	}

 	result = dns_db_register("_dns64", create, &dns64, named_g_mctx,
 				 &dns64.dbimp);
 	if (result != ISC_R_SUCCESS) {
 		dns_db_unregister(&builtin.dbimp);
-		return (result);
+		return result;
 	}

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 void
@@ -63,7 +63,6 @@ options {\n\
 	geoip-directory \".\";\n"
 #endif /* if defined(HAVE_GEOIP2) */
 			    "\
-	heartbeat-interval 60;\n\
 	interface-interval 60;\n\
 	listen-on {any;};\n\
 	listen-on-v6 {any;};\n\
@@ -96,10 +95,12 @@ options {\n\
 #endif
 			    "\
 	prefetch 2 9;\n\
+#	querylog <boolean>;\n\
 	recursing-file \"named.recursing\";\n\
 	recursive-clients 1000;\n\
 	request-nsid false;\n\
 	resolver-query-timeout 10;\n\
+#	responselog <boolean>;\n\
 	rrset-order { order random; };\n\
 	secroots-file \"named.secroots\";\n\
 	send-cookie true;\n\
@@ -151,9 +152,6 @@ options {\n\
 	clients-per-query 10;\n\
 	dnssec-accept-expired no;\n\
 	dnssec-validation " VALIDATION_DEFAULT "; \n"
-#ifdef USE_DNSRPS
-			    "	dnsrps-library \"" DNSRPS_LIBRPZ_PATH "\";\n"
-#endif /* ifdef USE_DNSRPS */
 #ifdef HAVE_DNSTAP
 			    "	dnstap-identity hostname;\n"
 #endif /* ifdef HAVE_DNSTAP */
@@ -170,7 +168,9 @@ options {\n\
 	max-clients-per-query 100;\n\
 	max-ncache-ttl 10800; /* 3 hours */\n\
 	max-recursion-depth 7;\n\
-	max-recursion-queries 100;\n\
+	max-recursion-queries 50;\n\
+	max-query-count 200;\n\
+	max-query-restarts 11;\n\
 	max-stale-ttl 86400; /* 1 day */\n\
 	message-compression yes;\n\
 	min-ncache-ttl 0; /* 0 hours */\n\
@@ -189,6 +189,7 @@ options {\n\
 	recursion true;\n\
 	request-expire true;\n\
 	request-ixfr true;\n\
+	request-ixfr-max-diffs 0;\n\
 	require-server-cookie no;\n\
 	root-key-sentinel yes;\n\
 	servfail-ttl 1;\n\
@@ -215,7 +216,6 @@ options {\n\
 	check-sibling yes;\n\
 	check-srv-cname warn;\n\
 	check-wildcard yes;\n\
-	dialup no;\n\
 	dnssec-loadkeys-interval 60;\n\
 #	forward <none>\n\
 #	forwarders <none>\n\
@@ -237,6 +237,7 @@ options {\n\
 	notify yes;\n\
 	notify-delay 5;\n\
 	notify-to-soa no;\n\
+	send-report-channel .;\n\
 	serial-update-method increment;\n\
 	sig-signing-nodes 100;\n\
 	sig-signing-signatures 10;\n\
@@ -298,6 +299,7 @@ dnssec-policy \"default\" {\n\
 	cds-digest-types { 2; };\n\
 	dnskey-ttl " DNS_KASP_KEY_TTL ";\n\
 	inline-signing yes;\n\
+	offline-ksk no;\n\
 	publish-safety " DNS_KASP_PUBLISH_SAFETY "; \n\
 	retire-safety " DNS_KASP_RETIRE_SAFETY "; \n\
 	purge-keys " DNS_KASP_PURGE_KEYS "; \n\
@@ -354,13 +356,15 @@ named_config_parsedefaults(cfg_parser_t *parser, cfg_obj_t **conf) {

 	isc_buffer_init(&b, defaultconf, sizeof(defaultconf) - 1);
 	isc_buffer_add(&b, sizeof(defaultconf) - 1);
-	return (cfg_parse_buffer(parser, &b, __FILE__, 0, &cfg_type_namedconf,
-				 CFG_PCTX_NODEPRECATED, conf));
+	return cfg_parse_buffer(parser, &b, __FILE__, 0, &cfg_type_namedconf,
+				CFG_PCTX_NODEPRECATED | CFG_PCTX_NOOBSOLETE |
+					CFG_PCTX_NOEXPERIMENTAL,
+				conf);
 }

 const char *
 named_config_getdefault(void) {
-	return (defaultconf);
+	return defaultconf;
 }

 isc_result_t
@@ -370,10 +374,10 @@ named_config_get(cfg_obj_t const *const *maps, const char *name,

 	for (i = 0; maps[i] != NULL; i++) {
 		if (cfg_map_get(maps[i], name, obj) == ISC_R_SUCCESS) {
-			return (ISC_R_SUCCESS);
+			return ISC_R_SUCCESS;
 		}
 	}
-	return (ISC_R_NOTFOUND);
+	return ISC_R_NOTFOUND;
 }

 isc_result_t
@@ -399,7 +403,7 @@ named_checknames_get(const cfg_obj_t **maps, const char *const names[],
 			 */
 			if (checknames != NULL && !cfg_obj_islist(checknames)) {
 				*obj = checknames;
-				return (ISC_R_SUCCESS);
+				return ISC_R_SUCCESS;
 			}
 			for (element = cfg_list_first(checknames);
 			     element != NULL; element = cfg_list_next(element))
@@ -413,13 +417,13 @@ named_checknames_get(const cfg_obj_t **maps, const char *const names[],
 					{
 						*obj = cfg_tuple_get(value,
 								     "mode");
-						return (ISC_R_SUCCESS);
+						return ISC_R_SUCCESS;
 					}
 				}
 			}
 		}
 	}
-	return (ISC_R_NOTFOUND);
+	return ISC_R_NOTFOUND;
 }

 int
@@ -431,7 +435,7 @@ named_config_listcount(const cfg_obj_t *list) {
 		i++;
 	}

-	return (i);
+	return i;
 }

 isc_result_t
@@ -442,16 +446,16 @@ named_config_getclass(const cfg_obj_t *classobj, dns_rdataclass_t defclass,

 	if (!cfg_obj_isstring(classobj)) {
 		*classp = defclass;
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}
 	r.base = UNCONST(cfg_obj_asstring(classobj));
 	r.length = strlen(r.base);
 	result = dns_rdataclass_fromtext(classp, &r);
 	if (result != ISC_R_SUCCESS) {
-		cfg_obj_log(classobj, named_g_lctx, ISC_LOG_ERROR,
-			    "unknown class '%s'", r.base);
+		cfg_obj_log(classobj, ISC_LOG_ERROR, "unknown class '%s'",
+			    r.base);
 	}
-	return (result);
+	return result;
 }

 isc_result_t
@@ -462,16 +466,16 @@ named_config_gettype(const cfg_obj_t *typeobj, dns_rdatatype_t deftype,

 	if (!cfg_obj_isstring(typeobj)) {
 		*typep = deftype;
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}
 	r.base = UNCONST(cfg_obj_asstring(typeobj));
 	r.length = strlen(r.base);
 	result = dns_rdatatype_fromtext(typep, &r);
 	if (result != ISC_R_SUCCESS) {
-		cfg_obj_log(typeobj, named_g_lctx, ISC_LOG_ERROR,
-			    "unknown type '%s'", r.base);
+		cfg_obj_log(typeobj, ISC_LOG_ERROR, "unknown type '%s'",
+			    r.base);
 	}
-	return (result);
+	return result;
 }

 dns_zonetype_t
@@ -497,7 +501,7 @@ named_config_getzonetype(const cfg_obj_t *zonetypeobj) {
 	} else {
 		UNREACHABLE();
 	}
-	return (ztype);
+	return ztype;
 }

 static isc_result_t
@@ -513,7 +517,7 @@ getremotesdef(const cfg_obj_t *cctx, const char *list, const char *name,

 	result = cfg_map_get(cctx, list, &obj);
 	if (result != ISC_R_SUCCESS) {
-		return (result);
+		return result;
 	}
 	elt = cfg_list_first(obj);
 	while (elt != NULL) {
@@ -522,11 +526,11 @@ getremotesdef(const cfg_obj_t *cctx, const char *list, const char *name,
 			       name) == 0)
 		{
 			*ret = obj;
-			return (ISC_R_SUCCESS);
+			return ISC_R_SUCCESS;
 		}
 		elt = cfg_list_next(elt);
 	}
-	return (ISC_R_NOTFOUND);
+	return ISC_R_NOTFOUND;
 }

 isc_result_t
@@ -535,15 +539,15 @@ named_config_getremotesdef(const cfg_obj_t *cctx, const char *list,
 	isc_result_t result;

 	if (strcmp(list, "parental-agents") == 0) {
-		return (getremotesdef(cctx, list, name, ret));
+		return getremotesdef(cctx, list, name, ret);
 	} else if (strcmp(list, "primaries") == 0) {
 		result = getremotesdef(cctx, list, name, ret);
 		if (result != ISC_R_SUCCESS) {
 			result = getremotesdef(cctx, "masters", name, ret);
 		}
-		return (result);
+		return result;
 	}
-	return (ISC_R_NOTFOUND);
+	return ISC_R_NOTFOUND;
 }

 static isc_result_t
@@ -558,7 +562,7 @@ named_config_getname(isc_mem_t *mctx, const cfg_obj_t *obj,

 	if (!cfg_obj_isstring(obj)) {
 		*namep = NULL;
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	*namep = isc_mem_get(mctx, sizeof(**namep));
@@ -573,11 +577,11 @@ named_config_getname(isc_mem_t *mctx, const cfg_obj_t *obj,
 	if (result != ISC_R_SUCCESS) {
 		isc_mem_put(mctx, *namep, sizeof(**namep));
 		*namep = NULL;
-		return (result);
+		return result;
 	}
 	dns_name_dup(dns_fixedname_name(&fname), mctx, *namep);

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 #define grow_array(mctx, array, newlen, oldlen)                          \
@@ -660,7 +664,7 @@ newlist:
 	if (cfg_obj_isuint32(portobj)) {
 		uint32_t val = cfg_obj_asuint32(portobj);
 		if (val > UINT16_MAX) {
-			cfg_obj_log(portobj, named_g_lctx, ISC_LOG_ERROR,
+			cfg_obj_log(portobj, ISC_LOG_ERROR,
 				    "port '%u' out of range", val);
 			result = ISC_R_RANGE;
 			goto cleanup;
@@ -715,7 +719,7 @@ resume:
 			tresult = named_config_getremotesdef(config, listtype,
 							     listname, &list);
 			if (tresult == ISC_R_NOTFOUND) {
-				cfg_obj_log(addr, named_g_lctx, ISC_LOG_ERROR,
+				cfg_obj_log(addr, ISC_LOG_ERROR,
 					    "%s \"%s\" not found", listtype,
 					    listname);

@@ -825,7 +829,7 @@ resume:
 	ipkl->count = addrcount;
 	ipkl->allocated = addrcount;

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;

 cleanup:
 	if (addrs != NULL) {
@@ -864,7 +868,7 @@ cleanup:
 	if (stack != NULL) {
 		isc_mem_cput(mctx, stack, stackcount, sizeof(stack[0]));
 	}
-	return (result);
+	return result;
 }

 isc_result_t
@@ -887,13 +891,12 @@ named_config_getport(const cfg_obj_t *config, const char *type,
 	result = named_config_get(maps, type, &portobj);
 	INSIST(result == ISC_R_SUCCESS);
 	if (cfg_obj_asuint32(portobj) >= UINT16_MAX) {
-		cfg_obj_log(portobj, named_g_lctx, ISC_LOG_ERROR,
-			    "port '%u' out of range",
+		cfg_obj_log(portobj, ISC_LOG_ERROR, "port '%u' out of range",
 			    cfg_obj_asuint32(portobj));
-		return (ISC_R_RANGE);
+		return ISC_R_RANGE;
 	}
 	*portp = (in_port_t)cfg_obj_asuint32(portobj);
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 struct keyalgorithms {
@@ -937,15 +940,15 @@ named_config_getkeyalgorithm(const char *str, unsigned int *typep,
 		}
 	}
 	if (algorithms[i].str == NULL) {
-		return (ISC_R_NOTFOUND);
+		return ISC_R_NOTFOUND;
 	}
 	if (str[len] == '-') {
 		result = isc_parse_uint16(&bits, str + len + 1, 10);
 		if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
 		if (bits > algorithms[i].size) {
-			return (ISC_R_RANGE);
+			return ISC_R_RANGE;
 		}
 	} else if (algorithms[i].size == 0) {
 		bits = 128;
@@ -954,5 +957,5 @@ named_config_getkeyalgorithm(const char *str, unsigned int *typep,
 	}
 	SET_IF_NOT_NULL(typep, algorithms[i].type);
 	SET_IF_NOT_NULL(digestbits, bits);
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }
@@ -16,6 +16,7 @@
 #include <stdbool.h>

 #include <isc/lex.h>
+#include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
 #include <isc/string.h>
@@ -43,23 +44,23 @@ getcommand(isc_lex_t *lex, char **cmdp) {

 	result = isc_lex_gettoken(lex, ISC_LEXOPT_EOF, &token);
 	if (result != ISC_R_SUCCESS) {
-		return (result);
+		return result;
 	}

 	isc_lex_ungettoken(lex, &token);

 	if (token.type != isc_tokentype_string) {
-		return (ISC_R_FAILURE);
+		return ISC_R_FAILURE;
 	}

 	*cmdp = token.value.as_textregion.base;

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static bool
 command_compare(const char *str, const char *command) {
-	return (strcasecmp(str, command) == 0);
+	return strcasecmp(str, command) == 0;
 }

 /*%
@@ -85,7 +86,7 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		/*
 		 * No data section.
 		 */
-		return (ISC_R_FAILURE);
+		return ISC_R_FAILURE;
 	}

 	result = isccc_cc_lookupstring(data, "type", &cmdline);
@@ -93,7 +94,7 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		/*
 		 * We have no idea what this is.
 		 */
-		return (result);
+		return result;
 	}

 	isc_lex_create(named_g_mctx, strlen(cmdline), &lex);
@@ -134,7 +135,7 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 	    !command_compare(command, NAMED_COMMAND_TESTGEN) &&
 	    !command_compare(command, NAMED_COMMAND_ZONESTATUS))
 	{
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_CONTROL, log_level,
 			      "rejecting restricted control channel "
 			      "command '%s'",
@@ -143,9 +144,9 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		goto cleanup;
 	}

-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_CONTROL, log_level,
-		      "received control channel command '%s'", cmdline);
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_CONTROL,
+		      log_level, "received control channel command '%s'",
+		      cmdline);

 	/*
 	 * After the lengthy "halt" and "stop", the commands are
@@ -201,6 +202,9 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		   command_compare(command, NAMED_COMMAND_MODZONE))
 	{
 		result = named_server_changezone(named_g_server, cmdline, text);
+	} else if (command_compare(command, NAMED_COMMAND_CLOSELOGS)) {
+		isc_log_closefilelogs();
+		result = ISC_R_SUCCESS;
 	} else if (command_compare(command, NAMED_COMMAND_DELZONE)) {
 		result = named_server_delzone(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_DNSSEC)) {
@@ -210,8 +214,7 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 	{
 		result = named_server_dnstap(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_DUMPDB)) {
-		named_server_dumpdb(named_g_server, lex, text);
-		result = ISC_R_SUCCESS;
+		result = named_server_dumpdb(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_DUMPSTATS)) {
 		result = named_server_dumpstats(named_g_server);
 	} else if (command_compare(command, NAMED_COMMAND_FETCHLIMIT)) {
@@ -224,6 +227,8 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		result = named_server_flushnode(named_g_server, lex, true);
 	} else if (command_compare(command, NAMED_COMMAND_FREEZE)) {
 		result = named_server_freeze(named_g_server, true, lex, text);
+	} else if (command_compare(command, NAMED_COMMAND_SKR)) {
+		result = named_server_skr(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_LOADKEYS) ||
 		   command_compare(command, NAMED_COMMAND_SIGN))
 	{
@@ -234,14 +239,16 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		result = named_server_notifycommand(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_NOTRACE)) {
 		named_g_debuglevel = 0;
-		isc_log_setdebuglevel(named_g_lctx, named_g_debuglevel);
+		isc_log_setdebuglevel(named_g_debuglevel);
 		result = ISC_R_SUCCESS;
 	} else if (command_compare(command, NAMED_COMMAND_NTA)) {
 		result = named_server_nta(named_g_server, lex, readonly, text);
 	} else if (command_compare(command, NAMED_COMMAND_NULL)) {
 		result = ISC_R_SUCCESS;
 	} else if (command_compare(command, NAMED_COMMAND_QUERYLOG)) {
-		result = named_server_togglequerylog(named_g_server, lex);
+		result = named_server_setortoggle(named_g_server,
+						  "query logging",
+						  NS_SERVER_LOGQUERIES, lex);
 	} else if (command_compare(command, NAMED_COMMAND_RECONFIG)) {
 		result = named_server_reconfigcommand(named_g_server);
 	} else if (command_compare(command, NAMED_COMMAND_RECURSING)) {
@@ -250,6 +257,10 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		result = named_server_refreshcommand(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_RELOAD)) {
 		result = named_server_reloadcommand(named_g_server, lex, text);
+	} else if (command_compare(command, NAMED_COMMAND_RESPONSELOG)) {
+		result = named_server_setortoggle(named_g_server,
+						  "response logging",
+						  NS_SERVER_LOGRESPONSES, lex);
 	} else if (command_compare(command, NAMED_COMMAND_RETRANSFER)) {
 		result = named_server_retransfercommand(named_g_server, lex,
 							text);
@@ -283,7 +294,7 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 	} else if (command_compare(command, NAMED_COMMAND_ZONESTATUS)) {
 		result = named_server_zonestatus(named_g_server, lex, text);
 	} else {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_CONTROL, ISC_LOG_WARNING,
 			      "unknown control channel command '%s'", command);
 		result = DNS_R_UNKNOWNCOMMAND;
@@ -294,5 +305,5 @@ cleanup:
 		isc_lex_destroy(&lex);
 	}

-	return (result);
+	return result;
 }
@@ -225,9 +225,9 @@ shutdown_listener(controllistener_t *listener) {

 	char socktext[ISC_SOCKADDR_FORMATSIZE];
 	isc_sockaddr_format(&listener->address, socktext, sizeof(socktext));
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_CONTROL, ISC_LOG_NOTICE,
-		      "stopping command channel on %s", socktext);
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_CONTROL,
+		      ISC_LOG_NOTICE, "stopping command channel on %s",
+		      socktext);

 	isc_nm_stoplistening(listener->sock);
 	isc_nmsocket_close(&listener->sock);
@@ -246,7 +246,7 @@ address_ok(isc_sockaddr_t *sockaddr, controllistener_t *listener) {

 	result = dns_acl_match(&netaddr, NULL, listener->acl, env, &match,
 			       NULL);
-	return (result == ISC_R_SUCCESS && match > 0);
+	return result == ISC_R_SUCCESS && match > 0;
 }

 static void
@@ -272,7 +272,7 @@ control_senddone(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 		isc_sockaddr_t peeraddr = isc_nmhandle_peeraddr(handle);

 		isc_sockaddr_format(&peeraddr, socktext, sizeof(socktext));
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_CONTROL, ISC_LOG_WARNING,
 			      "error sending command response to %s: %s",
 			      socktext, isc_result_totext(result));
@@ -291,9 +291,8 @@ log_invalid(isccc_ccmsg_t *ccmsg, isc_result_t result) {
 	isc_sockaddr_t peeraddr = isc_nmhandle_peeraddr(ccmsg->handle);

 	isc_sockaddr_format(&peeraddr, socktext, sizeof(socktext));
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_CONTROL, ISC_LOG_ERROR,
-		      "invalid command from %s: %s", socktext,
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_CONTROL,
+		      ISC_LOG_ERROR, "invalid command from %s: %s", socktext,
 		      isc_result_totext(result));
 }

@@ -588,9 +587,8 @@ conn_free(controlconnection_t *conn) {
 	}
 #endif /* ifdef ENABLE_AFL */

-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_CONTROL, ISC_LOG_DEBUG(3),
-		      "freeing control connection");
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_CONTROL,
+		      ISC_LOG_DEBUG(3), "freeing control connection");

 	isc_mem_put(listener->mctx, conn, sizeof(*conn));

@@ -601,7 +599,7 @@ static void
 newconnection(controllistener_t *listener, isc_nmhandle_t *handle) {
 	/* Don't create new connection if we are shutting down */
 	if (listener->shuttingdown) {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_CONTROL, ISC_LOG_DEBUG(3),
 			      "rejected new control connection: %s",
 			      isc_result_totext(ISC_R_SHUTTINGDOWN));
@@ -609,9 +607,8 @@ newconnection(controllistener_t *listener, isc_nmhandle_t *handle) {
 	}

 	controlconnection_t *conn = isc_mem_get(listener->mctx, sizeof(*conn));
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_CONTROL, ISC_LOG_DEBUG(3),
-		      "allocate new control connection");
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_CONTROL,
+		      ISC_LOG_DEBUG(3), "allocate new control connection");

 	*conn = (controlconnection_t){
 		.alg = DST_ALG_UNKNOWN,
@@ -641,22 +638,22 @@ control_newconn(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 		if (result == ISC_R_SHUTTINGDOWN) {
 			shutdown_listener(listener);
 		}
-		return (result);
+		return result;
 	}

 	peeraddr = isc_nmhandle_peeraddr(handle);
 	if (!address_ok(&peeraddr, listener)) {
 		char socktext[ISC_SOCKADDR_FORMATSIZE];
 		isc_sockaddr_format(&peeraddr, socktext, sizeof(socktext));
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_CONTROL, ISC_LOG_WARNING,
 			      "rejected command channel message from %s",
 			      socktext);
-		return (ISC_R_FAILURE);
+		return ISC_R_FAILURE;
 	}

 	newconnection(listener, handle);
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static void
@@ -710,11 +707,11 @@ cfgkeylist_find(const cfg_obj_t *keylist, const char *keyname,
 		}
 	}
 	if (element == NULL) {
-		return (ISC_R_NOTFOUND);
+		return ISC_R_NOTFOUND;
 	}
 	obj = cfg_listelt_value(element);
 	*objp = obj;
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static void
@@ -760,7 +757,7 @@ register_keys(const cfg_obj_t *control, const cfg_obj_t *keylist,

 		result = cfgkeylist_find(keylist, keyid->keyname, &keydef);
 		if (result != ISC_R_SUCCESS) {
-			cfg_obj_log(control, named_g_lctx, ISC_LOG_WARNING,
+			cfg_obj_log(control, ISC_LOG_WARNING,
 				    "couldn't find key '%s' for use with "
 				    "command channel %s",
 				    keyid->keyname, socktext);
@@ -783,8 +780,7 @@ register_keys(const cfg_obj_t *control, const cfg_obj_t *keylist,
 			result = named_config_getkeyalgorithm(algstr, &algtype,
 							      NULL);
 			if (result != ISC_R_SUCCESS) {
-				cfg_obj_log(control, named_g_lctx,
-					    ISC_LOG_WARNING,
+				cfg_obj_log(control, ISC_LOG_WARNING,
 					    "unsupported algorithm '%s' in "
 					    "key '%s' for use with command "
 					    "channel %s",
@@ -799,8 +795,7 @@ register_keys(const cfg_obj_t *control, const cfg_obj_t *keylist,
 			result = isc_base64_decodestring(secretstr, &b);

 			if (result != ISC_R_SUCCESS) {
-				cfg_obj_log(keydef, named_g_lctx,
-					    ISC_LOG_WARNING,
+				cfg_obj_log(keydef, ISC_LOG_WARNING,
 					    "secret for key '%s' on "
 					    "command channel %s: %s",
 					    keyid->keyname, socktext,
@@ -834,14 +829,14 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
 	unsigned int algtype;
 	isc_buffer_t b;

-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_CONTROL, ISC_LOG_INFO,
-		      "configuring command channel from '%s'", named_g_keyfile);
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_CONTROL,
+		      ISC_LOG_INFO, "configuring command channel from '%s'",
+		      named_g_keyfile);
 	if (!isc_file_exists(named_g_keyfile)) {
-		return (ISC_R_FILENOTFOUND);
+		return ISC_R_FILENOTFOUND;
 	}

-	CHECK(cfg_parser_create(mctx, named_g_lctx, &pctx));
+	CHECK(cfg_parser_create(mctx, &pctx));
 	CHECK(cfg_parse_file(pctx, named_g_keyfile, &cfg_type_rndckey,
 			     &config));
 	CHECK(cfg_map_get(config, "key", &key));
@@ -857,7 +852,7 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
 		CHECK(ISC_R_NOMEMORY);
 	}

-	CHECK(isccfg_check_key(key, named_g_lctx));
+	CHECK(isccfg_check_key(key));

 	(void)cfg_map_get(key, "algorithm", &algobj);
 	(void)cfg_map_get(key, "secret", &secretobj);
@@ -868,7 +863,7 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {

 	result = named_config_getkeyalgorithm(algstr, &algtype, NULL);
 	if (result != ISC_R_SUCCESS) {
-		cfg_obj_log(key, named_g_lctx, ISC_LOG_WARNING,
+		cfg_obj_log(key, ISC_LOG_WARNING,
 			    "unsupported algorithm '%s' in "
 			    "key '%s' for use with command "
 			    "channel",
@@ -881,7 +876,7 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
 	result = isc_base64_decodestring(secretstr, &b);

 	if (result != ISC_R_SUCCESS) {
-		cfg_obj_log(key, named_g_lctx, ISC_LOG_WARNING,
+		cfg_obj_log(key, ISC_LOG_WARNING,
 			    "secret for key '%s' on command channel: %s",
 			    keyid->keyname, isc_result_totext(result));
 		goto cleanup;
@@ -904,7 +899,7 @@ cleanup:
 	if (pctx != NULL) {
 		cfg_parser_destroy(&pctx);
 	}
-	return (result);
+	return result;
 }

 /*
@@ -1009,12 +1004,12 @@ update_listener(named_controls_t *cp, controllistener_t **listenerp,
 		 * sake of avoiding this message would be too much trouble.
 		 */
 		if (control != NULL) {
-			cfg_obj_log(control, named_g_lctx, ISC_LOG_WARNING,
+			cfg_obj_log(control, ISC_LOG_WARNING,
 				    "couldn't install new keys for "
 				    "command channel %s: %s",
 				    socktext, isc_result_totext(result));
 		} else {
-			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			isc_log_write(NAMED_LOGCATEGORY_GENERAL,
 				      NAMED_LOGMODULE_CONTROL, ISC_LOG_WARNING,
 				      "couldn't install new keys for "
 				      "command channel %s: %s",
@@ -1027,9 +1022,8 @@ update_listener(named_controls_t *cp, controllistener_t **listenerp,
 	 */
 	if (control != NULL && type == isc_socktype_tcp) {
 		allow = cfg_tuple_get(control, "allow");
-		result = cfg_acl_fromconfig(allow, config, named_g_lctx,
-					    aclconfctx, listener->mctx, 0,
-					    &new_acl);
+		result = cfg_acl_fromconfig(allow, config, aclconfctx,
+					    listener->mctx, 0, &new_acl);
 	} else {
 		result = dns_acl_any(listener->mctx, &new_acl);
 	}
@@ -1049,12 +1043,12 @@ update_listener(named_controls_t *cp, controllistener_t **listenerp,
 		dns_acl_detach(&new_acl);
 		/* XXXDCL say the old acl is still used? */
 	} else if (control != NULL) {
-		cfg_obj_log(control, named_g_lctx, ISC_LOG_WARNING,
+		cfg_obj_log(control, ISC_LOG_WARNING,
 			    "couldn't install new acl for "
 			    "command channel %s: %s",
 			    socktext, isc_result_totext(result));
 	} else {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_CONTROL, ISC_LOG_WARNING,
 			      "couldn't install new acl for "
 			      "command channel %s: %s",
@@ -1101,8 +1095,8 @@ add_listener(named_controls_t *cp, controllistener_t **listenerp,
 		const cfg_obj_t *readonly = NULL;

 		allow = cfg_tuple_get(control, "allow");
-		CHECK(cfg_acl_fromconfig(allow, config, named_g_lctx,
-					 aclconfctx, mctx, 0, &new_acl));
+		CHECK(cfg_acl_fromconfig(allow, config, aclconfctx, mctx, 0,
+					 &new_acl));

 		readonly = cfg_tuple_get(control, "read-only");
 		if (!cfg_obj_isvoid(readonly)) {
@@ -1128,7 +1122,7 @@ add_listener(named_controls_t *cp, controllistener_t **listenerp,
 	} else {
 		result = get_rndckey(mctx, &listener->keys);
 		if (result != ISC_R_SUCCESS && control != NULL) {
-			cfg_obj_log(control, named_g_lctx, ISC_LOG_WARNING,
+			cfg_obj_log(control, ISC_LOG_WARNING,
 				    "couldn't install keys for "
 				    "command channel %s: %s",
 				    socktext, isc_result_totext(result));
@@ -1146,9 +1140,9 @@ add_listener(named_controls_t *cp, controllistener_t **listenerp,
 			       &listener->address, control_newconn, listener, 5,
 			       NULL, &listener->sock));

-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_CONTROL, ISC_LOG_NOTICE,
-		      "command channel listening on %s", socktext);
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_CONTROL,
+		      ISC_LOG_NOTICE, "command channel listening on %s",
+		      socktext);
 	*listenerp = listener;
 	return;

@@ -1159,11 +1153,11 @@ cleanup:

 shuttingdown:
 	if (control != NULL) {
-		cfg_obj_log(control, named_g_lctx, ISC_LOG_WARNING,
+		cfg_obj_log(control, ISC_LOG_WARNING,
 			    "couldn't add command channel %s: %s", socktext,
 			    isc_result_totext(result));
 	} else {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_CONTROL, ISC_LOG_NOTICE,
 			      "couldn't add command channel %s: %s", socktext,
 			      isc_result_totext(result));
@@ -1208,11 +1202,10 @@ named_controls_configure(named_controls_t *cp, const cfg_obj_t *config,

 			(void)cfg_map_get(controls, "unix", &unixcontrols);
 			if (unixcontrols != NULL) {
-				cfg_obj_log(controls, named_g_lctx,
-					    ISC_LOG_ERROR,
+				cfg_obj_log(controls, ISC_LOG_ERROR,
 					    "UNIX domain sockets are not "
 					    "supported");
-				return (ISC_R_FAILURE);
+				return ISC_R_FAILURE;
 			}

 			(void)cfg_map_get(controls, "inet", &inetcontrols);
@@ -1245,8 +1238,7 @@ named_controls_configure(named_controls_t *cp, const cfg_obj_t *config,
 				isc_sockaddr_format(&addr, socktext,
 						    sizeof(socktext));

-				isc_log_write(named_g_lctx,
-					      NAMED_LOGCATEGORY_GENERAL,
+				isc_log_write(NAMED_LOGCATEGORY_GENERAL,
 					      NAMED_LOGMODULE_CONTROL,
 					      ISC_LOG_DEBUG(9),
 					      "processing control channel %s",
@@ -1341,7 +1333,7 @@ named_controls_configure(named_controls_t *cp, const cfg_obj_t *config,
 	 * down will be taken care of by listen_done().
 	 */
 	ISC_LIST_APPENDLIST(cp->listeners, new_listeners, link);
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 isc_result_t
@@ -1364,10 +1356,10 @@ named_controls_create(named_server_t *server, named_controls_t **ctrlsp) {
 	if (result != ISC_R_SUCCESS) {
 		isc_mutex_destroy(&controls->symtab_lock);
 		isc_mem_put(server->mctx, controls, sizeof(*controls));
-		return (result);
+		return result;
 	}
 	*ctrlsp = controls;
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 void
@@ -17,13 +17,13 @@
 #include <stdlib.h>
 #include <string.h>

+#include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
 #include <isc/util.h>
 #include <isc/uv.h>

 #include <dns/dlz_dlopen.h>
-#include <dns/log.h>

 #include <dlz/dlz_dlopen_driver.h>
 #include <named/globals.h>
@@ -80,7 +80,7 @@ static void
 dlopen_log(int level, const char *fmt, ...) {
 	va_list ap;
 	va_start(ap, fmt);
-	isc_log_vwrite(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_DLZ,
+	isc_log_vwrite(DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_DLZ,
 		       ISC_LOG_DEBUG(level), fmt, ap);
 	va_end(ap);
 }
@@ -98,13 +98,13 @@ dlopen_dlz_allnodes(const char *zone, void *driverarg, void *dbdata,
 	UNUSED(driverarg);

 	if (cd->dlz_allnodes == NULL) {
-		return (ISC_R_NOPERM);
+		return ISC_R_NOPERM;
 	}

 	MAYBE_LOCK(cd);
 	result = cd->dlz_allnodes(zone, cd->dbdata, allnodes);
 	MAYBE_UNLOCK(cd);
-	return (result);
+	return result;
 }

 static isc_result_t
@@ -116,13 +116,13 @@ dlopen_dlz_allowzonexfr(void *driverarg, void *dbdata, const char *name,
 	UNUSED(driverarg);

 	if (cd->dlz_allowzonexfr == NULL) {
-		return (ISC_R_NOPERM);
+		return ISC_R_NOPERM;
 	}

 	MAYBE_LOCK(cd);
 	result = cd->dlz_allowzonexfr(cd->dbdata, name, client);
 	MAYBE_UNLOCK(cd);
-	return (result);
+	return result;
 }

 static isc_result_t
@@ -134,13 +134,13 @@ dlopen_dlz_authority(const char *zone, void *driverarg, void *dbdata,
 	UNUSED(driverarg);

 	if (cd->dlz_authority == NULL) {
-		return (ISC_R_NOTIMPLEMENTED);
+		return ISC_R_NOTIMPLEMENTED;
 	}

 	MAYBE_LOCK(cd);
 	result = cd->dlz_authority(zone, cd->dbdata, lookup);
 	MAYBE_UNLOCK(cd);
-	return (result);
+	return result;
 }

 static isc_result_t
@@ -155,7 +155,7 @@ dlopen_dlz_findzonedb(void *driverarg, void *dbdata, const char *name,
 	MAYBE_LOCK(cd);
 	result = cd->dlz_findzonedb(cd->dbdata, name, methods, clientinfo);
 	MAYBE_UNLOCK(cd);
-	return (result);
+	return result;
 }

 static isc_result_t
@@ -172,7 +172,7 @@ dlopen_dlz_lookup(const char *zone, const char *name, void *driverarg,
 	result = cd->dlz_lookup(zone, name, cd->dbdata, lookup, methods,
 				clientinfo);
 	MAYBE_UNLOCK(cd);
-	return (result);
+	return result;
 }

 /*
@@ -195,7 +195,7 @@ dl_load_symbol(dlopen_data_t *cd, const char *symbol, bool mandatory) {
 		}
 	}

-	return (ptr);
+	return ptr;
 }

 static void
@@ -219,7 +219,7 @@ dlopen_dlz_create(const char *dlzname, unsigned int argc, char *argv[],
 			   "dlz_dlopen driver for '%s' needs a path to "
 			   "the shared library",
 			   dlzname);
-		return (ISC_R_FAILURE);
+		return ISC_R_FAILURE;
 	}

 	isc_mem_create(&mctx);
@@ -319,14 +319,14 @@ dlopen_dlz_create(const char *dlzname, unsigned int argc, char *argv[],

 	*dbdata = cd;

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;

 failed:
 	dlopen_log(ISC_LOG_ERROR, "dlz_dlopen of '%s' failed", dlzname);

 	dlopen_dlz_destroy(NULL, cd);

-	return (result);
+	return result;
 }

 /*
@@ -363,13 +363,13 @@ dlopen_dlz_newversion(const char *zone, void *driverarg, void *dbdata,
 	UNUSED(driverarg);

 	if (cd->dlz_newversion == NULL) {
-		return (ISC_R_NOTIMPLEMENTED);
+		return ISC_R_NOTIMPLEMENTED;
 	}

 	MAYBE_LOCK(cd);
 	result = cd->dlz_newversion(zone, cd->dbdata, versionp);
 	MAYBE_UNLOCK(cd);
-	return (result);
+	return result;
 }

 /*
@@ -404,7 +404,7 @@ dlopen_dlz_configure(dns_view_t *view, dns_dlzdb_t *dlzdb, void *driverarg,
 	UNUSED(driverarg);

 	if (cd->dlz_configure == NULL) {
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	MAYBE_LOCK(cd);
@@ -413,7 +413,7 @@ dlopen_dlz_configure(dns_view_t *view, dns_dlzdb_t *dlzdb, void *driverarg,
 	cd->in_configure = false;
 	MAYBE_UNLOCK(cd);

-	return (result);
+	return result;
 }

 /*
@@ -429,7 +429,7 @@ dlopen_dlz_ssumatch(const char *signer, const char *name, const char *tcpaddr,
 	UNUSED(driverarg);

 	if (cd->dlz_ssumatch == NULL) {
-		return (false);
+		return false;
 	}

 	MAYBE_LOCK(cd);
@@ -437,7 +437,7 @@ dlopen_dlz_ssumatch(const char *signer, const char *name, const char *tcpaddr,
 			       keydata, cd->dbdata);
 	MAYBE_UNLOCK(cd);

-	return (ret);
+	return ret;
 }

 /*
@@ -452,14 +452,14 @@ dlopen_dlz_addrdataset(const char *name, const char *rdatastr, void *driverarg,
 	UNUSED(driverarg);

 	if (cd->dlz_addrdataset == NULL) {
-		return (ISC_R_NOTIMPLEMENTED);
+		return ISC_R_NOTIMPLEMENTED;
 	}

 	MAYBE_LOCK(cd);
 	result = cd->dlz_addrdataset(name, rdatastr, cd->dbdata, version);
 	MAYBE_UNLOCK(cd);

-	return (result);
+	return result;
 }

 /*
@@ -474,14 +474,14 @@ dlopen_dlz_subrdataset(const char *name, const char *rdatastr, void *driverarg,
 	UNUSED(driverarg);

 	if (cd->dlz_subrdataset == NULL) {
-		return (ISC_R_NOTIMPLEMENTED);
+		return ISC_R_NOTIMPLEMENTED;
 	}

 	MAYBE_LOCK(cd);
 	result = cd->dlz_subrdataset(name, rdatastr, cd->dbdata, version);
 	MAYBE_UNLOCK(cd);

-	return (result);
+	return result;
 }

 /*
@@ -496,14 +496,14 @@ dlopen_dlz_delrdataset(const char *name, const char *type, void *driverarg,
 	UNUSED(driverarg);

 	if (cd->dlz_delrdataset == NULL) {
-		return (ISC_R_NOTIMPLEMENTED);
+		return ISC_R_NOTIMPLEMENTED;
 	}

 	MAYBE_LOCK(cd);
 	result = cd->dlz_delrdataset(name, type, cd->dbdata, version);
 	MAYBE_UNLOCK(cd);

-	return (result);
+	return result;
 }

 static dns_sdlzmethods_t dlz_dlopen_methods = {
@@ -535,7 +535,7 @@ dlz_dlopen_init(isc_mem_t *mctx) {
 		result = ISC_R_UNEXPECTED;
 	}

-	return (result);
+	return result;
 }

 /*
@@ -26,13 +26,12 @@
 #include <unistd.h>

 #include <isc/condition.h>
+#include <isc/log.h>
 #include <isc/loop.h>
 #include <isc/mutex.h>
 #include <isc/thread.h>
 #include <isc/util.h>

-#include <dns/log.h>
-
 #include <named/globals.h>
 #include <named/log.h>
 #include <named/server.h>
@@ -127,7 +126,7 @@ fuzz_thread_client(void *arg) {
 				named_server_flushonshutdown(named_g_server,
 							     false);
 				isc_loopmgr_shutdown(named_g_loopmgr);
-				return (NULL);
+				return NULL;
 			}
 			raise(SIGSTOP);
 			goto next;
@@ -161,7 +160,7 @@ fuzz_thread_client(void *arg) {
 	named_server_flushonshutdown(named_g_server, false);
 	isc_loopmgr_shutdown(named_g_loopmgr);

-	return (NULL);
+	return NULL;
 }

 /*
@@ -375,7 +374,7 @@ fuzz_thread_resolver(void *arg) {
 				named_server_flushonshutdown(named_g_server,
 							     false);
 				isc_loopmgr_shutdown(named_g_loopmgr);
-				return (NULL);
+				return NULL;
 			}
 			raise(SIGSTOP);
 			continue;
@@ -587,7 +586,7 @@ fuzz_thread_resolver(void *arg) {
 	__AFL_LOOP(0);
 #endif /* ifdef __AFL_LOOP */

-	return (NULL);
+	return NULL;
 }

 /*
@@ -718,7 +717,7 @@ fuzz_thread_tcp(void *arg) {
 	named_server_flushonshutdown(named_g_server, false);
 	isc_loopmgr_shutdown(named_g_loopmgr);

-	return (NULL);
+	return NULL;
 }

 #endif /* ENABLE_AFL */
@@ -39,27 +39,27 @@ open_geoip2(const char *dir, const char *dbfile, MMDB_s *mmdb) {

 	n = snprintf(pathbuf, sizeof(pathbuf), "%s/%s", dir, dbfile);
 	if (n >= sizeof(pathbuf)) {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+			      ISC_LOG_ERROR,
 			      "GeoIP2 database '%s/%s': path too long", dir,
 			      dbfile);
-		return (NULL);
+		return NULL;
 	}

 	ret = MMDB_open(pathbuf, MMDB_MODE_MMAP, mmdb);
 	if (ret == MMDB_SUCCESS) {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
-			      "opened GeoIP2 database '%s'", pathbuf);
-		return (mmdb);
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+			      ISC_LOG_INFO, "opened GeoIP2 database '%s'",
+			      pathbuf);
+		return mmdb;
 	}

-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_SERVER, ISC_LOG_DEBUG(1),
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+		      ISC_LOG_DEBUG(1),
 		      "unable to open GeoIP2 database '%s' (status %d)",
 		      pathbuf, ret);

-	return (NULL);
+	return NULL;
 }
 #endif /* HAVE_GEOIP2 */

@@ -79,9 +79,9 @@ named_geoip_load(char *dir) {
 #if defined(HAVE_GEOIP2)
 	REQUIRE(dir != NULL);

-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
-		      "looking for GeoIP2 databases in '%s'", dir);
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+		      ISC_LOG_INFO, "looking for GeoIP2 databases in '%s'",
+		      dir);

 	named_g_geoip->country = open_geoip2(dir, "GeoIP2-Country.mmdb",
 					     &geoip_country);
@@ -28,48 +28,51 @@

 #define NAMED_CONTROL_PORT 953

-#define NAMED_COMMAND_STOP	   "stop"
-#define NAMED_COMMAND_HALT	   "halt"
-#define NAMED_COMMAND_RELOAD	   "reload"
-#define NAMED_COMMAND_RECONFIG	   "reconfig"
-#define NAMED_COMMAND_REFRESH	   "refresh"
-#define NAMED_COMMAND_RETRANSFER   "retransfer"
-#define NAMED_COMMAND_DUMPSTATS	   "stats"
-#define NAMED_COMMAND_QUERYLOG	   "querylog"
+#define NAMED_COMMAND_ADDZONE	   "addzone"
+#define NAMED_COMMAND_CLOSELOGS	   "closelogs"
+#define NAMED_COMMAND_DELZONE	   "delzone"
+#define NAMED_COMMAND_DNSSEC	   "dnssec"
+#define NAMED_COMMAND_DNSTAP	   "dnstap"
+#define NAMED_COMMAND_DNSTAPREOPEN "dnstap-reopen"
 #define NAMED_COMMAND_DUMPDB	   "dumpdb"
-#define NAMED_COMMAND_SECROOTS	   "secroots"
-#define NAMED_COMMAND_TRACE	   "trace"
-#define NAMED_COMMAND_NOTRACE	   "notrace"
+#define NAMED_COMMAND_DUMPSTATS	   "stats"
+#define NAMED_COMMAND_FETCHLIMIT   "fetchlimit"
 #define NAMED_COMMAND_FLUSH	   "flush"
 #define NAMED_COMMAND_FLUSHNAME	   "flushname"
 #define NAMED_COMMAND_FLUSHTREE	   "flushtree"
-#define NAMED_COMMAND_STATUS	   "status"
 #define NAMED_COMMAND_FREEZE	   "freeze"
-#define NAMED_COMMAND_UNFREEZE	   "unfreeze"
-#define NAMED_COMMAND_THAW	   "thaw"
-#define NAMED_COMMAND_RECURSING	   "recursing"
-#define NAMED_COMMAND_NULL	   "null"
-#define NAMED_COMMAND_NOTIFY	   "notify"
-#define NAMED_COMMAND_VALIDATION   "validation"
-#define NAMED_COMMAND_SCAN	   "scan"
-#define NAMED_COMMAND_SIGN	   "sign"
+#define NAMED_COMMAND_HALT	   "halt"
 #define NAMED_COMMAND_LOADKEYS	   "loadkeys"
-#define NAMED_COMMAND_ADDZONE	   "addzone"
-#define NAMED_COMMAND_MODZONE	   "modzone"
-#define NAMED_COMMAND_DELZONE	   "delzone"
-#define NAMED_COMMAND_SHOWZONE	   "showzone"
-#define NAMED_COMMAND_SYNC	   "sync"
-#define NAMED_COMMAND_SIGNING	   "signing"
-#define NAMED_COMMAND_DNSSEC	   "dnssec"
-#define NAMED_COMMAND_ZONESTATUS   "zonestatus"
-#define NAMED_COMMAND_NTA	   "nta"
-#define NAMED_COMMAND_TESTGEN	   "testgen"
 #define NAMED_COMMAND_MKEYS	   "managed-keys"
-#define NAMED_COMMAND_DNSTAPREOPEN "dnstap-reopen"
-#define NAMED_COMMAND_DNSTAP	   "dnstap"
-#define NAMED_COMMAND_TCPTIMEOUTS  "tcp-timeouts"
+#define NAMED_COMMAND_MODZONE	   "modzone"
+#define NAMED_COMMAND_NOTIFY	   "notify"
+#define NAMED_COMMAND_NOTRACE	   "notrace"
+#define NAMED_COMMAND_NTA	   "nta"
+#define NAMED_COMMAND_NULL	   "null"
+#define NAMED_COMMAND_QUERYLOG	   "querylog"
+#define NAMED_COMMAND_RECONFIG	   "reconfig"
+#define NAMED_COMMAND_RECURSING	   "recursing"
+#define NAMED_COMMAND_REFRESH	   "refresh"
+#define NAMED_COMMAND_RELOAD	   "reload"
+#define NAMED_COMMAND_RESPONSELOG  "responselog"
+#define NAMED_COMMAND_RETRANSFER   "retransfer"
+#define NAMED_COMMAND_SCAN	   "scan"
+#define NAMED_COMMAND_SECROOTS	   "secroots"
 #define NAMED_COMMAND_SERVESTALE   "serve-stale"
-#define NAMED_COMMAND_FETCHLIMIT   "fetchlimit"
+#define NAMED_COMMAND_SHOWZONE	   "showzone"
+#define NAMED_COMMAND_SIGN	   "sign"
+#define NAMED_COMMAND_SIGNING	   "signing"
+#define NAMED_COMMAND_SKR	   "skr"
+#define NAMED_COMMAND_STATUS	   "status"
+#define NAMED_COMMAND_STOP	   "stop"
+#define NAMED_COMMAND_SYNC	   "sync"
+#define NAMED_COMMAND_TCPTIMEOUTS  "tcp-timeouts"
+#define NAMED_COMMAND_TESTGEN	   "testgen"
+#define NAMED_COMMAND_THAW	   "thaw"
+#define NAMED_COMMAND_TRACE	   "trace"
+#define NAMED_COMMAND_UNFREEZE	   "unfreeze"
+#define NAMED_COMMAND_VALIDATION   "validation"
+#define NAMED_COMMAND_ZONESTATUS   "zonestatus"

 isc_result_t
 named_controls_create(named_server_t *server, named_controls_t **ctrlsp);
@@ -86,10 +86,8 @@ EXTERN named_server_t *named_g_server INIT(NULL);
 /*
 * Logging.
 */
-EXTERN isc_log_t *named_g_lctx		     INIT(NULL);
-EXTERN isc_logcategory_t *named_g_categories INIT(NULL);
-EXTERN isc_logmodule_t *named_g_modules	     INIT(NULL);
-EXTERN unsigned int named_g_debuglevel	     INIT(0);
+EXTERN bool named_g_logging	       INIT(false);
+EXTERN unsigned int named_g_debuglevel INIT(0);

 /*
 * Current configuration information.
@@ -100,8 +98,6 @@ EXTERN const char *named_g_conffile	   INIT(NAMED_SYSCONFDIR "/named.conf");
 EXTERN const char *named_g_defaultbindkeys INIT(NULL);
 EXTERN const char *named_g_keyfile	   INIT(NAMED_SYSCONFDIR "/rndc.key");

-EXTERN dns_tsigkey_t *named_g_sessionkey    INIT(NULL);
-EXTERN dns_name_t			    named_g_sessionkeyname;
 EXTERN bool named_g_conffileset		    INIT(false);
 EXTERN cfg_aclconfctx_t *named_g_aclconfctx INIT(NULL);

@@ -113,6 +109,7 @@ EXTERN const char *named_g_chrootdir INIT(NULL);
 EXTERN bool named_g_foreground	     INIT(false);
 EXTERN bool named_g_logstderr	     INIT(false);
 EXTERN bool named_g_nosyslog	     INIT(false);
+EXTERN unsigned int named_g_logflags INIT(0);
 EXTERN const char *named_g_logfile   INIT(NULL);

 EXTERN const char *named_g_defaultsessionkeyfile INIT(NAMED_LOCALSTATEDIR
@@ -129,8 +126,6 @@ EXTERN const char *named_g_defaultpidfile INIT(NAMED_LOCALSTATEDIR "/run/"

 EXTERN const char *named_g_username INIT(NULL);

-EXTERN const char *named_g_engine INIT(NULL);
-
 EXTERN isc_time_t		  named_g_boottime;
 EXTERN isc_time_t		  named_g_configtime;
 EXTERN bool named_g_memstatistics INIT(false);
@@ -18,22 +18,8 @@
 #include <isc/log.h>
 #include <isc/types.h>

-#include <dns/log.h>
-
 #include <named/globals.h> /* Required for named_g_(categories|modules). */

-/* Unused slot 0. */
-#define NAMED_LOGCATEGORY_UNMATCHED (&named_g_categories[1])
-
-/*
- * Backwards compatibility.
- */
-#define NAMED_LOGCATEGORY_GENERAL ISC_LOGCATEGORY_GENERAL
-
-#define NAMED_LOGMODULE_MAIN	(&named_g_modules[0])
-#define NAMED_LOGMODULE_SERVER	(&named_g_modules[1])
-#define NAMED_LOGMODULE_CONTROL (&named_g_modules[2])
-
 isc_result_t
 named_log_init(bool safe);
 /*%
@@ -79,6 +65,3 @@ named_log_setunmatchedcategory(isc_logconfig_t *lcfg);
 /*%
 * Set up "category unmatched" to go to the right places.
 */
-
-void
-named_log_shutdown(void);
@@ -26,7 +26,7 @@
 */
 #define NAMED_MAIN_ARGS "46A:c:Cd:D:E:fFgL:M:m:n:N:p:sS:t:T:U:u:vVx:X:"

-noreturn void
+ISC_NORETURN void
 named_main_earlyfatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);

 void
@@ -39,10 +39,13 @@ void
 named_os_inituserinfo(const char *username);

 void
-named_os_changeuser(void);
+named_os_changeuser(bool permanent);
+
+void
+named_os_restoreuser(void);

 uid_t
-ns_os_uid(void);
+named_os_uid(void);

 void
 named_os_adjustnofile(void);
@@ -56,9 +56,6 @@ struct named_server {
 	char *version;	    /*%< User-specified version */
 	bool  hostname_set; /*%< User has set hostname */
 	char *hostname;	    /*%< User-specified hostname */
-#ifdef USE_DNSRPS
-	char *dnsrpslib;
-#endif /* ifdef USE_DNSRPS */

 	/* Server data structures. */
 	dns_loadmgr_t	  *loadmgr;
@@ -75,7 +72,6 @@ struct named_server {
 	isc_timer_t *tat_timer;

 	uint32_t interface_interval;
-	uint32_t heartbeat_interval;

 	atomic_int reload_status;

@@ -108,6 +104,7 @@ struct named_server {
 	isc_tlsctx_cache_t *tlsctx_client_cache;

 	isc_signal_t *sighup;
+	isc_signal_t *sigusr1;
 };

 #define NAMED_SERVER_MAGIC    ISC_MAGIC('S', 'V', 'E', 'R')
@@ -184,10 +181,20 @@ named_server_retransfercommand(named_server_t *server, isc_lex_t *lex,
 */

 isc_result_t
-named_server_togglequerylog(named_server_t *server, isc_lex_t *lex);
+named_server_setortoggle(named_server_t *server, const char *optname,
+			 unsigned int option, isc_lex_t *lex);
 /*%<
- * Enable/disable logging of queries.  (Takes "yes" or "no" argument,
- * but can also be used as a toggle for backward comptibility.)
+ * Enable/disable, or toggle, a server option via the command channel.
+ * 'option' is the option value to be changed (for example,
+ * NS_SERVER_LOGQUERIES or NS_SERVER_LOGRESPOSNES) and 'optname' is the
+ * option's human-readable name for logging purposes ("query logging"
+ * or "response logging").
+ *
+ * If an explicit argument to enable the option was provided
+ * (i.e., "on", "enable", "true", or "yes") or an explicit argument
+ * to disable it ("off", "disable", "false", or "no"), it will be used.
+ *
+ * If no argument is provided, the option's current state will be reversed.
 */

 /*%
@@ -375,3 +382,9 @@ named_server_servestale(named_server_t *server, isc_lex_t *lex,
 isc_result_t
 named_server_fetchlimit(named_server_t *server, isc_lex_t *lex,
 			isc_buffer_t **text);
+
+/*%
+ * Import SKR file for offline KSK signing.
+ */
+isc_result_t
+named_server_skr(named_server_t *server, isc_lex_t *lex, isc_buffer_t **text);
@@ -15,67 +15,29 @@

 #include <stdlib.h>

+#include <isc/log.h>
 #include <isc/result.h>
 #include <isc/util.h>

-#include <dns/log.h>
-
-#include <isccfg/log.h>
-
-#include <ns/log.h>
-
 #include <named/log.h>

 #ifndef ISC_FACILITY
 #define ISC_FACILITY LOG_DAEMON
 #endif /* ifndef ISC_FACILITY */

-/*%
- * When adding a new category, be sure to add the appropriate
- * \#define to <named/log.h> and to update the list in
- * bin/check/check-tool.c.
- */
-static isc_logcategory_t categories[] = { { "", 0 },
-					  { "unmatched", 0 },
-					  { NULL, 0 } };
-
-/*%
- * When adding a new module, be sure to add the appropriate
- * \#define to <dns/log.h>.
- */
-static isc_logmodule_t modules[] = {
-	{ "main", 0 }, { "server", 0 }, { "control", 0 }, { NULL, 0 }
-};
-
 isc_result_t
 named_log_init(bool safe) {
 	isc_result_t result;
 	isc_logconfig_t *lcfg = NULL;
-	isc_mem_t *log_mctx = NULL;
-
-	named_g_categories = categories;
-	named_g_modules = modules;

 	/*
-	 * Setup a logging context.
+	 * This is not technically needed, as we are calling named_log_init()
+	 * only at the start of named process.  But since the named binary is
+	 * the only place that also calls isc_logconfig_set(), this is a good
+	 * hygiene.
 	 */
-	isc_mem_create(&log_mctx);
-	isc_mem_setname(log_mctx, "named_log");
-	isc_log_create(log_mctx, &named_g_lctx, &lcfg);
-	isc_mem_detach(&log_mctx);
-
-	/*
-	 * named-checktool.c:setup_logging() needs to be kept in sync.
-	 */
-	isc_log_registercategories(named_g_lctx, named_g_categories);
-	isc_log_registermodules(named_g_lctx, named_g_modules);
-	isc_log_setcontext(named_g_lctx);
-	dns_log_init(named_g_lctx);
-	dns_log_setcontext(named_g_lctx);
-	cfg_log_init(named_g_lctx);
-	ns_log_init(named_g_lctx);
-	ns_log_setcontext(named_g_lctx);
-
+	rcu_read_lock();
+	lcfg = isc_logconfig_get();
 	if (safe) {
 		named_log_setsafechannels(lcfg);
 	} else {
@@ -88,15 +50,16 @@ named_log_init(bool safe) {
 	}

 	named_log_setdefaultsslkeylogfile(lcfg);
+	rcu_read_unlock();

-	return (ISC_R_SUCCESS);
+	named_g_logging = true;
+
+	return ISC_R_SUCCESS;

 cleanup:
-	isc_log_destroy(&named_g_lctx);
-	isc_log_setcontext(NULL);
-	dns_log_setcontext(NULL);
+	rcu_read_unlock();

-	return (result);
+	return result;
 }

 void
@@ -116,6 +79,16 @@ named_log_setdefaultchannels(isc_logconfig_t *lcfg) {
 		isc_log_createchannel(lcfg, "default_debug", ISC_LOG_TOFILE,
 				      ISC_LOG_DYNAMIC, &destination,
 				      ISC_LOG_PRINTTIME | ISC_LOG_DEBUGONLY);
+	} else if (named_g_logstderr && (named_g_logflags != 0)) {
+		/*
+		 * If the option -g is given, but we also requested iso
+		 * timestamps, we'll still need to override the "default_debug"
+		 * logger with a new one.
+		 */
+		isc_log_createchannel(lcfg, "default_debug", ISC_LOG_TOFILEDESC,
+				      ISC_LOG_DYNAMIC,
+				      ISC_LOGDESTINATION_STDERR,
+				      ISC_LOG_PRINTTIME | named_g_logflags);
 	}

 	if (named_g_logfile != NULL) {
@@ -139,7 +112,7 @@ named_log_setdefaultchannels(isc_logconfig_t *lcfg) {
 	/*
 	 * Set the initial debug level.
 	 */
-	isc_log_setdebuglevel(named_g_lctx, named_g_debuglevel);
+	isc_log_setdebuglevel(named_g_debuglevel);
 }

 void
@@ -154,9 +127,19 @@ named_log_setsafechannels(isc_logconfig_t *lcfg) {
 		 * Setting the debug level to zero should get the output
 		 * discarded a bit faster.
 		 */
-		isc_log_setdebuglevel(named_g_lctx, 0);
+		isc_log_setdebuglevel(0);
+	} else if (named_g_logstderr && (named_g_logflags != 0)) {
+		/*
+		 * If the option -g is given, but we also requested iso
+		 * timestamps, we'll still need to override the "default_debug"
+		 * logger with a new one.
+		 */
+		isc_log_createchannel(lcfg, "default_debug", ISC_LOG_TOFILEDESC,
+				      ISC_LOG_DYNAMIC,
+				      ISC_LOGDESTINATION_STDERR,
+				      ISC_LOG_PRINTTIME | named_g_logflags);
 	} else {
-		isc_log_setdebuglevel(named_g_lctx, named_g_debuglevel);
+		isc_log_setdebuglevel(named_g_debuglevel);
 	}

 	if (named_g_logfile != NULL) {
@@ -199,7 +182,6 @@ named_log_setdefaultsslkeylogfile(isc_logconfig_t *lcfg) {
 			.maximum_size = 100 * 1024 * 1024,
 		},
 	};
-	isc_result_t result;

 	if (sslkeylogfile_path == NULL ||
 	    strcmp(sslkeylogfile_path, "config") == 0)
@@ -207,11 +189,10 @@ named_log_setdefaultsslkeylogfile(isc_logconfig_t *lcfg) {
 		return;
 	}

-	isc_log_createchannel(lcfg, "default_sslkeylogfile", ISC_LOG_TOFILE,
-			      ISC_LOG_INFO, &destination, 0);
-	result = isc_log_usechannel(lcfg, "default_sslkeylogfile",
-				    ISC_LOGCATEGORY_SSLKEYLOG, NULL);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+	isc_log_createandusechannel(lcfg, "default_sslkeylogfile",
+				    ISC_LOG_TOFILE, ISC_LOG_INFO, &destination,
+				    0, ISC_LOGCATEGORY_SSLKEYLOG,
+				    ISC_LOGMODULE_DEFAULT);
 }

 isc_result_t
@@ -219,7 +200,8 @@ named_log_setdefaultcategory(isc_logconfig_t *lcfg) {
 	isc_result_t result = ISC_R_SUCCESS;

 	result = isc_log_usechannel(lcfg, "default_debug",
-				    ISC_LOGCATEGORY_DEFAULT, NULL);
+				    ISC_LOGCATEGORY_DEFAULT,
+				    ISC_LOGMODULE_DEFAULT);
 	if (result != ISC_R_SUCCESS) {
 		goto cleanup;
 	}
@@ -228,16 +210,16 @@ named_log_setdefaultcategory(isc_logconfig_t *lcfg) {
 		if (named_g_logfile != NULL) {
 			result = isc_log_usechannel(lcfg, "default_logfile",
 						    ISC_LOGCATEGORY_DEFAULT,
-						    NULL);
+						    ISC_LOGMODULE_DEFAULT);
 		} else if (!named_g_nosyslog) {
 			result = isc_log_usechannel(lcfg, "default_syslog",
 						    ISC_LOGCATEGORY_DEFAULT,
-						    NULL);
+						    ISC_LOGMODULE_DEFAULT);
 		}
 	}

 cleanup:
-	return (result);
+	return result;
 }

 isc_result_t
@@ -245,13 +227,6 @@ named_log_setunmatchedcategory(isc_logconfig_t *lcfg) {
 	isc_result_t result;

 	result = isc_log_usechannel(lcfg, "null", NAMED_LOGCATEGORY_UNMATCHED,
-				    NULL);
-	return (result);
-}
-
-void
-named_log_shutdown(void) {
-	isc_log_destroy(&named_g_lctx);
-	isc_log_setcontext(NULL);
-	dns_log_setcontext(NULL);
+				    ISC_LOGMODULE_DEFAULT);
+	return result;
 }
@@ -24,7 +24,6 @@
 #include <isc/util.h>

 #include <isccfg/cfg.h>
-#include <isccfg/log.h>

 #include <named/log.h>
 #include <named/logconf.h>
@@ -44,28 +43,25 @@ static isc_result_t
 category_fromconf(const cfg_obj_t *ccat, isc_logconfig_t *logconfig) {
 	isc_result_t result;
 	const char *catname;
-	isc_logcategory_t *category;
-	isc_logmodule_t *module;
+	isc_logcategory_t category;
 	const cfg_obj_t *destinations = NULL;
 	const cfg_listelt_t *element = NULL;

 	catname = cfg_obj_asstring(cfg_tuple_get(ccat, "name"));
-	category = isc_log_categorybyname(named_g_lctx, catname);
-	if (category == NULL) {
-		cfg_obj_log(ccat, named_g_lctx, ISC_LOG_ERROR,
+	category = isc_log_categorybyname(catname);
+	if (category == ISC_LOGCATEGORY_INVALID) {
+		cfg_obj_log(ccat, ISC_LOG_ERROR,
 			    "unknown logging category '%s' ignored", catname);
 		/*
 		 * Allow further processing by returning success.
 		 */
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	if (logconfig == NULL) {
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

-	module = NULL;
-
 	destinations = cfg_tuple_get(ccat, "destinations");
 	for (element = cfg_list_first(destinations); element != NULL;
 	     element = cfg_list_next(element))
@@ -74,16 +70,16 @@ category_fromconf(const cfg_obj_t *ccat, isc_logconfig_t *logconfig) {
 		const char *channelname = cfg_obj_asstring(channel);

 		result = isc_log_usechannel(logconfig, channelname, category,
-					    module);
+					    ISC_LOGMODULE_DEFAULT);
 		if (result != ISC_R_SUCCESS) {
-			isc_log_write(named_g_lctx, CFG_LOGCATEGORY_CONFIG,
+			isc_log_write(CFG_LOGCATEGORY_CONFIG,
 				      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 				      "logging channel '%s': %s", channelname,
 				      isc_result_totext(result));
-			return (result);
+			return result;
 		}
 	}
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 /*%
@@ -127,11 +123,11 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *logconfig) {
 	}

 	if (i != 1) {
-		cfg_obj_log(channel, named_g_lctx, ISC_LOG_ERROR,
+		cfg_obj_log(channel, ISC_LOG_ERROR,
 			    "channel '%s': exactly one of file, syslog, "
 			    "null, and stderr must be present",
 			    channelname);
-		return (ISC_R_FAILURE);
+		return ISC_R_FAILURE;
 	}

 	type = ISC_LOG_TONULL;
@@ -243,6 +239,8 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *logconfig) {
 				flags |= ISC_LOG_ISO8601;
 			} else if (strcasecmp(s, "iso8601-utc") == 0) {
 				flags |= ISC_LOG_ISO8601 | ISC_LOG_UTC;
+			} else if (strcasecmp(s, "iso8601-tzinfo") == 0) {
+				flags |= ISC_LOG_ISO8601 | ISC_LOG_TZINFO;
 			}
 		}
 	}
@@ -310,7 +308,7 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *logconfig) {
 	}

 done:
-	return (result);
+	return result;
 }

 isc_result_t
@@ -365,8 +363,8 @@ named_logconfig(isc_logconfig_t *logconfig, const cfg_obj_t *logstmt) {
 		CHECK(named_log_setunmatchedcategory(logconfig));
 	}

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;

 cleanup:
-	return (result);
+	return result;
 }
@@ -27,6 +27,7 @@
 #include <isc/attributes.h>
 #include <isc/backtrace.h>
 #include <isc/commandline.h>
+#include <isc/crypto.h>
 #include <isc/dir.h>
 #include <isc/file.h>
 #include <isc/fips.h>
@@ -88,7 +89,7 @@
 #include <openssl/crypto.h>
 #include <openssl/evp.h>
 #include <openssl/opensslv.h>
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
 #include <openssl/err.h>
 #include <openssl/provider.h>
 #endif
@@ -152,7 +153,7 @@ static bool transferstuck = false;
 static bool disable6 = false;
 static bool disable4 = false;

-#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
 static OSSL_PROVIDER *fips = NULL, *base = NULL;
 #endif

@@ -161,10 +162,9 @@ named_main_earlywarning(const char *format, ...) {
 	va_list args;

 	va_start(args, format);
-	if (named_g_lctx != NULL) {
-		isc_log_vwrite(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			       NAMED_LOGMODULE_MAIN, ISC_LOG_WARNING, format,
-			       args);
+	if (named_g_logging) {
+		isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			       ISC_LOG_WARNING, format, args);
 	} else {
 		fprintf(stderr, "%s: ", program_name);
 		vfprintf(stderr, format, args);
@@ -179,12 +179,11 @@ named_main_earlyfatal(const char *format, ...) {
 	va_list args;

 	va_start(args, format);
-	if (named_g_lctx != NULL) {
-		isc_log_vwrite(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			       NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL, format,
-			       args);
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL,
+	if (named_g_logging) {
+		isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			       ISC_LOG_CRITICAL, format, args);
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			      ISC_LOG_CRITICAL,
 			      "exiting (due to early fatal error)");
 	} else {
 		fprintf(stderr, "%s: ", program_name);
@@ -197,7 +196,7 @@ named_main_earlyfatal(const char *format, ...) {
 	_exit(EXIT_FAILURE);
 }

-noreturn static void
+ISC_NORETURN static void
 assertion_failed(const char *file, int line, isc_assertiontype_t type,
 		 const char *cond);

@@ -208,21 +207,20 @@ assertion_failed(const char *file, int line, isc_assertiontype_t type,
 	 * Handle assertion failures.
 	 */

-	if (named_g_lctx != NULL) {
+	if (named_g_logging) {
 		/*
 		 * Reset the assertion callback in case it is the log
 		 * routines causing the assertion.
 		 */
 		isc_assertion_setcallback(NULL);

-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL,
-			      "%s:%d: %s(%s) failed", file, line,
-			      isc_assertion_typetotext(type), cond);
-		isc_backtrace_log(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			      ISC_LOG_CRITICAL, "%s:%d: %s(%s) failed", file,
+			      line, isc_assertion_typetotext(type), cond);
+		isc_backtrace_log(NAMED_LOGCATEGORY_GENERAL,
 				  NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL);
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL,
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			      ISC_LOG_CRITICAL,
 			      "exiting (due to assertion failure)");
 	} else {
 		fprintf(stderr, "%s:%d: %s(%s) failed\n", file, line,
@@ -236,7 +234,7 @@ assertion_failed(const char *file, int line, isc_assertiontype_t type,
 	_exit(EXIT_FAILURE);
 }

-noreturn static void
+ISC_NORETURN static void
 library_fatal_error(const char *file, int line, const char *func,
 		    const char *format, va_list args) ISC_FORMAT_PRINTF(3, 0);

@@ -247,21 +245,20 @@ library_fatal_error(const char *file, int line, const char *func,
 	 * Handle isc_error_fatal() calls from our libraries.
 	 */

-	if (named_g_lctx != NULL) {
+	if (named_g_logging) {
 		/*
 		 * Reset the error callback in case it is the log
 		 * routines causing the assertion.
 		 */
 		isc_error_setfatal(NULL);

-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL,
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			      ISC_LOG_CRITICAL,
 			      "%s:%d:%s(): fatal error: ", file, line, func);
-		isc_log_vwrite(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			       NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL, format,
-			       args);
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL,
+		isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			       ISC_LOG_CRITICAL, format, args);
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			      ISC_LOG_CRITICAL,
 			      "exiting (due to fatal error in library)");
 	} else {
 		fprintf(stderr, "%s:%d:%s(): fatal error: ", file, line, func);
@@ -288,14 +285,13 @@ library_unexpected_error(const char *file, int line, const char *func,
 	 * Handle isc_error_unexpected() calls from our libraries.
 	 */

-	if (named_g_lctx != NULL) {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_MAIN, ISC_LOG_ERROR,
+	if (named_g_logging) {
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			      ISC_LOG_ERROR,
 			      "%s:%d:%s(): unexpected error: ", file, line,
 			      func);
-		isc_log_vwrite(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			       NAMED_LOGMODULE_MAIN, ISC_LOG_ERROR, format,
-			       args);
+		isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			       ISC_LOG_ERROR, format, args);
 	} else {
 		fprintf(stderr, "%s:%d:%s(): fatal error: ", file, line, func);
 		vfprintf(stderr, format, args);
@@ -307,13 +303,13 @@ library_unexpected_error(const char *file, int line, const char *func,
 static void
 usage(void) {
 	fprintf(stderr, "usage: named [-4|-6] [-c conffile] [-d debuglevel] "
-			"[-D comment] [-E engine]\n"
+			"[-D comment]\n"
 			"             [-f|-g] [-L logfile] [-n number_of_cpus] "
 			"[-p port] [-s]\n"
 			"             [-S sockets] [-t chrootdir] [-u "
 			"username] [-U listeners]\n"
 			"             [-m "
-			"{usage|trace|record|size|mctx}]\n"
+			"{usage|trace|record}]\n"
 			"             [-M fill|nofill]\n"
 			"usage: named [-v|-V|-C]\n");
 }
@@ -406,7 +402,7 @@ parse_int(char *arg, const char *desc) {
 	if (tmp < 0 || tmp != ltmp) {
 		named_main_earlyfatal("%s '%s' out of range", desc, arg);
 	}
-	return (tmp);
+	return tmp;
 }

 static struct flag_def {
@@ -510,9 +506,8 @@ list_hmac_algorithms(isc_buffer_t *b) {

 static void
 logit(isc_buffer_t *b) {
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE, "%.*s",
-		      (int)isc_buffer_usedlength(b),
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "%.*s", (int)isc_buffer_usedlength(b),
 		      (char *)isc_buffer_base(b));
 }

@@ -556,8 +551,6 @@ format_supported_algorithms(void (*emit)(isc_buffer_t *b)) {
 static void
 printversion(bool verbose) {
 	char rndcconf[PATH_MAX], *dot = NULL;
-	isc_mem_t *mctx = NULL;
-	isc_result_t result;
 	isc_buffer_t b;
 	char buf[512];
 #if defined(HAVE_GEOIP2)
@@ -590,16 +583,8 @@ printversion(bool verbose) {
 	printf("compiled by Solaris Studio %x\n", __SUNPRO_C);
 #endif /* ifdef __SUNPRO_C */
 	printf("compiled with OpenSSL version: %s\n", OPENSSL_VERSION_TEXT);
-#if !defined(LIBRESSL_VERSION_NUMBER) && \
-	OPENSSL_VERSION_NUMBER >= 0x10100000L /* 1.1.0 or higher */
 	printf("linked to OpenSSL version: %s\n",
 	       OpenSSL_version(OPENSSL_VERSION));
-
-#else  /* if !defined(LIBRESSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER >= \
-	* 0x10100000L */
-	printf("linked to OpenSSL version: %s\n",
-	       SSLeay_version(SSLEAY_VERSION));
-#endif /* OPENSSL_VERSION_NUMBER >= 0x10100000L */
 	printf("compiled with libuv version: %d.%d.%d\n", UV_VERSION_MAJOR,
 	       UV_VERSION_MINOR, UV_VERSION_PATCH);
 	printf("linked to libuv version: %s\n", uv_version_string());
@@ -639,17 +624,9 @@ printversion(bool verbose) {
 #endif /* if defined(HAVE_DNSTAP) */
 	printf("threads support is enabled\n");

-	isc_mem_create(&mctx);
-	result = dst_lib_init(mctx, named_g_engine);
-	if (result == ISC_R_SUCCESS) {
-		isc_buffer_init(&b, buf, sizeof(buf));
-		format_supported_algorithms(printit);
-		printf("\n");
-		dst_lib_destroy();
-	} else {
-		printf("DST initialization failure: %s\n",
-		       isc_result_totext(result));
-	}
+	isc_buffer_init(&b, buf, sizeof(buf));
+	format_supported_algorithms(printit);
+	printf("\n");

 	/*
 	 * The default rndc.conf and rndc.key paths are in the same
@@ -673,7 +650,9 @@ printversion(bool verbose) {
 	printf("  named PID file:       %s\n", named_g_defaultpidfile);
 #if defined(HAVE_GEOIP2)
 #define RTC(x) RUNTIME_CHECK((x) == ISC_R_SUCCESS)
-	RTC(cfg_parser_create(mctx, named_g_lctx, &parser));
+	isc_mem_t *mctx = NULL;
+	isc_mem_create(&mctx);
+	RTC(cfg_parser_create(mctx, &parser));
 	RTC(named_config_parsedefaults(parser, &config));
 	RTC(cfg_map_get(config, "options", &defaults));
 	RTC(cfg_map_get(defaults, "geoip-directory", &obj));
@@ -902,7 +881,8 @@ parse_command_line(int argc, char *argv[]) {
 			/* Descriptive comment for 'ps'. */
 			break;
 		case 'E':
-			named_g_engine = isc_commandline_argument;
+			named_main_earlyfatal(
+				"%s", isc_result_totext(DST_R_NOENGINE));
 			break;
 		case 'f':
 			named_g_foreground = true;
@@ -910,6 +890,8 @@ parse_command_line(int argc, char *argv[]) {
 		case 'g':
 			named_g_foreground = true;
 			named_g_logstderr = true;
+			named_g_logflags = ISC_LOG_PRINTTIME | ISC_LOG_ISO8601 |
+					   ISC_LOG_TZINFO;
 			break;
 		case 'L':
 			named_g_logfile = isc_commandline_argument;
@@ -968,7 +950,7 @@ parse_command_line(int argc, char *argv[]) {
 			named_main_earlyfatal("option '-X' has been removed");
 			break;
 		case 'F':
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
 			fips = OSSL_PROVIDER_load(NULL, "fips");
 			if (fips == NULL) {
 				ERR_clear_error();
@@ -1032,18 +1014,18 @@ create_managers(void) {
 		named_g_cpus = named_g_cpus_detected;
 	}

-	isc_log_write(
-		named_g_lctx, NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-		ISC_LOG_INFO, "found %u CPU%s, using %u worker thread%s",
-		named_g_cpus_detected, named_g_cpus_detected == 1 ? "" : "s",
-		named_g_cpus, named_g_cpus == 1 ? "" : "s");
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+		      ISC_LOG_INFO, "found %u CPU%s, using %u worker thread%s",
+		      named_g_cpus_detected,
+		      named_g_cpus_detected == 1 ? "" : "s", named_g_cpus,
+		      named_g_cpus == 1 ? "" : "s");

 	isc_managers_create(&named_g_mctx, named_g_cpus, &named_g_loopmgr,
 			    &named_g_netmgr);

 	isc_nm_maxudp(named_g_netmgr, maxudp);

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static void
@@ -1116,150 +1098,129 @@ setup(void) {
 		named_os_daemonize();
 	}

-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "starting %s%s <id:%s>", PACKAGE_STRING,
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "starting %s%s <id:%s>", PACKAGE_STRING,
 		      PACKAGE_DESCRIPTION, PACKAGE_SRCID);

-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE, "running on %s",
-		      named_os_uname());
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "running on %s", named_os_uname());

-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE, "built with %s",
-		      PACKAGE_CONFIGARGS);
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "built with %s", PACKAGE_CONFIGARGS);

-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "running as: %s%s%s", program_name, saved_command_line,
-		      ellipsis);
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "running as: %s%s%s", program_name,
+		      saved_command_line, ellipsis);
 #ifdef __clang__
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "compiled by CLANG %s", __VERSION__);
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "compiled by CLANG %s", __VERSION__);
 #else /* ifdef __clang__ */
 #if defined(__ICC) || defined(__INTEL_COMPILER)
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "compiled by ICC %s", __VERSION__);
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "compiled by ICC %s", __VERSION__);
 #else /* if defined(__ICC) || defined(__INTEL_COMPILER) */
 #ifdef __GNUC__
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "compiled by GCC %s", __VERSION__);
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "compiled by GCC %s", __VERSION__);
 #endif /* ifdef __GNUC__ */
 #endif /* if defined(__ICC) || defined(__INTEL_COMPILER) */
 #endif /* ifdef __clang__ */
 #ifdef __SUNPRO_C
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "compiled by Solaris Studio %x", __SUNPRO_C);
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "compiled by Solaris Studio %x",
+		      __SUNPRO_C);
 #endif /* ifdef __SUNPRO_C */
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "compiled with OpenSSL version: %s",
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "compiled with OpenSSL version: %s",
 		      OPENSSL_VERSION_TEXT);
-#if !defined(LIBRESSL_VERSION_NUMBER) && \
-	OPENSSL_VERSION_NUMBER >= 0x10100000L /* 1.1.0 or higher */
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "linked to OpenSSL version: %s",
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "linked to OpenSSL version: %s",
 		      OpenSSL_version(OPENSSL_VERSION));
-#else  /* if !defined(LIBRESSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER >= \
-	* 0x10100000L */
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "linked to OpenSSL version: %s",
-		      SSLeay_version(SSLEAY_VERSION));
-#endif /* OPENSSL_VERSION_NUMBER >= 0x10100000L */
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "compiled with libuv version: %d.%d.%d", UV_VERSION_MAJOR,
-		      UV_VERSION_MINOR, UV_VERSION_PATCH);
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "linked to libuv version: %s", uv_version_string());
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "compiled with %s version: %s", RCU_FLAVOR, RCU_VERSION);
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "compiled with libuv version: %d.%d.%d",
+		      UV_VERSION_MAJOR, UV_VERSION_MINOR, UV_VERSION_PATCH);
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "linked to libuv version: %s",
+		      uv_version_string());
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "compiled with %s version: %s",
+		      RCU_FLAVOR, RCU_VERSION);
 #if defined(JEMALLOC_VERSION)
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE,
 		      "compiled with jemalloc version: %u.%u.%u",
 		      JEMALLOC_VERSION_MAJOR, JEMALLOC_VERSION_MINOR,
 		      JEMALLOC_VERSION_BUGFIX);
 #elif defined(M_VERSION)
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE,
 		      "compiled with system jemalloc version: %u", M_VERSION);
 #endif
 #if HAVE_LIBNGHTTP2
 	nghttp2_info *nginfo = NULL;
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "compiled with libnghttp2 version: %s", NGHTTP2_VERSION);
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "compiled with libnghttp2 version: %s",
+		      NGHTTP2_VERSION);
 	nginfo = nghttp2_version(1);
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "linked to libnghttp2 version: %s", nginfo->version_str);
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "linked to libnghttp2 version: %s",
+		      nginfo->version_str);
 #endif
 #ifdef HAVE_LIBXML2
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "compiled with libxml2 version: %s",
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "compiled with libxml2 version: %s",
 		      LIBXML_DOTTED_VERSION);
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "linked to libxml2 version: %s", xmlParserVersion);
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "linked to libxml2 version: %s",
+		      xmlParserVersion);
 #endif /* ifdef HAVE_LIBXML2 */
 #if defined(HAVE_JSON_C)
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "compiled with json-c version: %s", JSON_C_VERSION);
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "linked to json-c version: %s", json_c_version());
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "compiled with json-c version: %s",
+		      JSON_C_VERSION);
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "linked to json-c version: %s",
+		      json_c_version());
 #endif /* if defined(HAVE_JSON_C) */
 #if defined(HAVE_ZLIB) && defined(ZLIB_VERSION)
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "compiled with zlib version: %s", ZLIB_VERSION);
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "linked to zlib version: %s", zlibVersion());
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "compiled with zlib version: %s",
+		      ZLIB_VERSION);
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "linked to zlib version: %s",
+		      zlibVersion());
 #endif /* if defined(HAVE_ZLIB) && defined(ZLIB_VERSION) */
 #if defined(HAVE_GEOIP2)
 	/* Unfortunately, no version define on link time */
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "linked to maxminddb version: %s", MMDB_lib_version());
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "linked to maxminddb version: %s",
+		      MMDB_lib_version());
 #endif /* if defined(HAVE_GEOIP2) */
 #if defined(HAVE_DNSTAP)
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "compiled with protobuf-c version: %s",
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "compiled with protobuf-c version: %s",
 		      PROTOBUF_C_VERSION);
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "linked to protobuf-c version: %s", protobuf_c_version());
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "linked to protobuf-c version: %s",
+		      protobuf_c_version());
 #endif /* if defined(HAVE_DNSTAP) */
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE,
 		      "----------------------------------------------------");
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE,
 		      "BIND 9 is maintained by Internet Systems Consortium,");
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE,
 		      "Inc. (ISC), a non-profit 501(c)(3) public-benefit ");
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE,
 		      "corporation.  Support and training for BIND 9 are ");
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE,
 		      "available at https://www.isc.org/support");
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE,
 		      "----------------------------------------------------");

 	/*
@@ -1316,10 +1277,6 @@ setup(void) {
 	ENSURE(named_g_server != NULL);
 	sctx = named_g_server->sctx;

-	/*
-	 * Report supported algorithms now that dst_lib_init() has
-	 * been called via named_server_create().
-	 */
 	format_supported_algorithms(logit);

 	/*
@@ -1395,9 +1352,8 @@ cleanup(void) {
 	 */
 	dlz_dlopen_clear();

-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE, "exiting");
-	named_log_shutdown();
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE, "exiting");
 }

 static char *memstats = NULL;
@@ -1437,7 +1393,7 @@ named_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {
 			UNEXPECTED_ERROR("scf_handle_create() failed: %s",
 					 scf_strerror(scf_error()));
 		}
-		return (ISC_R_FAILURE);
+		return ISC_R_FAILURE;
 	}

 	if (scf_handle_bind(h) == -1) {
@@ -1446,7 +1402,7 @@ named_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {
 					 scf_strerror(scf_error()));
 		}
 		scf_handle_destroy(h);
-		return (ISC_R_FAILURE);
+		return ISC_R_FAILURE;
 	}

 	if ((namelen = scf_myname(h, NULL, 0)) == -1) {
@@ -1455,7 +1411,7 @@ named_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {
 					 scf_strerror(scf_error()));
 		}
 		scf_handle_destroy(h);
-		return (ISC_R_FAILURE);
+		return ISC_R_FAILURE;
 	}

 	if ((instance = isc_mem_allocate(mctx, namelen + 1)) == NULL) {
@@ -1463,7 +1419,7 @@ named_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {
 				 "allocation failed: %s",
 				 isc_result_totext(ISC_R_NOMEMORY));
 		scf_handle_destroy(h);
-		return (ISC_R_FAILURE);
+		return ISC_R_FAILURE;
 	}

 	if (scf_myname(h, instance, namelen + 1) == -1) {
@@ -1473,12 +1429,12 @@ named_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {
 		}
 		scf_handle_destroy(h);
 		isc_mem_free(mctx, instance);
-		return (ISC_R_FAILURE);
+		return ISC_R_FAILURE;
 	}

 	scf_handle_destroy(h);
 	*ins_name = instance;
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }
 #endif /* HAVE_LIBSCF */

@@ -1567,6 +1523,7 @@ main(int argc, char *argv[]) {
 	 * Start things running
 	 */
 	isc_signal_start(named_g_server->sighup);
+	isc_signal_start(named_g_server->sigusr1);

 	/*
 	 * Pause the loop manager in fatal.
@@ -1609,7 +1566,7 @@ main(int argc, char *argv[]) {
 	isc_managers_destroy(&named_g_mctx, &named_g_loopmgr, &named_g_netmgr);

 #if ENABLE_LEAK_DETECTION
-	isc__tls_setdestroycheck(true);
+	isc__crypto_setdestroycheck(true);
 	isc__uv_setdestroycheck(true);
 	isc__xml_setdestroycheck(true);
 #endif
@@ -1622,7 +1579,7 @@ main(int argc, char *argv[]) {

 	named_os_shutdown();

-#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
 	if (base != NULL) {
 		OSSL_PROVIDER_unload(base);
 	}
@@ -1635,5 +1592,5 @@ main(int argc, char *argv[]) {
 	ProfilerStop();
 #endif /* ifdef HAVE_GPERFTOOLS_PROFILER */

-	return (0);
+	return 0;
 }
@@ -21,7 +21,7 @@ named - Internet domain name server
 Synopsis
 ~~~~~~~~

-:program:`named` [ [**-4**] | [**-6**] ] [**-c** config-file] [**-C**] [**-d** debug-level] [**-D** string] [**-E** engine-name] [**-f**] [**-g**] [**-L** logfile] [**-M** option] [**-m** flag] [**-n** #cpus] [**-p** port] [**-s**] [**-t** directory] [**-u** user] [**-v**] [**-V**] ]
+:program:`named` [ [**-4**] | [**-6**] ] [**-c** config-file] [**-C**] [**-d** debug-level] [**-D** string] [**-f**] [**-g**] [**-L** logfile] [**-M** option] [**-m** flag] [**-n** #cpus] [**-p** port] [**-s**] [**-t** directory] [**-u** user] [**-v**] [**-V**] ]

 Description
 ~~~~~~~~~~~
@@ -73,15 +73,6 @@ Options
   This option specifies a string that is used to identify a instance of :program:`named`
   in a process listing. The contents of ``string`` are not examined.

-.. option:: -E engine-name
-
-   When applicable, this option specifies the hardware to use for cryptographic
-   operations, such as a secure key store used for signing.
-
-   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
-   engine identifier that drives the cryptographic accelerator or
-   hardware service module (usually ``pkcs11``).
-
 .. option:: -f

   This option runs the server in the foreground (i.e., do not daemonize).
@@ -117,7 +108,7 @@ Options
 .. option:: -m flag

   This option turns on memory usage debugging flags. Possible flags are ``usage``,
-   ``trace``, ``record``, ``size``, and ``mctx``. These correspond to the
+   ``trace`` and ``record``. These correspond to the
   ``ISC_MEM_DEBUGXXXX`` flags described in ``<isc/mem.h>``.

 .. option:: -n #cpus
@@ -61,6 +61,9 @@ static struct passwd *runas_pw = NULL;
 static bool done_setuid = false;
 static int dfd[2] = { -1, -1 };

+static uid_t saved_uid = (uid_t)-1;
+static gid_t saved_gid = (gid_t)-1;
+
 #if HAVE_LIBCAP

 static bool non_root = false;
@@ -249,115 +252,6 @@ linux_keepcaps(void) {

 #endif /* HAVE_LIBCAP */

-/*
- * First define compatibility shims if {set,get}res{uid,gid} are not available
- */
-
-#if !HAVE_GETRESGID
-static int
-getresgid(gid_t *rgid, gid_t *egid, gid_t *sgid) {
-	*rgid = -1;
-	*egid = getegid();
-	*sgid = -1;
-
-	return (0);
-}
-#endif /* !HAVE_GETRESGID */
-
-#if !HAVE_SETRESGID
-static int
-setresgid(gid_t rgid, gid_t egid, gid_t sgid) {
-	REQUIRE(rgid == (gid_t)-1);
-	REQUIRE(sgid == (gid_t)-1);
-
-#if HAVE_SETREGID
-	return (setregid(rgid, egid));
-#else  /* HAVE_SETREGID */
-	return (setegid(egid));
-#endif /* HAVE_SETREGID */
-}
-#endif /* !HAVE_SETRESGID */
-
-#if !HAVE_GETRESUID
-static int
-getresuid(uid_t *ruid, uid_t *euid, uid_t *suid) {
-	*ruid = -1;
-	*euid = geteuid();
-	*suid = -1;
-
-	return (0);
-}
-#endif /* !HAVE_GETRESUID */
-
-#if !HAVE_SETRESUID
-static int
-setresuid(uid_t ruid, uid_t euid, uid_t suid) {
-	REQUIRE(ruid == (uid_t)-1);
-	REQUIRE(suid == (uid_t)-1);
-
-#if HAVE_SETREGID
-	return (setregid(ruid, euid));
-#else  /* HAVE_SETREGID */
-	return (setegid(euid));
-#endif /* HAVE_SETREGID */
-}
-#endif /* !HAVE_SETRESUID */
-
-static int
-set_effective_gid(gid_t gid) {
-	gid_t oldgid;
-
-	if (getresgid(&(gid_t){ 0 }, &oldgid, &(gid_t){ 0 }) == -1) {
-		return (-1);
-	}
-
-	if (oldgid == gid) {
-		return (0);
-	}
-
-	if (setresgid(-1, gid, -1) == -1) {
-		return (-1);
-	}
-
-	if (getresgid(&(gid_t){ 0 }, &oldgid, &(gid_t){ 0 }) == -1) {
-		return (-1);
-	}
-
-	if (oldgid != gid) {
-		return (-1);
-	}
-
-	return (0);
-}
-
-static int
-set_effective_uid(uid_t uid) {
-	uid_t olduid;
-
-	if (getresuid(&(uid_t){ 0 }, &olduid, &(uid_t){ 0 }) == -1) {
-		return (-1);
-	}
-
-	if (olduid == uid) {
-		return (0);
-	}
-
-	if (setresuid(-1, uid, -1) == -1) {
-		return (-1);
-	}
-
-	if (getresuid(&(uid_t){ 0 }, &olduid, &(uid_t){ 0 }) == -1) {
-		return (-1);
-	}
-
-	if (olduid != uid) {
-		return (-1);
-	}
-
-	/* Success */
-	return (0);
-}
-
 static void
 setperms(uid_t uid, gid_t gid) {
 	char strbuf[ISC_STRERRORSIZE];
@@ -366,13 +260,13 @@ setperms(uid_t uid, gid_t gid) {
 	 * Drop the gid privilege first, because in some cases the gid privilege
 	 * cannot be dropped after the uid privilege has been dropped.
 	 */
-	if (set_effective_gid(gid) == -1) {
+	if (setegid(gid) == -1) {
 		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlywarning("unable to set effective gid to %d: %s",
 					gid, strbuf);
 	}

-	if (set_effective_uid(uid) == -1) {
+	if (seteuid(uid) == -1) {
 		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlywarning("unable to set effective uid to %d: %s",
 					uid, strbuf);
@@ -506,15 +400,15 @@ named_os_closedevnull(void) {
 static bool
 all_digits(const char *s) {
 	if (*s == '\0') {
-		return (false);
+		return false;
 	}
 	while (*s != '\0') {
 		if (!isdigit((unsigned char)(*s))) {
-			return (false);
+			return false;
 		}
 		s++;
 	}
-	return (true);
+	return true;
 }

 void
@@ -570,20 +464,41 @@ named_os_inituserinfo(const char *username) {
 }

 void
-named_os_changeuser(void) {
+named_os_restoreuser(void) {
+	if (runas_pw == NULL || done_setuid) {
+		return;
+	}
+
+	REQUIRE(saved_uid != (uid_t)-1);
+	REQUIRE(saved_gid != (gid_t)-1);
+
+	setperms(saved_uid, saved_gid);
+}
+
+void
+named_os_changeuser(bool permanent) {
 	char strbuf[ISC_STRERRORSIZE];
 	if (runas_pw == NULL || done_setuid) {
 		return;
 	}

+	if (!permanent) {
+		saved_uid = getuid();
+		saved_gid = getgid();
+
+		setperms(runas_pw->pw_uid, runas_pw->pw_gid);
+
+		return;
+	}
+
 	done_setuid = true;

-	if (setgid(runas_pw->pw_gid) < 0) {
+	if (setgid(runas_pw->pw_gid) == -1) {
 		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlyfatal("setgid(): %s", strbuf);
 	}

-	if (setuid(runas_pw->pw_uid) < 0) {
+	if (setuid(runas_pw->pw_uid) == -1) {
 		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlyfatal("setuid(): %s", strbuf);
 	}
@@ -604,11 +519,11 @@ named_os_changeuser(void) {
 }

 uid_t
-ns_os_uid(void) {
+named_os_uid(void) {
 	if (runas_pw == NULL) {
-		return (0);
+		return 0;
 	}
-	return (runas_pw->pw_uid);
+	return runas_pw->pw_uid;
 }

 void
@@ -626,8 +541,8 @@ named_os_adjustnofile(void) {
 	rlim_old = rl.rlim_cur;

 	if (rl.rlim_cur == rl.rlim_max) {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			      ISC_LOG_NOTICE,
 			      "the limit on open files is already at the "
 			      "maximum allowed value: "
 			      "%" PRIu64,
@@ -641,8 +556,8 @@ named_os_adjustnofile(void) {
 		goto fail;
 	}

-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE,
 		      "adjusted limit on open files from "
 		      "%" PRIu64 " to "
 		      "%" PRIu64,
@@ -660,7 +575,7 @@ void
 named_os_minprivs(void) {
 #if HAVE_LIBCAP
 	linux_keepcaps();
-	named_os_changeuser();
+	named_os_changeuser(true);
 	linux_minprivs();
 #endif /* HAVE_LIBCAP */
 }
@@ -672,22 +587,22 @@ safe_open(const char *filename, mode_t mode, bool append) {

 	if (stat(filename, &sb) == -1) {
 		if (errno != ENOENT) {
-			return (-1);
+			return -1;
 		}
 	} else if ((sb.st_mode & S_IFREG) == 0) {
 		errno = EOPNOTSUPP;
-		return (-1);
+		return -1;
 	}

 	if (append) {
 		fd = open(filename, O_WRONLY | O_CREAT | O_APPEND, mode);
 	} else {
 		if (unlink(filename) < 0 && errno != ENOENT) {
-			return (-1);
+			return -1;
 		}
 		fd = open(filename, O_WRONLY | O_CREAT | O_EXCL, mode);
 	}
-	return (fd);
+	return fd;
 }

 static void
@@ -735,7 +650,7 @@ mkdirpath(char *filename, void (*report)(const char *, ...)) {
 			    !strcmp(slash + 1, ".."))
 			{
 				*slash = '/';
-				return (0);
+				return 0;
 			}
 			mode = S_IRUSR | S_IWUSR | S_IXUSR; /* u=rwx */
 			mode |= S_IRGRP | S_IXGRP;	    /* g=rx */
@@ -757,11 +672,11 @@ mkdirpath(char *filename, void (*report)(const char *, ...)) {
 		}
 		*slash = '/';
 	}
-	return (0);
+	return 0;

 error:
 	*slash = '/';
-	return (-1);
+	return -1;
 }

 FILE *
@@ -778,28 +693,25 @@ named_os_openfile(const char *filename, mode_t mode, bool switch_user) {
 		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlywarning("couldn't strdup() '%s': %s", filename,
 					strbuf);
-		return (NULL);
+		return NULL;
 	}
 	if (mkdirpath(f, named_main_earlywarning) == -1) {
 		free(f);
-		return (NULL);
+		return NULL;
 	}
 	free(f);

 	if (switch_user && runas_pw != NULL) {
-		uid_t olduid = getuid();
-		gid_t oldgid = getgid();
-
 		/*
-		 * Set UID/GID to the one we'll be running with
+		 * Temporarily set UID/GID to the one we'll be running with
 		 * eventually.
 		 */
-		setperms(runas_pw->pw_uid, runas_pw->pw_gid);
+		named_os_changeuser(false);

 		fd = safe_open(filename, mode, false);

 		/* Restore UID/GID to previous uid/gid */
-		setperms(olduid, oldgid);
+		named_os_restoreuser();

 		if (fd == -1) {
 			fd = safe_open(filename, mode, false);
@@ -825,7 +737,7 @@ named_os_openfile(const char *filename, mode_t mode, bool switch_user) {
 		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlywarning("could not open file '%s': %s",
 					filename, strbuf);
-		return (NULL);
+		return NULL;
 	}

 	fp = fdopen(fd, "w");
@@ -835,7 +747,7 @@ named_os_openfile(const char *filename, mode_t mode, bool switch_user) {
 					filename, strbuf);
 	}

-	return (fp);
+	return fp;
 }

 void
@@ -951,5 +863,5 @@ named_os_uname(void) {
 	if (unamep == NULL) {
 		getuname();
 	}
-	return (unamep);
+	return unamep;
 }
@@ -126,19 +126,19 @@ user_zonetype(dns_zone_t *zone) {
 	const struct zt *tp;

 	if ((dns_zone_getoptions(zone) & DNS_ZONEOPT_AUTOEMPTY) != 0) {
-		return ("builtin");
+		return "builtin";
 	}

 	view = dns_zone_getview(zone);
 	if (view != NULL && strcmp(view->name, "_bind") == 0) {
-		return ("builtin");
+		return "builtin";
 	}

 	ztype = dns_zone_gettype(zone);
 	for (tp = typemap; tp->string != NULL && tp->type != ztype; tp++) {
 		/* empty */
 	}
-	return (tp->string);
+	return tp->string;
 }
 #endif /* ifdef EXTENDED_STATS */

@@ -251,7 +251,7 @@ get_histo_desc(const char *prefix, int i, int inf, bool ext) {
 	}
 	INSIST(0 < len && (size_t)len < space);
 	used += len + 1;
-	return (desc);
+	return desc;
 }

 static void
@@ -339,6 +339,21 @@ init_desc(void) {
 		       "RPZRewrites");
 	SET_NSSTATDESC(udp, "UDP queries received", "QryUDP");
 	SET_NSSTATDESC(tcp, "TCP queries received", "QryTCP");
+	SET_NSSTATDESC(dot, "DoT queries received", "QryDoT");
+	SET_NSSTATDESC(doh, "DoH queries received", "QryDoH");
+	SET_NSSTATDESC(dohplain, "DoH-Plain queries received", "QryDoHPlain");
+	SET_NSSTATDESC(proxyudp, "PROXYv2 UDP queries received", "QryProxyUDP");
+	SET_NSSTATDESC(proxytcp, "PROXYv2 TCP queries received", "QryProxyTCP");
+	SET_NSSTATDESC(proxydot, "PROXYv2 DoT queries received", "QryProxyDoT");
+	SET_NSSTATDESC(proxydoh, "PROXYv2 DoH queries received", "QryProxyDoH");
+	SET_NSSTATDESC(proxydohplain, "PROXYv2/DoH-Plain queries received",
+		       "QryProxyDoHPlain");
+	SET_NSSTATDESC(encryptedproxydot,
+		       "Encrypted PROXYv2 DoT queries received",
+		       "QryEncryptedProxyDoT");
+	SET_NSSTATDESC(encryptedproxydoh,
+		       "Encrypted PROXYv2 DoH queries received",
+		       "QryEncryptedProxyDoH");
 	SET_NSSTATDESC(nsidopt, "NSID option received", "NSIDOpt");
 	SET_NSSTATDESC(expireopt, "Expire option received", "ExpireOpt");
 	SET_NSSTATDESC(keepaliveopt, "EDNS TCP keepalive option received",
@@ -472,6 +487,8 @@ init_desc(void) {
 			"ClientQuota");
 	SET_RESSTATDESC(nextitem, "waited for next item", "NextItem");
 	SET_RESSTATDESC(priming, "priming queries", "Priming");
+	SET_RESSTATDESC(forwardonlyfail, "all forwarders failed",
+			"ForwardOnlyFail");

 	INSIST(i == dns_resstatscounter_max);

@@ -814,8 +831,8 @@ dump_stats(isc_stats_t *stats, isc_statsformat_t type, void *arg,
 	memset(values, 0, sizeof(values[0]) * ncounters);
 	isc_stats_dump(stats, generalstat_dump, &dumparg, options);

-	return (dump_counters(type, arg, category, desc, ncounters, indices,
-			      values, options));
+	return dump_counters(type, arg, category, desc, ncounters, indices,
+			     values, options);
 }

 #if defined(EXTENDED_STATS)
@@ -831,8 +848,8 @@ dump_histo(isc_histomulti_t *hm, isc_statsformat_t type, void *arg,
 	}
 	isc_histo_destroy(&hg);

-	return (dump_counters(type, arg, category, desc, ncounters, indices,
-			      values, options));
+	return dump_counters(type, arg, category, desc, ncounters, indices,
+			     values, options);
 }
 #endif /* defined(EXTENDED_STATS) */

@@ -861,7 +878,7 @@ dump_counters(isc_statsformat_t type, void *arg, const char *category,
 		if (category != NULL) {
 			cat = json_object_new_object();
 			if (cat == NULL) {
-				return (ISC_R_NOMEMORY);
+				return ISC_R_NOMEMORY;
 			}
 			json_object_object_add(job, category, cat);
 		}
@@ -926,20 +943,19 @@ dump_counters(isc_statsformat_t type, void *arg, const char *category,
 #ifdef HAVE_JSON_C
 			counter = json_object_new_int64(value);
 			if (counter == NULL) {
-				return (ISC_R_NOMEMORY);
+				return ISC_R_NOMEMORY;
 			}
 			json_object_object_add(cat, desc[idx], counter);
 #endif /* ifdef HAVE_JSON_C */
 			break;
 		}
 	}
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 #ifdef HAVE_LIBXML2
 cleanup:
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
-		      "failed at dump_counters()");
-	return (ISC_R_FAILURE);
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+		      ISC_LOG_ERROR, "failed at dump_counters()");
+	return ISC_R_FAILURE;
 #endif /* ifdef HAVE_LIBXML2 */
 }

@@ -999,9 +1015,8 @@ rdtypestat_dump(dns_rdatastatstype_t type, uint64_t val, void *arg) {
 	return;
 #ifdef HAVE_LIBXML2
 cleanup:
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
-		      "failed at rdtypestat_dump()");
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+		      ISC_LOG_ERROR, "failed at rdtypestat_dump()");
 	dumparg->result = ISC_R_FAILURE;
 	return;
 #endif /* ifdef HAVE_LIBXML2 */
@@ -1009,7 +1024,7 @@ cleanup:

 static bool
 rdatastatstype_attr(dns_rdatastatstype_t type, unsigned int attr) {
-	return ((DNS_RDATASTATSTYPE_ATTR(type) & attr) != 0);
+	return (DNS_RDATASTATSTYPE_ATTR(type) & attr) != 0;
 }

 static void
@@ -1088,9 +1103,8 @@ rdatasetstats_dump(dns_rdatastatstype_t type, uint64_t val, void *arg) {
 	return;
 #ifdef HAVE_LIBXML2
 cleanup:
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
-		      "failed at rdatasetstats_dump()");
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+		      ISC_LOG_ERROR, "failed at rdatasetstats_dump()");
 	dumparg->result = ISC_R_FAILURE;
 #endif /* ifdef HAVE_LIBXML2 */
 }
@@ -1143,9 +1157,8 @@ opcodestat_dump(dns_opcode_t code, uint64_t val, void *arg) {

 #ifdef HAVE_LIBXML2
 cleanup:
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
-		      "failed at opcodestat_dump()");
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+		      ISC_LOG_ERROR, "failed at opcodestat_dump()");
 	dumparg->result = ISC_R_FAILURE;
 	return;
 #endif /* ifdef HAVE_LIBXML2 */
@@ -1199,9 +1212,8 @@ rcodestat_dump(dns_rcode_t code, uint64_t val, void *arg) {

 #ifdef HAVE_LIBXML2
 cleanup:
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
-		      "failed at rcodestat_dump()");
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+		      ISC_LOG_ERROR, "failed at rcodestat_dump()");
 	dumparg->result = ISC_R_FAILURE;
 	return;
 #endif /* ifdef HAVE_LIBXML2 */
@@ -1256,9 +1268,8 @@ dnssecsignstat_dump(uint32_t kval, uint64_t val, void *arg) {
 	return;
 #ifdef HAVE_LIBXML2
 cleanup:
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
-		      "failed at dnssecsignstat_dump()");
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+		      ISC_LOG_ERROR, "failed at dnssecsignstat_dump()");
 	dumparg->result = ISC_R_FAILURE;
 	return;
 #endif /* ifdef HAVE_LIBXML2 */
@@ -1293,7 +1304,7 @@ zone_xmlrender(dns_zone_t *zone, void *arg) {

 	statlevel = dns_zone_getstatlevel(zone);
 	if (statlevel == dns_zonestat_none) {
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	dumparg.type = isc_statsformat_xml;
@@ -1450,12 +1461,11 @@ zone_xmlrender(dns_zone_t *zone, void *arg) {

 	TRY0(xmlTextWriterEndElement(writer)); /* zone */

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 cleanup:
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
-		      "Failed at zone_xmlrender()");
-	return (ISC_R_FAILURE);
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+		      ISC_LOG_ERROR, "Failed at zone_xmlrender()");
+	return ISC_R_FAILURE;
 }

 static isc_result_t
@@ -1481,7 +1491,7 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {

 	statlevel = dns_zone_getstatlevel(zone);
 	if (statlevel == dns_zonestat_none) {
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	if (dns_zone_getxfr(zone, &xfr, &is_firstrefresh, &is_running,
@@ -1493,7 +1503,7 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {
 		 * (if any), but we still want to continue generating the
 		 * remaining parts of the output.
 		 */
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	if (!is_running && !is_deferred && !is_presoa && !is_pending &&
@@ -1503,12 +1513,12 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {
 			dns_xfrin_detach(&xfr);
 		}
 		/* No ongoing/queued transfer. */
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	if (is_running && xfr == NULL) {
 		/* The transfer is finished, and it's shutting down. */
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "xfrin"));
@@ -1718,18 +1728,17 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {
 		dns_xfrin_detach(&xfr);
 	}

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;

 cleanup:
 	if (xfr != NULL) {
 		dns_xfrin_detach(&xfr);
 	}

-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
-		      "Failed at xfrin_xmlrender()");
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+		      ISC_LOG_ERROR, "Failed at xfrin_xmlrender()");

-	return (ISC_R_FAILURE);
+	return ISC_R_FAILURE;
 }

 static isc_result_t
@@ -2131,19 +2140,18 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,

 	xmlFreeTextWriter(writer);
 	xmlFreeDoc(doc);
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;

 cleanup:
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
-		      "failed generating XML response");
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+		      ISC_LOG_ERROR, "failed generating XML response");
 	if (writer != NULL) {
 		xmlFreeTextWriter(writer);
 	}
 	if (doc != NULL) {
 		xmlFreeDoc(doc);
 	}
-	return (ISC_R_FAILURE);
+	return ISC_R_FAILURE;
 }

 static void
@@ -2173,12 +2181,11 @@ render_xml(uint32_t flags, void *arg, unsigned int *retcode,
 		*freecb = wrap_xmlfree;
 		*freecb_args = NULL;
 	} else {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
-			      "failed at rendering XML()");
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+			      ISC_LOG_ERROR, "failed at rendering XML()");
 	}

-	return (result);
+	return result;
 }

 static isc_result_t
@@ -2188,8 +2195,8 @@ render_xml_all(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 	       void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return (render_xml(STATS_XML_ALL, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args));
+	return render_xml(STATS_XML_ALL, arg, retcode, retmsg, mimetype, b,
+			  freecb, freecb_args);
 }

 static isc_result_t
@@ -2199,8 +2206,8 @@ render_xml_status(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		  isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return (render_xml(STATS_XML_STATUS, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args));
+	return render_xml(STATS_XML_STATUS, arg, retcode, retmsg, mimetype, b,
+			  freecb, freecb_args);
 }

 static isc_result_t
@@ -2210,8 +2217,8 @@ render_xml_server(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		  isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return (render_xml(STATS_XML_SERVER, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args));
+	return render_xml(STATS_XML_SERVER, arg, retcode, retmsg, mimetype, b,
+			  freecb, freecb_args);
 }

 static isc_result_t
@@ -2221,8 +2228,8 @@ render_xml_zones(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		 isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return (render_xml(STATS_XML_ZONES, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args));
+	return render_xml(STATS_XML_ZONES, arg, retcode, retmsg, mimetype, b,
+			  freecb, freecb_args);
 }

 static isc_result_t
@@ -2232,8 +2239,8 @@ render_xml_xfrins(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		  isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return (render_xml(STATS_XML_XFRINS, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args));
+	return render_xml(STATS_XML_XFRINS, arg, retcode, retmsg, mimetype, b,
+			  freecb, freecb_args);
 }

 static isc_result_t
@@ -2243,8 +2250,8 @@ render_xml_net(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 	       void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return (render_xml(STATS_XML_NET, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args));
+	return render_xml(STATS_XML_NET, arg, retcode, retmsg, mimetype, b,
+			  freecb, freecb_args);
 }

 static isc_result_t
@@ -2254,8 +2261,8 @@ render_xml_mem(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 	       void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return (render_xml(STATS_XML_MEM, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args));
+	return render_xml(STATS_XML_MEM, arg, retcode, retmsg, mimetype, b,
+			  freecb, freecb_args);
 }

 static isc_result_t
@@ -2265,8 +2272,8 @@ render_xml_traffic(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		   isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return (render_xml(STATS_XML_TRAFFIC, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args));
+	return render_xml(STATS_XML_TRAFFIC, arg, retcode, retmsg, mimetype, b,
+			  freecb, freecb_args);
 }

 #endif /* HAVE_LIBXML2 */
@@ -2306,7 +2313,7 @@ addzone(char *name, char *classname, const char *ztype, uint32_t serial,
 	json_object *node = json_object_new_object();

 	if (node == NULL) {
-		return (NULL);
+		return NULL;
 	}

 	json_object_object_add(node, "name", json_object_new_string(name));
@@ -2320,7 +2327,7 @@ addzone(char *name, char *classname, const char *ztype, uint32_t serial,
 		json_object_object_add(node, "type",
 				       json_object_new_string(ztype));
 	}
-	return (node);
+	return node;
 }

 static isc_result_t
@@ -2339,7 +2346,7 @@ zone_jsonrender(dns_zone_t *zone, void *arg) {

 	statlevel = dns_zone_getstatlevel(zone);
 	if (statlevel == dns_zonestat_none) {
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	dns_zone_nameonly(zone, buf, sizeof(buf));
@@ -2358,7 +2365,7 @@ zone_jsonrender(dns_zone_t *zone, void *arg) {
 	}

 	if (zoneobj == NULL) {
-		return (ISC_R_NOMEMORY);
+		return ISC_R_NOMEMORY;
 	}

 	/*
@@ -2526,7 +2533,7 @@ cleanup:
 	if (zoneobj != NULL) {
 		json_object_put(zoneobj);
 	}
-	return (result);
+	return result;
 }

 static isc_result_t
@@ -2555,7 +2562,7 @@ xfrin_jsonrender(dns_zone_t *zone, void *arg) {

 	statlevel = dns_zone_getstatlevel(zone);
 	if (statlevel == dns_zonestat_none) {
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	dns_zone_nameonly(zone, buf, sizeof(buf));
@@ -2780,7 +2787,7 @@ cleanup:
 	if (xfrinobj != NULL) {
 		json_object_put(xfrinobj);
 	}
-	return (result);
+	return result;
 }

 static isc_result_t
@@ -2818,7 +2825,7 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,

 	bindstats = json_object_new_object();
 	if (bindstats == NULL) {
-		return (ISC_R_NOMEMORY);
+		return ISC_R_NOMEMORY;
 	}

 	/*
@@ -3351,7 +3358,7 @@ cleanup:
 		json_object_put(bindstats);
 	}

-	return (result);
+	return result;
 }

 static isc_result_t
@@ -3376,12 +3383,11 @@ render_json(uint32_t flags, void *arg, unsigned int *retcode,
 		*freecb = wrap_jsonfree;
 		*freecb_args = bindstats;
 	} else {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
-			      "failed at rendering JSON()");
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+			      ISC_LOG_ERROR, "failed at rendering JSON()");
 	}

-	return (result);
+	return result;
 }

 static isc_result_t
@@ -3391,8 +3397,8 @@ render_json_all(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return (render_json(STATS_JSON_ALL, arg, retcode, retmsg, mimetype, b,
-			    freecb, freecb_args));
+	return render_json(STATS_JSON_ALL, arg, retcode, retmsg, mimetype, b,
+			   freecb, freecb_args);
 }

 static isc_result_t
@@ -3402,8 +3408,8 @@ render_json_status(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		   isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return (render_json(STATS_JSON_STATUS, arg, retcode, retmsg, mimetype,
-			    b, freecb, freecb_args));
+	return render_json(STATS_JSON_STATUS, arg, retcode, retmsg, mimetype, b,
+			   freecb, freecb_args);
 }

 static isc_result_t
@@ -3413,8 +3419,8 @@ render_json_server(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		   isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return (render_json(STATS_JSON_SERVER, arg, retcode, retmsg, mimetype,
-			    b, freecb, freecb_args));
+	return render_json(STATS_JSON_SERVER, arg, retcode, retmsg, mimetype, b,
+			   freecb, freecb_args);
 }

 static isc_result_t
@@ -3424,8 +3430,8 @@ render_json_zones(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		  isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return (render_json(STATS_JSON_ZONES, arg, retcode, retmsg, mimetype, b,
-			    freecb, freecb_args));
+	return render_json(STATS_JSON_ZONES, arg, retcode, retmsg, mimetype, b,
+			   freecb, freecb_args);
 }

 static isc_result_t
@@ -3435,8 +3441,8 @@ render_json_xfrins(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		   isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return (render_json(STATS_JSON_XFRINS, arg, retcode, retmsg, mimetype,
-			    b, freecb, freecb_args));
+	return render_json(STATS_JSON_XFRINS, arg, retcode, retmsg, mimetype, b,
+			   freecb, freecb_args);
 }

 static isc_result_t
@@ -3446,8 +3452,8 @@ render_json_mem(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return (render_json(STATS_JSON_MEM, arg, retcode, retmsg, mimetype, b,
-			    freecb, freecb_args));
+	return render_json(STATS_JSON_MEM, arg, retcode, retmsg, mimetype, b,
+			   freecb, freecb_args);
 }

 static isc_result_t
@@ -3457,8 +3463,8 @@ render_json_net(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return (render_json(STATS_JSON_NET, arg, retcode, retmsg, mimetype, b,
-			    freecb, freecb_args));
+	return render_json(STATS_JSON_NET, arg, retcode, retmsg, mimetype, b,
+			   freecb, freecb_args);
 }

 static isc_result_t
@@ -3468,12 +3474,17 @@ render_json_traffic(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		    isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return (render_json(STATS_JSON_TRAFFIC, arg, retcode, retmsg, mimetype,
-			    b, freecb, freecb_args));
+	return render_json(STATS_JSON_TRAFFIC, arg, retcode, retmsg, mimetype,
+			   b, freecb, freecb_args);
 }

 #endif /* HAVE_JSON_C */

+#if HAVE_LIBXML2
+/*
+ * This is only needed if we have libxml2 and was confusingly returned if
+ * neither of libxml2 or json-c is configured.
+ */
 static isc_result_t
 render_xsl(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo, void *args,
 	   unsigned int *retcode, const char **retmsg, const char **mimetype,
@@ -3527,20 +3538,22 @@ send:
 	isc_buffer_reinit(b, p, strlen(xslmsg));
 	isc_buffer_add(b, strlen(xslmsg));
 end:
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }
+#endif

 static void
 shutdown_listener(named_statschannel_t *listener) {
 	char socktext[ISC_SOCKADDR_FORMATSIZE];
 	isc_sockaddr_format(&listener->address, socktext, sizeof(socktext));
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_SERVER, ISC_LOG_NOTICE,
-		      "stopping statistics channel on %s", socktext);
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+		      ISC_LOG_NOTICE, "stopping statistics channel on %s",
+		      socktext);

 	isc_httpdmgr_shutdown(&listener->httpdmgr);
 }

+#if defined(HAVE_LIBXML2) || defined(HAVE_JSON_C)
 static bool
 client_ok(const isc_sockaddr_t *fromaddr, void *arg) {
 	named_statschannel_t *listener = arg;
@@ -3560,18 +3573,20 @@ client_ok(const isc_sockaddr_t *fromaddr, void *arg) {
 	    match > 0)
 	{
 		UNLOCK(&listener->lock);
-		return (true);
+		return true;
 	}
 	UNLOCK(&listener->lock);

 	isc_sockaddr_format(fromaddr, socktext, sizeof(socktext));
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
-		      "rejected statistics connection from %s", socktext);
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+		      ISC_LOG_WARNING, "rejected statistics connection from %s",
+		      socktext);

-	return (false);
+	return false;
 }
+#endif

+#if defined(HAVE_LIBXML2) || defined(HAVE_JSON_C)
 static void
 destroy_listener(void *arg) {
 	named_statschannel_t *listener = (named_statschannel_t *)arg;
@@ -3585,12 +3600,24 @@ destroy_listener(void *arg) {
 	isc_mutex_destroy(&listener->lock);
 	isc_mem_putanddetach(&listener->mctx, listener, sizeof(*listener));
 }
+#endif

 static isc_result_t
 add_listener(named_server_t *server, named_statschannel_t **listenerp,
 	     const cfg_obj_t *listen_params, const cfg_obj_t *config,
 	     isc_sockaddr_t *addr, cfg_aclconfctx_t *aclconfctx,
 	     const char *socktext) {
+#if !defined(HAVE_LIBXML2) && !defined(HAVE_JSON_C)
+	UNUSED(server);
+	UNUSED(listenerp);
+	UNUSED(listen_params);
+	UNUSED(config);
+	UNUSED(addr);
+	UNUSED(aclconfctx);
+	UNUSED(socktext);
+
+	return ISC_R_NOTIMPLEMENTED;
+#else
 	isc_result_t result;
 	named_statschannel_t *listener = NULL;
 	const cfg_obj_t *allow = NULL;
@@ -3605,9 +3632,8 @@ add_listener(named_server_t *server, named_statschannel_t **listenerp,

 	allow = cfg_tuple_get(listen_params, "allow");
 	if (allow != NULL && cfg_obj_islist(allow)) {
-		result = cfg_acl_fromconfig(allow, config, named_g_lctx,
-					    aclconfctx, listener->mctx, 0,
-					    &new_acl);
+		result = cfg_acl_fromconfig(allow, config, aclconfctx,
+					    listener->mctx, 0, &new_acl);
 	} else {
 		result = dns_acl_any(listener->mctx, &new_acl);
 	}
@@ -3656,6 +3682,8 @@ add_listener(named_server_t *server, named_statschannel_t **listenerp,
 	isc_httpdmgr_addurl(listener->httpdmgr,
 			    "/xml/v" STATS_XML_VERSION_MAJOR "/traffic", false,
 			    render_xml_traffic, server);
+	isc_httpdmgr_addurl(listener->httpdmgr, "/bind9.xsl", true, render_xsl,
+			    server);
 #endif /* ifdef HAVE_LIBXML2 */
 #ifdef HAVE_JSON_C
 	isc_httpdmgr_addurl(listener->httpdmgr, "/json", false, render_json_all,
@@ -3685,15 +3713,13 @@ add_listener(named_server_t *server, named_statschannel_t **listenerp,
 			    "/json/v" STATS_JSON_VERSION_MAJOR "/traffic",
 			    false, render_json_traffic, server);
 #endif /* ifdef HAVE_JSON_C */
-	isc_httpdmgr_addurl(listener->httpdmgr, "/bind9.xsl", true, render_xsl,
-			    server);

 	*listenerp = listener;
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_SERVER, ISC_LOG_NOTICE,
-		      "statistics channel listening on %s", socktext);
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+		      ISC_LOG_NOTICE, "statistics channel listening on %s",
+		      socktext);

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;

 cleanup:
 	if (listener->acl != NULL) {
@@ -3702,7 +3728,8 @@ cleanup:
 	isc_mutex_destroy(&listener->lock);
 	isc_mem_putanddetach(&listener->mctx, listener, sizeof(*listener));

-	return (result);
+	return result;
+#endif
 }

 static void
@@ -3733,9 +3760,8 @@ update_listener(named_server_t *server, named_statschannel_t **listenerp,
 	 */
 	allow = cfg_tuple_get(listen_params, "allow");
 	if (allow != NULL && cfg_obj_islist(allow)) {
-		result = cfg_acl_fromconfig(allow, config, named_g_lctx,
-					    aclconfctx, listener->mctx, 0,
-					    &new_acl);
+		result = cfg_acl_fromconfig(allow, config, aclconfctx,
+					    listener->mctx, 0, &new_acl);
 	} else {
 		result = dns_acl_any(listener->mctx, &new_acl);
 	}
@@ -3749,7 +3775,7 @@ update_listener(named_server_t *server, named_statschannel_t **listenerp,

 		UNLOCK(&listener->lock);
 	} else {
-		cfg_obj_log(listen_params, named_g_lctx, ISC_LOG_WARNING,
+		cfg_obj_log(listen_params, ISC_LOG_WARNING,
 			    "couldn't install new acl for "
 			    "statistics channel %s: %s",
 			    socktext, isc_result_totext(result));
@@ -3786,20 +3812,20 @@ named_statschannels_configure(named_server_t *server, const cfg_obj_t *config,
 	 */
 	if (statschannellist != NULL) {
 #ifndef EXTENDED_STATS
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+			      ISC_LOG_WARNING,
 			      "statistics-channels specified but not effective "
 			      "due to missing XML and/or JSON library");
 #else /* EXTENDED_STATS */
 #ifndef HAVE_LIBXML2
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+			      ISC_LOG_WARNING,
 			      "statistics-channels: XML library missing, "
 			      "only JSON stats will be available");
 #endif /* !HAVE_LIBXML2 */
 #ifndef HAVE_JSON_C
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+			      ISC_LOG_WARNING,
 			      "statistics-channels: JSON library missing, "
 			      "only XML stats will be available");
 #endif /* !HAVE_JSON_C */
@@ -3838,8 +3864,7 @@ named_statschannels_configure(named_server_t *server, const cfg_obj_t *config,
 				isc_sockaddr_format(&addr, socktext,
 						    sizeof(socktext));

-				isc_log_write(named_g_lctx,
-					      NAMED_LOGCATEGORY_GENERAL,
+				isc_log_write(NAMED_LOGCATEGORY_GENERAL,
 					      NAMED_LOGMODULE_SERVER,
 					      ISC_LOG_DEBUG(9),
 					      "processing statistics "
@@ -3870,7 +3895,6 @@ named_statschannels_configure(named_server_t *server, const cfg_obj_t *config,
 					if (r != ISC_R_SUCCESS) {
 						cfg_obj_log(
 							listen_params,
-							named_g_lctx,
 							ISC_LOG_WARNING,
 							"couldn't allocate "
 							"statistics channel"
@@ -3897,7 +3921,7 @@ named_statschannels_configure(named_server_t *server, const cfg_obj_t *config,
 	}

 	ISC_LIST_APPENDLIST(server->statschannels, new_listeners, link);
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 void
@@ -4135,5 +4159,5 @@ named_stats_dump(named_server_t *server, FILE *fp) {

 	fprintf(fp, "--- Statistics Dump --- (%lu)\n", (unsigned long)now);

-	return (ISC_R_SUCCESS); /* this function currently always succeeds */
+	return ISC_R_SUCCESS; /* this function currently always succeeds */
 }
@@ -38,9 +38,9 @@
 	} while (0)

 #include <named/log.h>
-#define LOG(msg)                                               \
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL, \
-		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR, "%s", msg)
+#define LOG(msg)                                                         \
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER, \
+		      ISC_LOG_ERROR, "%s", msg)

 isc_result_t
 named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
@@ -55,7 +55,7 @@ named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,

 	result = dns_tkeyctx_create(mctx, &tctx);
 	if (result != ISC_R_SUCCESS) {
-		return (result);
+		return result;
 	}

 	obj = NULL;
@@ -91,9 +91,9 @@ named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 	}

 	*tctxp = tctx;
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;

 failure:
 	dns_tkeyctx_destroy(&tctx);
-	return (result);
+	return result;
 }
@@ -131,13 +131,12 @@ add_doh_transports(const cfg_obj_t *transportlist, dns_transport_list_t *list) {
 				       dns_transport_set_remote_hostname);
 	}

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 failure:
-	cfg_obj_log(doh, named_g_lctx, ISC_LOG_ERROR,
-		    "configuring DoH '%s': %s", dohid,
+	cfg_obj_log(doh, ISC_LOG_ERROR, "configuring DoH '%s': %s", dohid,
 		    isc_result_totext(result));

-	return (result);
+	return result;
 }

 static isc_result_t
@@ -185,13 +184,12 @@ add_tls_transports(const cfg_obj_t *transportlist, dns_transport_list_t *list) {
 				       dns_transport_set_remote_hostname);
 	}

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 failure:
-	cfg_obj_log(tls, named_g_lctx, ISC_LOG_ERROR,
-		    "configuring tls '%s': %s", tlsid,
+	cfg_obj_log(tls, ISC_LOG_ERROR, "configuring tls '%s': %s", tlsid,
 		    isc_result_totext(result));

-	return (result);
+	return result;
 }

 #define CHECK(f)                             \
@@ -218,7 +216,7 @@ transport_list_fromconfig(const cfg_obj_t *config, dns_transport_list_t *list) {
 		obj = NULL;
 	}

-	return (result);
+	return result;
 }

 static void
@@ -260,8 +258,8 @@ named_transports_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	}

 	*listp = list;
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 failure:
 	dns_transport_list_detach(&list);
-	return (result);
+	return result;
 }
@@ -85,7 +85,7 @@ add_initial_keys(const cfg_obj_t *list, dns_tsigkeyring_t *ring,
 		if (named_config_getkeyalgorithm(algstr, &alg, &bits) !=
 		    ISC_R_SUCCESS)
 		{
-			cfg_obj_log(algobj, named_g_lctx, ISC_LOG_ERROR,
+			cfg_obj_log(algobj, ISC_LOG_ERROR,
 				    "key '%s': has a "
 				    "unsupported algorithm '%s'",
 				    keyid, algstr);
@@ -123,15 +123,15 @@ add_initial_keys(const cfg_obj_t *list, dns_tsigkeyring_t *ring,
 		dns_tsigkey_detach(&tsigkey);
 	}

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;

 failure:
 	if (secret != NULL) {
 		isc_mem_put(mctx, secret, secretalloc);
 	}
-	cfg_obj_log(key, named_g_lctx, ISC_LOG_ERROR,
-		    "configuring key '%s': %s", keyid, isc_result_totext(ret));
-	return (ret);
+	cfg_obj_log(key, ISC_LOG_ERROR, "configuring key '%s': %s", keyid,
+		    isc_result_totext(ret));
+	return ret;
 }

 isc_result_t
@@ -172,9 +172,9 @@ named_tsigkeyring_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	}

 	*ringp = ring;
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;

 failure:
 	dns_tsigkeyring_detach(&ring);
-	return (result);
+	return result;
 }
@@ -16,6 +16,7 @@

 #include <isc/buffer.h>
 #include <isc/file.h>
+#include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
 #include <isc/stats.h>
@@ -28,7 +29,6 @@
 #include <dns/ipkeylist.h>
 #include <dns/journal.h>
 #include <dns/kasp.h>
-#include <dns/log.h>
 #include <dns/masterdump.h>
 #include <dns/name.h>
 #include <dns/nsec3.h>
@@ -61,13 +61,6 @@ typedef enum {
 	allow_update_forwarding
 } acl_type_t;

-#define RETERR(x)                        \
-	do {                             \
-		isc_result_t _r = (x);   \
-		if (_r != ISC_R_SUCCESS) \
-			return ((_r));   \
-	} while (0)
-
 #define CHECK(x)                             \
 	do {                                 \
 		result = (x);                \
@@ -148,7 +141,7 @@ configure_zone_acl(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
 	/* Failing that, see if there's a default ACL already in the view */
 	if (aclp != NULL && *aclp != NULL) {
 		(*setzacl)(zone, *aclp);
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	/* Check for default ACLs that haven't been parsed yet */
@@ -171,14 +164,14 @@ configure_zone_acl(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
 	(void)named_config_get(maps, aclname, &aclobj);
 	if (aclobj == NULL) {
 		(*clearzacl)(zone);
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 parse_acl:
-	result = cfg_acl_fromconfig(aclobj, config, named_g_lctx, actx,
-				    named_g_mctx, 0, &acl);
+	result = cfg_acl_fromconfig(aclobj, config, actx, named_g_mctx, 0,
+				    &acl);
 	if (result != ISC_R_SUCCESS) {
-		return (result);
+		return result;
 	}
 	(*setzacl)(zone, acl);

@@ -188,7 +181,7 @@ parse_acl:
 	}

 	dns_acl_detach(&acl);
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 /*%
@@ -203,12 +196,17 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 	isc_mem_t *mctx = dns_zone_getmctx(zone);
 	bool autoddns = false;
 	isc_result_t result = ISC_R_SUCCESS;
+	char debug[1024];
+	isc_buffer_t dbuf;
+
+	isc_buffer_init(&dbuf, debug, sizeof(debug));
+	isc_buffer_setmctx(&dbuf, mctx);

 	(void)cfg_map_get(zconfig, "update-policy", &updatepolicy);

 	if (updatepolicy == NULL) {
 		dns_zone_setssutable(zone, NULL);
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	if (cfg_obj_isstring(updatepolicy) &&
@@ -237,7 +235,9 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		isc_buffer_t b;
 		dns_ssuruletype_t *types;
 		unsigned int i, n;
+		char namebuf[DNS_NAME_FORMATSIZE];

+		isc_buffer_clear(&dbuf);
 		str = cfg_obj_asstring(mode);
 		if (strcasecmp(str, "grant") == 0) {
 			grant = true;
@@ -246,14 +246,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		} else {
 			UNREACHABLE();
 		}
-
-		str = cfg_obj_asstring(matchtype);
-		CHECK(dns_ssu_mtypefromstring(str, &mtype));
-		if (mtype == dns_ssumatchtype_subdomain &&
-		    strcasecmp(str, "zonesub") == 0)
-		{
-			usezone = true;
-		}
+		isc_buffer_putstr(&dbuf, str);

 		dns_fixedname_init(&fident);
 		str = cfg_obj_asstring(identity);
@@ -262,10 +255,24 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		result = dns_name_fromtext(dns_fixedname_name(&fident), &b,
 					   dns_rootname, 0, NULL);
 		if (result != ISC_R_SUCCESS) {
-			cfg_obj_log(identity, named_g_lctx, ISC_LOG_ERROR,
+			cfg_obj_log(identity, ISC_LOG_ERROR,
 				    "'%s' is not a valid name", str);
 			goto cleanup;
 		}
+		dns_name_format(dns_fixedname_name(&fident), namebuf,
+				sizeof(namebuf));
+		isc_buffer_putstr(&dbuf, " ");
+		isc_buffer_putstr(&dbuf, namebuf);
+
+		str = cfg_obj_asstring(matchtype);
+		CHECK(dns_ssu_mtypefromstring(str, &mtype));
+		if (mtype == dns_ssumatchtype_subdomain &&
+		    strcasecmp(str, "zonesub") == 0)
+		{
+			usezone = true;
+		}
+		isc_buffer_putstr(&dbuf, " ");
+		isc_buffer_putstr(&dbuf, str);

 		dns_fixedname_init(&fname);
 		if (usezone) {
@@ -278,11 +285,14 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 			result = dns_name_fromtext(dns_fixedname_name(&fname),
 						   &b, dns_rootname, 0, NULL);
 			if (result != ISC_R_SUCCESS) {
-				cfg_obj_log(identity, named_g_lctx,
-					    ISC_LOG_ERROR,
+				cfg_obj_log(identity, ISC_LOG_ERROR,
 					    "'%s' is not a valid name", str);
 				goto cleanup;
 			}
+			dns_name_format(dns_fixedname_name(&fname), namebuf,
+					sizeof(namebuf));
+			isc_buffer_putstr(&dbuf, " ");
+			isc_buffer_putstr(&dbuf, namebuf);
 		}

 		n = named_config_listcount(typelist);
@@ -306,6 +316,8 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 			typeobj = cfg_listelt_value(element2);
 			str = cfg_obj_asstring(typeobj);
 			r.base = UNCONST(str);
+			isc_buffer_putstr(&dbuf, " ");
+			isc_buffer_putstr(&dbuf, str);

 			bracket = strchr(str, '(' /*)*/);
 			if (bracket != NULL) {
@@ -315,8 +327,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 				if (max > 0xffff || end[0] != /*(*/ ')' ||
 				    end[1] != 0)
 				{
-					cfg_obj_log(identity, named_g_lctx,
-						    ISC_LOG_ERROR,
+					cfg_obj_log(identity, ISC_LOG_ERROR,
 						    "'%s' is not a valid count",
 						    bracket);
 					isc_mem_cput(mctx, types, n,
@@ -330,8 +341,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,

 			result = dns_rdatatype_fromtext(&types[i++].type, &r);
 			if (result != ISC_R_SUCCESS) {
-				cfg_obj_log(identity, named_g_lctx,
-					    ISC_LOG_ERROR,
+				cfg_obj_log(identity, ISC_LOG_ERROR,
 					    "'%.*s' is not a valid type",
 					    (int)r.length, str);
 				isc_mem_cput(mctx, types, n, sizeof(*types));
@@ -340,9 +350,10 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		}
 		INSIST(i == n);

+		isc_buffer_putuint8(&dbuf, '\0');
 		dns_ssutable_addrule(table, grant, dns_fixedname_name(&fident),
 				     mtype, dns_fixedname_name(&fname), n,
-				     types);
+				     types, isc_buffer_base(&dbuf));
 		if (types != NULL) {
 			isc_mem_cput(mctx, types, n, sizeof(*types));
 		}
@@ -357,7 +368,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		dns_ssuruletype_t any = { dns_rdatatype_any, 0 };

 		if (named_g_server->session_keyname == NULL) {
-			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			isc_log_write(NAMED_LOGCATEGORY_GENERAL,
 				      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 				      "failed to enable auto DDNS policy "
 				      "for zone %s: session key not found",
@@ -366,17 +377,18 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 			goto cleanup;
 		}

-		dns_ssutable_addrule(table, true,
-				     named_g_server->session_keyname,
-				     dns_ssumatchtype_local,
-				     dns_zone_getorigin(zone), 1, &any);
+		dns_ssutable_addrule(
+			table, true, named_g_server->session_keyname,
+			dns_ssumatchtype_local, dns_zone_getorigin(zone), 1,
+			&any, "local");
 	}

 	dns_zone_setssutable(zone, table);

 cleanup:
+	isc_buffer_clearmctx(&dbuf);
 	dns_ssutable_detach(&table);
-	return (result);
+	return result;
 }

 /*
@@ -415,18 +427,18 @@ configure_staticstub_serveraddrs(const cfg_obj_t *zconfig, dns_zone_t *zone,

 		sa = cfg_obj_assockaddr(address);
 		if (isc_sockaddr_getport(sa) != 0) {
-			cfg_obj_log(zconfig, named_g_lctx, ISC_LOG_ERROR,
+			cfg_obj_log(zconfig, ISC_LOG_ERROR,
 				    "port is not configurable for "
 				    "static stub server-addresses");
-			return (ISC_R_FAILURE);
+			return ISC_R_FAILURE;
 		}
 		isc_netaddr_fromsockaddr(&na, sa);
 		if (isc_netaddr_getzone(&na) != 0) {
-			cfg_obj_log(zconfig, named_g_lctx, ISC_LOG_ERROR,
+			cfg_obj_log(zconfig, ISC_LOG_ERROR,
 				    "scoped address is not allowed "
 				    "for static stub "
 				    "server-addresses");
-			return (ISC_R_FAILURE);
+			return ISC_R_FAILURE;
 		}

 		switch (na.family) {
@@ -457,7 +469,7 @@ configure_staticstub_serveraddrs(const cfg_obj_t *zconfig, dns_zone_t *zone,
 	if (ISC_LIST_EMPTY(rdatalist_a->rdata) &&
 	    ISC_LIST_EMPTY(rdatalist_aaaa->rdata))
 	{
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	/* Add to the list an apex NS with the ns name being the origin name */
@@ -471,7 +483,7 @@ configure_staticstub_serveraddrs(const cfg_obj_t *zconfig, dns_zone_t *zone,
 			     &region);
 	ISC_LIST_APPEND(rdatalist_ns->rdata, rdata, link);

-	return (result);
+	return result;
 }

 /*%
@@ -508,18 +520,18 @@ configure_staticstub_servernames(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		isc_buffer_add(&b, strlen(str));
 		result = dns_name_fromtext(nsname, &b, dns_rootname, 0, NULL);
 		if (result != ISC_R_SUCCESS) {
-			cfg_obj_log(zconfig, named_g_lctx, ISC_LOG_ERROR,
+			cfg_obj_log(zconfig, ISC_LOG_ERROR,
 				    "server-name '%s' is not a valid "
 				    "name",
 				    str);
-			return (result);
+			return result;
 		}
 		if (dns_name_issubdomain(nsname, dns_zone_getorigin(zone))) {
-			cfg_obj_log(zconfig, named_g_lctx, ISC_LOG_ERROR,
+			cfg_obj_log(zconfig, ISC_LOG_ERROR,
 				    "server-name '%s' must not be a "
 				    "subdomain of zone name '%s'",
 				    str, zname);
-			return (ISC_R_FAILURE);
+			return ISC_R_FAILURE;
 		}

 		dns_name_toregion(nsname, &sregion);
@@ -533,7 +545,7 @@ configure_staticstub_servernames(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		ISC_LIST_APPEND(rdatalist->rdata, rdata, link);
 	}

-	return (result);
+	return result;
 }

 /*%
@@ -558,9 +570,12 @@ configure_staticstub(const cfg_obj_t *zconfig, dns_zone_t *zone,
 	isc_region_t region;

 	/* Create the DB beforehand */
-	RETERR(dns_db_create(mctx, dbtype, dns_zone_getorigin(zone),
-			     dns_dbtype_stub, dns_zone_getclass(zone), 0, NULL,
-			     &db));
+	result = dns_db_create(mctx, dbtype, dns_zone_getorigin(zone),
+			       dns_dbtype_stub, dns_zone_getclass(zone), 0,
+			       NULL, &db);
+	if (result != ISC_R_SUCCESS) {
+		return result;
+	}

 	dns_rdataset_init(&rdataset);

@@ -602,8 +617,8 @@ configure_staticstub(const cfg_obj_t *zconfig, dns_zone_t *zone,
 	 * to trigger delegation.
 	 */
 	if (ISC_LIST_EMPTY(rdatalist_ns.rdata)) {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+			      ISC_LOG_ERROR,
 			      "No NS record is configured for a "
 			      "static-stub zone '%s'",
 			      zname);
@@ -673,7 +688,7 @@ cleanup:

 	INSIST(dbversion == NULL);

-	return (result);
+	return result;
 }

 /*%
@@ -686,7 +701,7 @@ zonetype_fromconfig(const cfg_obj_t *map) {

 	result = cfg_map_get(map, "type", &obj);
 	INSIST(result == ISC_R_SUCCESS && obj != NULL);
-	return (named_config_getzonetype(obj));
+	return named_config_getzonetype(obj);
 }

 /*%
@@ -717,11 +732,11 @@ strtoargvsub(isc_mem_t *mctx, char *s, unsigned int *argcp, char ***argvp,

 		result = strtoargvsub(mctx, p, argcp, argvp, n + 1);
 		if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
 		(*argvp)[n] = s;
 	}
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 /*%
@@ -733,7 +748,7 @@ strtoargvsub(isc_mem_t *mctx, char *s, unsigned int *argcp, char ***argvp,
 */
 static isc_result_t
 strtoargv(isc_mem_t *mctx, char *s, unsigned int *argcp, char ***argvp) {
-	return (strtoargvsub(mctx, s, argcp, argvp, 0));
+	return strtoargvsub(mctx, s, argcp, argvp, 0);
 }

 static const char *const primary_synonyms[] = { "primary", "master", NULL };
@@ -780,12 +795,12 @@ isself(dns_view_t *myview, dns_tsigkey_t *mykey, const isc_sockaddr_t *srcaddr,

 	/* interfacemgr can be destroyed only in exclusive mode. */
 	if (named_g_server->interfacemgr == NULL) {
-		return (true);
+		return true;
 	}

 	if (!ns_interfacemgr_listeningon(named_g_server->interfacemgr, dstaddr))
 	{
-		return (false);
+		return false;
 	}

 	isc_netaddr_fromsockaddr(&netsrc, srcaddr);
@@ -828,7 +843,7 @@ isself(dns_view_t *myview, dns_tsigkey_t *mykey, const isc_sockaddr_t *srcaddr,
 			break;
 		}
 	}
-	return (view == myview);
+	return view == myview;
 }

 /*%
@@ -846,7 +861,7 @@ process_notifytype(dns_notifytype_t ntype, dns_zonetype_t ztype,
 	 * zone is configured with something else than "notify yes;".
 	 */
 	if (ztype != dns_zone_mirror || ntype != dns_notifytype_yes) {
-		return (ntype);
+		return ntype;
 	}

 	/*
@@ -854,13 +869,13 @@ process_notifytype(dns_notifytype_t ntype, dns_zonetype_t ztype,
 	 * hierarchy supplied in 'maps'.
 	 */
 	if (named_config_get(maps, "notify", &obj) == ISC_R_SUCCESS) {
-		cfg_obj_log(obj, named_g_lctx, ISC_LOG_INFO,
+		cfg_obj_log(obj, ISC_LOG_INFO,
 			    "'notify explicit;' will be used for mirror zone "
 			    "'%s'",
 			    zname);
 	}

-	return (dns_notifytype_explicit);
+	return dns_notifytype_explicit;
 }

 isc_result_t
@@ -882,18 +897,15 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	const char *dupcheck;
 	dns_checkdstype_t checkdstype = dns_checkdstype_yes;
 	dns_notifytype_t notifytype = dns_notifytype_yes;
-	uint32_t count;
 	unsigned int dbargc;
 	char **dbargv;
 	static char default_dbtype[] = ZONEDB_DEFAULT;
 	static char dlz_dbtype[] = "dlz";
 	char *cpval = default_dbtype;
 	isc_mem_t *mctx = dns_zone_getmctx(zone);
-	dns_dialuptype_t dialup = dns_dialuptype_no;
 	dns_zonetype_t ztype;
 	int i;
 	int32_t journal_size;
-	bool multi;
 	dns_kasp_t *kasp = NULL;
 	bool check = false, fail = false;
 	bool warn = false, ignore = false;
@@ -975,7 +987,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		size_t len;

 		if (cpval != default_dbtype) {
-			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			isc_log_write(NAMED_LOGCATEGORY_GENERAL,
 				      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 				      "zone '%s': both 'database' and 'dlz' "
 				      "specified",
@@ -1018,9 +1030,9 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	if (ztype == dns_zone_primary && cpval == default_dbtype &&
 	    filename == NULL)
 	{
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
-			      "zone '%s': 'file' not specified", zname);
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+			      ISC_LOG_ERROR, "zone '%s': 'file' not specified",
+			      zname);
 		CHECK(ISC_R_FAILURE);
 	}

@@ -1049,7 +1061,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		const char *masterstylestr = cfg_obj_asstring(obj);

 		if (masterformat != dns_masterformat_text) {
-			cfg_obj_log(obj, named_g_lctx, ISC_LOG_ERROR,
+			cfg_obj_log(obj, ISC_LOG_ERROR,
 				    "zone '%s': 'masterfile-style' "
 				    "can only be used with "
 				    "'masterfile-format text'",
@@ -1135,34 +1147,6 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 				 zone, dns_zone_setqueryonacl,
 				 dns_zone_clearqueryonacl));

-	obj = NULL;
-	result = named_config_get(maps, "dialup", &obj);
-	INSIST(result == ISC_R_SUCCESS && obj != NULL);
-	if (cfg_obj_isboolean(obj)) {
-		if (cfg_obj_asboolean(obj)) {
-			dialup = dns_dialuptype_yes;
-		} else {
-			dialup = dns_dialuptype_no;
-		}
-	} else {
-		const char *dialupstr = cfg_obj_asstring(obj);
-		if (strcasecmp(dialupstr, "notify") == 0) {
-			dialup = dns_dialuptype_notify;
-		} else if (strcasecmp(dialupstr, "notify-passive") == 0) {
-			dialup = dns_dialuptype_notifypassive;
-		} else if (strcasecmp(dialupstr, "refresh") == 0) {
-			dialup = dns_dialuptype_refresh;
-		} else if (strcasecmp(dialupstr, "passive") == 0) {
-			dialup = dns_dialuptype_passive;
-		} else {
-			UNREACHABLE();
-		}
-	}
-	if (raw != NULL) {
-		dns_zone_setdialup(raw, dialup);
-	}
-	dns_zone_setdialup(zone, dialup);
-
 	obj = NULL;
 	result = named_config_get(maps, "zone-statistics", &obj);
 	INSIST(result == ISC_R_SUCCESS && obj != NULL);
@@ -1218,6 +1202,8 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	if (ztype != dns_zone_stub && ztype != dns_zone_staticstub &&
 	    ztype != dns_zone_redirect)
 	{
+		bool logreports = false;
+
 		/* Make a reference to the default policy. */
 		result = dns_kasplist_find(kasplist, "default", &kasp);
 		INSIST(result == ISC_R_SUCCESS && kasp != NULL);
@@ -1233,8 +1219,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 							   &kasp);
 				if (result != ISC_R_SUCCESS) {
 					cfg_obj_log(
-						obj, named_g_lctx,
-						ISC_LOG_ERROR,
+						obj, ISC_LOG_ERROR,
 						"dnssec-policy '%s' not found ",
 						kaspname);
 					CHECK(result);
@@ -1360,7 +1345,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		} else {
 			uint64_t value = cfg_obj_asuint64(obj);
 			if (value > DNS_JOURNAL_SIZE_MAX) {
-				cfg_obj_log(obj, named_g_lctx, ISC_LOG_ERROR,
+				cfg_obj_log(obj, ISC_LOG_ERROR,
 					    "'max-journal-size "
 					    "%" PRId64 "' "
 					    "is too large",
@@ -1422,6 +1407,11 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		INSIST(result == ISC_R_SUCCESS);
 		dns_zone_setrequestixfr(zone, cfg_obj_asboolean(obj));

+		obj = NULL;
+		result = named_config_get(maps, "request-ixfr-max-diffs", &obj);
+		INSIST(result == ISC_R_SUCCESS);
+		dns_zone_setrequestixfrmaxdiffs(zone, cfg_obj_asuint32(obj));
+
 		obj = NULL;
 		checknames(ztype, maps, &obj);
 		INSIST(obj != NULL);
@@ -1487,6 +1477,51 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		dns_zone_setoption(zone, DNS_ZONEOPT_NSEC3TESTZONE,
 				   cfg_obj_asboolean(obj));
+
+		obj = NULL;
+		result = cfg_map_get(zoptions, "log-report-channel", &obj);
+		if (result == ISC_R_SUCCESS) {
+			logreports = cfg_obj_asboolean(obj);
+			dns_zone_setoption(zone, DNS_ZONEOPT_LOGREPORTS,
+					   logreports);
+		}
+		obj = NULL;
+		result = named_config_get(maps, "send-report-channel", &obj);
+		if (result == ISC_R_SUCCESS && obj != NULL) {
+			dns_fixedname_t fixed;
+			dns_name_t *rad = dns_fixedname_initname(&fixed);
+			const char *adstr = cfg_obj_asstring(obj);
+			dns_name_t *zn = dns_zone_getorigin(zone);
+
+			CHECK(dns_name_fromstring(rad, adstr, dns_rootname, 0,
+						  mctx));
+			if (logreports || dns_name_equal(rad, dns_rootname)) {
+				/* Disable RC for error-logging zones or root */
+				dns_zone_setrad(zone, NULL);
+			} else if (dns_name_equal(rad, zn)) {
+				/*
+				 * It's illegal to set a matching agent
+				 * domain at the zone level, but it could
+				 * be set in options/view. If so, and the
+				 * matching zone doesn't log reports, warn.
+				 */
+				cfg_obj_log(obj, ISC_LOG_WARNING,
+					    "send-report-channel is set to "
+					    "'%s' but that zone does not have "
+					    "log-report-channel set",
+					    zname);
+				dns_zone_setrad(zone, NULL);
+			} else if (dns_name_issubdomain(rad, zn)) {
+				cfg_obj_log(obj, ISC_LOG_WARNING,
+					    "send-report-channel '%s' ignored "
+					    "for zone '%s' because it is a "
+					    "subdomain of the zone",
+					    adstr, zname);
+				dns_zone_setrad(zone, NULL);
+			} else {
+				dns_zone_setrad(zone, rad);
+			}
+		}
 	} else if (ztype == dns_zone_redirect) {
 		dns_zone_setnotifytype(zone, dns_notifytype_no);

@@ -1505,7 +1540,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		} else {
 			uint64_t value = cfg_obj_asuint64(obj);
 			if (value > DNS_JOURNAL_SIZE_MAX) {
-				cfg_obj_log(obj, named_g_lctx, ISC_LOG_ERROR,
+				cfg_obj_log(obj, ISC_LOG_ERROR,
 					    "'max-journal-size "
 					    "%" PRId64 "' "
 					    "is too large",
@@ -1546,7 +1581,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,

 		updateacl = dns_zone_getupdateacl(mayberaw);
 		if (updateacl != NULL && dns_acl_isinsecure(updateacl)) {
-			isc_log_write(named_g_lctx, DNS_LOGCATEGORY_SECURITY,
+			isc_log_write(DNS_LOGCATEGORY_SECURITY,
 				      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
 				      "zone '%s' allows unsigned updates "
 				      "from remote hosts, which is insecure",
@@ -1801,7 +1836,6 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	case dns_zone_secondary:
 	case dns_zone_stub:
 	case dns_zone_redirect:
-		count = 0;
 		obj = NULL;
 		(void)cfg_map_get(zoptions, "primaries", &obj);
 		if (obj == NULL) {
@@ -1829,22 +1863,12 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			dns_zone_setprimaries(mayberaw, ipkl.addrs,
 					      ipkl.sources, ipkl.keys,
 					      ipkl.tlss, ipkl.count);
-			count = ipkl.count;
 			dns_ipkeylist_clear(mctx, &ipkl);
 		} else {
 			dns_zone_setprimaries(mayberaw, NULL, NULL, NULL, NULL,
 					      0);
 		}

-		multi = false;
-		if (count > 1) {
-			obj = NULL;
-			result = named_config_get(maps, "multi-master", &obj);
-			INSIST(result == ISC_R_SUCCESS && obj != NULL);
-			multi = cfg_obj_asboolean(obj);
-		}
-		dns_zone_setoption(mayberaw, DNS_ZONEOPT_MULTIMASTER, multi);
-
 		obj = NULL;
 		result = named_config_get(maps, "max-transfer-time-in", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
@@ -1912,7 +1936,7 @@ cleanup:
 	if (kasp != NULL) {
 		dns_kasp_detach(&kasp);
 	}
-	return (result);
+	return result;
 }

 /*
@@ -1927,11 +1951,11 @@ named_zone_configure_writeable_dlz(dns_dlzdb_t *dlzdatabase, dns_zone_t *zone,
 	dns_zone_settype(zone, dns_zone_dlz);
 	result = dns_sdlz_setdb(dlzdatabase, rdclass, name, &db);
 	if (result != ISC_R_SUCCESS) {
-		return (result);
+		return result;
 	}
 	result = dns_zone_dlzpostload(zone, db);
 	dns_db_detach(&db);
-	return (result);
+	return result;
 }

 bool
@@ -1955,7 +1979,7 @@ named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,
 	if (zonetype_fromconfig(zoptions) == dns_zone_staticstub) {
 		dns_zone_log(zone, ISC_LOG_DEBUG(1),
 			     "not reusable: staticstub");
-		return (false);
+		return false;
 	}

 	/* If there's a raw zone, use that for filename and type comparison */
@@ -1976,17 +2000,17 @@ named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,
 	if (!inline_signing && has_raw) {
 		dns_zone_log(zone, ISC_LOG_DEBUG(1),
 			     "not reusable: old zone was inline-signing");
-		return (false);
+		return false;
 	} else if (inline_signing && !has_raw) {
 		dns_zone_log(zone, ISC_LOG_DEBUG(1),
 			     "not reusable: old zone was not inline-signing");
-		return (false);
+		return false;
 	}

 	if (zonetype_fromconfig(zoptions) != ztype) {
 		dns_zone_log(zone, ISC_LOG_DEBUG(1),
 			     "not reusable: type mismatch");
-		return (false);
+		return false;
 	}

 	obj = NULL;
@@ -2002,10 +2026,10 @@ named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,
 	{
 		dns_zone_log(zone, ISC_LOG_DEBUG(1),
 			     "not reusable: filename mismatch");
-		return (false);
+		return false;
 	}

-	return (true);
+	return true;
 }

 bool
@@ -2039,13 +2063,13 @@ named_zone_inlinesigning(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
 	if (res != ISC_R_SUCCESS ||
 	    strcmp(cfg_obj_asstring(policy), "none") == 0)
 	{
-		return (false);
+		return false;
 	}

 	/* Lookup the policy. */
 	res = dns_kasplist_find(kasplist, cfg_obj_asstring(policy), &kasp);
 	if (res != ISC_R_SUCCESS) {
-		return (false);
+		return false;
 	}

 	inline_signing = dns_kasp_inlinesigning(kasp);
@@ -2058,8 +2082,8 @@ named_zone_inlinesigning(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
 	 */
 	res = cfg_map_get(maps[0], "inline-signing", &signing);
 	if (res == ISC_R_SUCCESS && cfg_obj_isboolean(signing)) {
-		return (cfg_obj_asboolean(signing));
+		return cfg_obj_asboolean(signing);
 	}

-	return (inline_signing);
+	return inline_signing;
 }
@@ -52,7 +52,6 @@
 #include <dns/dispatch.h>
 #include <dns/dnssec.h>
 #include <dns/fixedname.h>
-#include <dns/log.h>
 #include <dns/masterdump.h>
 #include <dns/message.h>
 #include <dns/name.h>
@@ -117,14 +116,12 @@ static bool debugging = false, ddebugging = false;
 static bool memdebugging = false;
 static bool have_ipv4 = false;
 static bool have_ipv6 = false;
-static bool is_dst_up = false;
 static bool use_tls = false;
 static bool usevc = false;
 static bool usegsstsig = false;
 static bool local_only = false;
 static isc_nm_t *netmgr = NULL;
 static isc_loopmgr_t *loopmgr = NULL;
-static isc_log_t *glctx = NULL;
 static isc_mem_t *gmctx = NULL;
 static dns_dispatchmgr_t *dispatchmgr = NULL;
 static dns_requestmgr_t *requestmgr = NULL;
@@ -199,7 +196,7 @@ send_update(dns_name_t *zonename, isc_sockaddr_t *primary);
 static void
 getinput(void *arg);

-noreturn static void
+ISC_NORETURN static void
 fatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);

 static void
@@ -256,7 +253,7 @@ getzoneclass(void) {
 	if (zoneclass == dns_rdataclass_none) {
 		zoneclass = defaultclass;
 	}
-	return (zoneclass);
+	return zoneclass;
 }

 static bool
@@ -266,9 +263,9 @@ setzoneclass(dns_rdataclass_t rdclass) {
 		zoneclass = rdclass;
 	}
 	if (zoneclass != rdclass) {
-		return (false);
+		return false;
 	}
-	return (true);
+	return true;
 }

 static void
@@ -332,7 +329,7 @@ nsu_strsep(char **stringp, const char *delim) {
 	char sc, dc;

 	if (string == NULL) {
-		return (NULL);
+		return NULL;
 	}

 	for (; *string != '\0'; string++) {
@@ -353,11 +350,11 @@ nsu_strsep(char **stringp, const char *delim) {
 			if (sc == dc) {
 				*s++ = '\0';
 				*stringp = s;
-				return (string);
+				return string;
 			}
 		}
 	}
-	return (string);
+	return string;
 }

 static void
@@ -393,7 +390,7 @@ parse_hmac(const char *hmacstr, size_t len, dst_algorithm_t *hmac_alg,

 	if (len >= sizeof(buf)) {
 		error("unknown key type '%.*s'", (int)(len), hmacstr);
-		return (false);
+		return false;
 	}

 	/* Copy len bytes and NUL terminate. */
@@ -406,7 +403,7 @@ parse_hmac(const char *hmacstr, size_t len, dst_algorithm_t *hmac_alg,
 		result = isc_parse_uint16(&digestbits, &buf[9], 10);
 		if (result != ISC_R_SUCCESS || digestbits > 128) {
 			error("digest-bits out of range [0..128]");
-			return (false);
+			return false;
 		}
 		*digestbitsp = (digestbits + 7) & ~0x7U;
 	} else if (strcasecmp(buf, "hmac-sha1") == 0) {
@@ -416,7 +413,7 @@ parse_hmac(const char *hmacstr, size_t len, dst_algorithm_t *hmac_alg,
 		result = isc_parse_uint16(&digestbits, &buf[10], 10);
 		if (result != ISC_R_SUCCESS || digestbits > 160) {
 			error("digest-bits out of range [0..160]");
-			return (false);
+			return false;
 		}
 		*digestbitsp = (digestbits + 7) & ~0x7U;
 	} else if (strcasecmp(buf, "hmac-sha224") == 0) {
@@ -426,7 +423,7 @@ parse_hmac(const char *hmacstr, size_t len, dst_algorithm_t *hmac_alg,
 		result = isc_parse_uint16(&digestbits, &buf[12], 10);
 		if (result != ISC_R_SUCCESS || digestbits > 224) {
 			error("digest-bits out of range [0..224]");
-			return (false);
+			return false;
 		}
 		*digestbitsp = (digestbits + 7) & ~0x7U;
 	} else if (strcasecmp(buf, "hmac-sha256") == 0) {
@@ -436,7 +433,7 @@ parse_hmac(const char *hmacstr, size_t len, dst_algorithm_t *hmac_alg,
 		result = isc_parse_uint16(&digestbits, &buf[12], 10);
 		if (result != ISC_R_SUCCESS || digestbits > 256) {
 			error("digest-bits out of range [0..256]");
-			return (false);
+			return false;
 		}
 		*digestbitsp = (digestbits + 7) & ~0x7U;
 	} else if (strcasecmp(buf, "hmac-sha384") == 0) {
@@ -446,7 +443,7 @@ parse_hmac(const char *hmacstr, size_t len, dst_algorithm_t *hmac_alg,
 		result = isc_parse_uint16(&digestbits, &buf[12], 10);
 		if (result != ISC_R_SUCCESS || digestbits > 384) {
 			error("digest-bits out of range [0..384]");
-			return (false);
+			return false;
 		}
 		*digestbitsp = (digestbits + 7) & ~0x7U;
 	} else if (strcasecmp(buf, "hmac-sha512") == 0) {
@@ -456,14 +453,14 @@ parse_hmac(const char *hmacstr, size_t len, dst_algorithm_t *hmac_alg,
 		result = isc_parse_uint16(&digestbits, &buf[12], 10);
 		if (result != ISC_R_SUCCESS || digestbits > 512) {
 			error("digest-bits out of range [0..512]");
-			return (false);
+			return false;
 		}
 		*digestbitsp = (digestbits + 7) & ~0x7U;
 	} else {
 		error("unknown key type '%s'", buf);
-		return (false);
+		return false;
 	}
-	return (true);
+	return true;
 }

 static int
@@ -477,7 +474,7 @@ basenamelen(const char *file) {
 	} else if (len > 4 && strcmp(file + len - 4, ".key") == 0) {
 		len -= 4;
 	}
-	return (len);
+	return len;
 }

 static void
@@ -560,7 +557,7 @@ failure:
 * Get a key from a named.conf format keyfile
 */
 static isc_result_t
-read_sessionkey(isc_mem_t *mctx, isc_log_t *lctx) {
+read_sessionkey(isc_mem_t *mctx) {
 	cfg_parser_t *pctx = NULL;
 	cfg_obj_t *sessionkey = NULL;
 	const cfg_obj_t *key = NULL;
@@ -573,10 +570,10 @@ read_sessionkey(isc_mem_t *mctx, isc_log_t *lctx) {
 	int len;

 	if (!isc_file_exists(keyfile)) {
-		return (ISC_R_FILENOTFOUND);
+		return ISC_R_FILENOTFOUND;
 	}

-	result = cfg_parser_create(mctx, lctx, &pctx);
+	result = cfg_parser_create(mctx, &pctx);
 	if (result != ISC_R_SUCCESS) {
 		goto cleanup;
 	}
@@ -619,11 +616,11 @@ cleanup:
 		isc_mem_free(mctx, keystr);
 	}

-	return (result);
+	return result;
 }

 static void
-setup_keyfile(isc_mem_t *mctx, isc_log_t *lctx) {
+setup_keyfile(isc_mem_t *mctx) {
 	dst_key_t *dstkey = NULL;
 	isc_result_t result;
 	dst_algorithm_t hmac_alg = DST_ALG_UNKNOWN;
@@ -640,7 +637,7 @@ setup_keyfile(isc_mem_t *mctx, isc_log_t *lctx) {

 	/* If that didn't work, try reading it as a session.key keyfile */
 	if (result != ISC_R_SUCCESS) {
-		result = read_sessionkey(mctx, lctx);
+		result = read_sessionkey(mctx);
 		if (result == ISC_R_SUCCESS) {
 			return;
 		}
@@ -797,8 +794,8 @@ create_name(const char *str, char *namedata, size_t len, dns_name_t *name) {
 	isc_buffer_add(&namesrc, strlen(str));
 	isc_buffer_init(&namebuf, namedata, len);

-	return (dns_name_fromtext(name, &namesrc, dns_rootname,
-				  DNS_NAME_DOWNCASE, &namebuf));
+	return dns_name_fromtext(name, &namesrc, dns_rootname,
+				 DNS_NAME_DOWNCASE, &namebuf);
 }

 static void
@@ -813,15 +810,12 @@ setup_system(void *arg ISC_ATTR_UNUSED) {

 	ddebug("setup_system()");

-	isc_log_create(gmctx, &glctx, &logconfig);
-	isc_log_setcontext(glctx);
-	dns_log_init(glctx);
-	dns_log_setcontext(glctx);
-
-	result = isc_log_usechannel(logconfig, "default_debug", NULL, NULL);
-	check_result(result, "isc_log_usechannel");
-
-	isc_log_setdebuglevel(glctx, logdebuglevel);
+	logconfig = isc_logconfig_get();
+	isc_log_createandusechannel(logconfig, "debug", ISC_LOG_TOFILEDESC,
+				    ISC_LOG_DYNAMIC, ISC_LOGDESTINATION_STDERR,
+				    ISC_LOG_PRINTTIME, ISC_LOGCATEGORY_DEFAULT,
+				    ISC_LOGMODULE_DEFAULT);
+	isc_log_setdebuglevel(logdebuglevel);

 	result = irs_resconf_load(gmctx, resolvconf, &resconf);
 	if (result != ISC_R_SUCCESS && result != ISC_R_FILENOTFOUND) {
@@ -926,10 +920,6 @@ setup_system(void *arg ISC_ATTR_UNUSED) {
 	result = dns_dispatchmgr_create(gmctx, loopmgr, netmgr, &dispatchmgr);
 	check_result(result, "dns_dispatchmgr_create");

-	result = dst_lib_init(gmctx, NULL);
-	check_result(result, "dst_lib_init");
-	is_dst_up = true;
-
 	set_source_ports(dispatchmgr);

 	if (have_ipv6) {
@@ -978,13 +968,13 @@ setup_system(void *arg ISC_ATTR_UNUSED) {
 	if (keystr != NULL) {
 		setup_keystr();
 	} else if (local_only) {
-		result = read_sessionkey(gmctx, glctx);
+		result = read_sessionkey(gmctx);
 		if (result != ISC_R_SUCCESS) {
 			fatal("can't read key from %s: %s\n", keyfile,
 			      isc_result_totext(result));
 		}
 	} else if (keyfile != NULL) {
-		setup_keyfile(gmctx, glctx);
+		setup_keyfile(gmctx);
 	}

 	isc_mutex_init(&answer_lock);
@@ -1003,7 +993,7 @@ get_addresses(char *host, in_port_t port, isc_sockaddr_t *sockaddr,
 		error("couldn't get address for '%s': %s", host,
 		      isc_result_totext(result));
 	}
-	return (count);
+	return count;
 }

 #define PARSE_ARGS_FMT "46A:C:dDE:ghH:iK:lL:MoOk:p:Pr:R:St:Tu:vVy:"
@@ -1313,7 +1303,7 @@ parse_name(char **cmdlinep, dns_message_t *msg, dns_name_t **namep) {
 	word = nsu_strsep(cmdlinep, " \t\r\n");
 	if (word == NULL || *word == 0) {
 		fprintf(stderr, "could not read owner name\n");
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}

 	dns_message_gettempname(msg, namep);
@@ -1324,10 +1314,10 @@ parse_name(char **cmdlinep, dns_message_t *msg, dns_name_t **namep) {
 		error("invalid owner name: %s", isc_result_totext(result));
 		isc_buffer_invalidate(&source);
 		dns_message_puttempname(msg, namep);
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}
 	isc_buffer_invalidate(&source);
-	return (STATUS_MORE);
+	return STATUS_MORE;
 }

 static uint16_t
@@ -1342,7 +1332,7 @@ parse_rdata(char **cmdlinep, dns_rdataclass_t rdataclass,

 	if (cmdline == NULL) {
 		rdata->flags = DNS_RDATA_UPDATE;
-		return (STATUS_MORE);
+		return STATUS_MORE;
 	}

 	while (*cmdline != 0 && isspace((unsigned char)*cmdline)) {
@@ -1373,13 +1363,13 @@ parse_rdata(char **cmdlinep, dns_rdataclass_t rdataclass,
 			fprintf(stderr, "invalid rdata format: %s\n",
 				isc_result_totext(result));
 			isc_buffer_free(&buf);
-			return (STATUS_SYNTAX);
+			return STATUS_SYNTAX;
 		}
 	} else {
 		rdata->flags = DNS_RDATA_UPDATE;
 	}
 	*cmdlinep = cmdline;
-	return (STATUS_MORE);
+	return STATUS_MORE;
 }

 static uint16_t
@@ -1402,7 +1392,7 @@ make_prereq(char *cmdline, bool ispositive, bool isrrset) {
 	 */
 	retval = parse_name(&cmdline, updatemsg, &name);
 	if (retval != STATUS_MORE) {
-		return (retval);
+		return retval;
 	}

 	/*
@@ -1482,13 +1472,13 @@ make_prereq(char *cmdline, bool ispositive, bool isrrset) {
 	ISC_LIST_INIT(name->list);
 	ISC_LIST_APPEND(name->list, rdataset, link);
 	dns_message_addname(updatemsg, name, DNS_SECTION_PREREQUISITE);
-	return (STATUS_MORE);
+	return STATUS_MORE;

 failure:
 	if (name != NULL) {
 		dns_message_puttempname(updatemsg, &name);
 	}
-	return (STATUS_SYNTAX);
+	return STATUS_SYNTAX;
 }

 static uint16_t
@@ -1500,7 +1490,7 @@ evaluate_prereq(char *cmdline) {
 	word = nsu_strsep(&cmdline, " \t\r\n");
 	if (word == NULL || *word == 0) {
 		fprintf(stderr, "could not read operation code\n");
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}
 	if (strcasecmp(word, "nxdomain") == 0) {
 		ispositive = false;
@@ -1516,9 +1506,9 @@ evaluate_prereq(char *cmdline) {
 		isrrset = true;
 	} else {
 		fprintf(stderr, "incorrect operation code: %s\n", word);
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}
-	return (make_prereq(cmdline, ispositive, isrrset));
+	return make_prereq(cmdline, ispositive, isrrset);
 }

 static void
@@ -1564,7 +1554,7 @@ evaluate_lease(char *cmdline) {
 	word = nsu_strsep(&cmdline, " \t\r\n");
 	if (word == NULL || *word == 0) {
 		fprintf(stderr, "could not read ttl\n");
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}

 	if (!strcasecmp(word, "none")) {
@@ -1573,12 +1563,12 @@ evaluate_lease(char *cmdline) {
 		keylease = 0;
 		keylease_set = false;
 		updateopt();
-		return (STATUS_MORE);
+		return STATUS_MORE;
 	}

 	result = isc_parse_uint32(&value1, word, 10);
 	if (result != ISC_R_SUCCESS) {
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}

 	word = nsu_strsep(&cmdline, " \t\r\n");
@@ -1588,12 +1578,12 @@ evaluate_lease(char *cmdline) {
 		keylease = 0;
 		keylease_set = false;
 		updateopt();
-		return (STATUS_MORE);
+		return STATUS_MORE;
 	}

 	result = isc_parse_uint32(&value2, word, 10);
 	if (result != ISC_R_SUCCESS) {
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}

 	lease = value1;
@@ -1602,7 +1592,7 @@ evaluate_lease(char *cmdline) {
 	keylease_set = true;
 	updateopt();

-	return (STATUS_MORE);
+	return STATUS_MORE;
 }

 static uint16_t
@@ -1612,13 +1602,13 @@ evaluate_server(char *cmdline) {

 	if (local_only) {
 		fprintf(stderr, "cannot reset server in localhost-only mode\n");
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}

 	word = nsu_strsep(&cmdline, " \t\r\n");
 	if (word == NULL || *word == 0) {
 		fprintf(stderr, "could not read server name\n");
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}
 	server = word;

@@ -1630,13 +1620,13 @@ evaluate_server(char *cmdline) {
 		port = strtol(word, &endp, 10);
 		if (*endp != 0) {
 			fprintf(stderr, "port '%s' is not numeric\n", word);
-			return (STATUS_SYNTAX);
+			return STATUS_SYNTAX;
 		} else if (port < 1 || port > 65535) {
 			fprintf(stderr,
 				"port '%s' is out of range "
 				"(1 to 65535)\n",
 				word);
-			return (STATUS_SYNTAX);
+			return STATUS_SYNTAX;
 		}
 	}

@@ -1654,10 +1644,10 @@ evaluate_server(char *cmdline) {
 	servers = isc_mem_cget(gmctx, ns_alloc, sizeof(isc_sockaddr_t));
 	ns_total = get_addresses(server, (in_port_t)port, servers, ns_alloc);
 	if (ns_total == 0) {
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}

-	return (STATUS_MORE);
+	return STATUS_MORE;
 }

 static uint16_t
@@ -1670,7 +1660,7 @@ evaluate_local(char *cmdline) {
 	word = nsu_strsep(&cmdline, " \t\r\n");
 	if (word == NULL || *word == 0) {
 		fprintf(stderr, "could not read server name\n");
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}
 	local = word;

@@ -1682,13 +1672,13 @@ evaluate_local(char *cmdline) {
 		port = strtol(word, &endp, 10);
 		if (*endp != 0) {
 			fprintf(stderr, "port '%s' is not numeric\n", word);
-			return (STATUS_SYNTAX);
+			return STATUS_SYNTAX;
 		} else if (port < 1 || port > 65535) {
 			fprintf(stderr,
 				"port '%s' is out of range "
 				"(1 to 65535)\n",
 				word);
-			return (STATUS_SYNTAX);
+			return STATUS_SYNTAX;
 		}
 	}

@@ -1704,10 +1694,10 @@ evaluate_local(char *cmdline) {
 		isc_sockaddr_fromin(localaddr4, &in4, (in_port_t)port);
 	} else {
 		fprintf(stderr, "invalid address %s", local);
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}

-	return (STATUS_MORE);
+	return STATUS_MORE;
 }

 static uint16_t
@@ -1728,7 +1718,7 @@ evaluate_key(char *cmdline) {
 	namestr = nsu_strsep(&cmdline, " \t\r\n");
 	if (namestr == NULL || *namestr == 0) {
 		fprintf(stderr, "could not read key name\n");
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}

 	mykeyname = dns_fixedname_initname(&fkeyname);
@@ -1736,7 +1726,7 @@ evaluate_key(char *cmdline) {
 	n = strchr(namestr, ':');
 	if (n != NULL) {
 		if (!parse_hmac(namestr, n - namestr, &hmac_alg, &digestbits)) {
-			return (STATUS_SYNTAX);
+			return STATUS_SYNTAX;
 		}
 		namestr = n + 1;
 	} else {
@@ -1748,13 +1738,13 @@ evaluate_key(char *cmdline) {
 	result = dns_name_fromtext(mykeyname, &b, dns_rootname, 0, NULL);
 	if (result != ISC_R_SUCCESS) {
 		fprintf(stderr, "could not parse key name\n");
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}

 	secretstr = nsu_strsep(&cmdline, "\r\n");
 	if (secretstr == NULL || *secretstr == 0) {
 		fprintf(stderr, "could not read key secret\n");
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}
 	secretlen = strlen(secretstr) * 3 / 4;
 	secret = isc_mem_allocate(gmctx, secretlen);
@@ -1765,7 +1755,7 @@ evaluate_key(char *cmdline) {
 		fprintf(stderr, "could not create key from %s: %s\n", secretstr,
 			isc_result_totext(result));
 		isc_mem_free(gmctx, secret);
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}
 	secretlen = isc_buffer_usedlength(&secretbuf);

@@ -1778,10 +1768,10 @@ evaluate_key(char *cmdline) {
 	if (result != ISC_R_SUCCESS) {
 		fprintf(stderr, "could not create key from %s %s: %s\n",
 			namestr, secretstr, isc_result_totext(result));
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}
 	dst_key_setbits(tsigkey->key, digestbits);
-	return (STATUS_MORE);
+	return STATUS_MORE;
 }

 static uint16_t
@@ -1793,7 +1783,7 @@ evaluate_zone(char *cmdline) {
 	word = nsu_strsep(&cmdline, " \t\r\n");
 	if (word == NULL || *word == 0) {
 		fprintf(stderr, "could not read zone name\n");
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}

 	userzone = dns_fixedname_initname(&fuserzone);
@@ -1803,10 +1793,10 @@ evaluate_zone(char *cmdline) {
 	if (result != ISC_R_SUCCESS) {
 		userzone = NULL; /* Lest it point to an invalid name */
 		fprintf(stderr, "could not parse zone name\n");
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}

-	return (STATUS_MORE);
+	return STATUS_MORE;
 }

 static uint16_t
@@ -1823,19 +1813,19 @@ evaluate_realm(char *cmdline) {

 	word = nsu_strsep(&cmdline, " \t\r\n");
 	if (word == NULL || *word == 0) {
-		return (STATUS_MORE);
+		return STATUS_MORE;
 	}

 	n = snprintf(buf, sizeof(buf), "@%s", word);
 	if (n < 0 || (size_t)n >= sizeof(buf)) {
 		error("realm is too long");
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}
 	realm = isc_mem_strdup(gmctx, buf);
-	return (STATUS_MORE);
+	return STATUS_MORE;
 #else  /* HAVE_GSSAPI */
 	UNUSED(cmdline);
-	return (STATUS_SYNTAX);
+	return STATUS_SYNTAX;
 #endif /* HAVE_GSSAPI */
 }

@@ -1848,29 +1838,29 @@ evaluate_ttl(char *cmdline) {
 	word = nsu_strsep(&cmdline, " \t\r\n");
 	if (word == NULL || *word == 0) {
 		fprintf(stderr, "could not read ttl\n");
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}

 	if (!strcasecmp(word, "none")) {
 		default_ttl = 0;
 		default_ttl_set = false;
-		return (STATUS_MORE);
+		return STATUS_MORE;
 	}

 	result = isc_parse_uint32(&ttl, word, 10);
 	if (result != ISC_R_SUCCESS) {
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}

 	if (ttl > TTL_MAX) {
 		fprintf(stderr, "ttl '%s' is out of range (0 to %u)\n", word,
 			TTL_MAX);
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}
 	default_ttl = ttl;
 	default_ttl_set = true;

-	return (STATUS_MORE);
+	return STATUS_MORE;
 }

 static uint16_t
@@ -1883,7 +1873,7 @@ evaluate_class(char *cmdline) {
 	word = nsu_strsep(&cmdline, " \t\r\n");
 	if (word == NULL || *word == 0) {
 		fprintf(stderr, "could not read class name\n");
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}

 	r.base = word;
@@ -1891,19 +1881,19 @@ evaluate_class(char *cmdline) {
 	result = dns_rdataclass_fromtext(&rdclass, &r);
 	if (result != ISC_R_SUCCESS) {
 		fprintf(stderr, "could not parse class name: %s\n", word);
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}
 	switch (rdclass) {
 	case dns_rdataclass_none:
 	case dns_rdataclass_any:
 	case dns_rdataclass_reserved0:
 		fprintf(stderr, "bad default class: %s\n", word);
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	default:
 		defaultclass = rdclass;
 	}

-	return (STATUS_MORE);
+	return STATUS_MORE;
 }

 static uint16_t
@@ -1927,7 +1917,7 @@ update_addordelete(char *cmdline, bool isdelete) {
 	 */
 	retval = parse_name(&cmdline, updatemsg, &name);
 	if (retval != STATUS_MORE) {
-		return (retval);
+		return retval;
 	}

 	dns_message_gettemprdata(updatemsg, &rdata);
@@ -2113,14 +2103,14 @@ doneparsing:
 	ISC_LIST_INIT(name->list);
 	ISC_LIST_APPEND(name->list, rdataset, link);
 	dns_message_addname(updatemsg, name, DNS_SECTION_UPDATE);
-	return (STATUS_MORE);
+	return STATUS_MORE;

 failure:
 	if (name != NULL) {
 		dns_message_puttempname(updatemsg, &name);
 	}
 	dns_message_puttemprdata(updatemsg, &rdata);
-	return (STATUS_SYNTAX);
+	return STATUS_SYNTAX;
 }

 static uint16_t
@@ -2132,7 +2122,7 @@ evaluate_update(char *cmdline) {
 	word = nsu_strsep(&cmdline, " \t\r\n");
 	if (word == NULL || *word == 0) {
 		fprintf(stderr, "could not read operation code\n");
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}
 	if (strcasecmp(word, "delete") == 0) {
 		isdelete = true;
@@ -2142,9 +2132,9 @@ evaluate_update(char *cmdline) {
 		isdelete = false;
 	} else {
 		fprintf(stderr, "incorrect operation code: %s\n", word);
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}
-	return (update_addordelete(cmdline, isdelete));
+	return update_addordelete(cmdline, isdelete);
 }

 static uint16_t
@@ -2155,7 +2145,7 @@ evaluate_checknames(char *cmdline) {
 	word = nsu_strsep(&cmdline, " \t\r\n");
 	if (word == NULL || *word == 0) {
 		fprintf(stderr, "could not read check-names directive\n");
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}
 	if (strcasecmp(word, "yes") == 0 || strcasecmp(word, "true") == 0 ||
 	    strcasecmp(word, "on") == 0)
@@ -2168,9 +2158,9 @@ evaluate_checknames(char *cmdline) {
 		checknames = false;
 	} else {
 		fprintf(stderr, "incorrect check-names directive: %s\n", word);
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}
-	return (STATUS_MORE);
+	return STATUS_MORE;
 }

 static uint16_t
@@ -2181,7 +2171,7 @@ evaluate_checksvcb(char *cmdline) {
 	word = nsu_strsep(&cmdline, " \t\r\n");
 	if (word == NULL || *word == 0) {
 		fprintf(stderr, "could not read check-svcb directive\n");
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}
 	if (strcasecmp(word, "yes") == 0 || strcasecmp(word, "true") == 0 ||
 	    strcasecmp(word, "on") == 0)
@@ -2194,9 +2184,9 @@ evaluate_checksvcb(char *cmdline) {
 		checksvcb = false;
 	} else {
 		fprintf(stderr, "incorrect check-svcb directive: %s\n", word);
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}
-	return (STATUS_MORE);
+	return STATUS_MORE;
 }

 static void
@@ -2274,58 +2264,58 @@ do_next_command(char *cmdline) {
 	word = nsu_strsep(&cmdline, " \t\r\n");

 	if (word == NULL || *word == 0) {
-		return (STATUS_SEND);
+		return STATUS_SEND;
 	}
 	if (word[0] == ';') {
-		return (STATUS_MORE);
+		return STATUS_MORE;
 	}
 	if (strcasecmp(word, "quit") == 0) {
-		return (STATUS_QUIT);
+		return STATUS_QUIT;
 	}
 	if (strcasecmp(word, "prereq") == 0) {
-		return (evaluate_prereq(cmdline));
+		return evaluate_prereq(cmdline);
 	}
 	if (strcasecmp(word, "nxdomain") == 0) {
-		return (make_prereq(cmdline, false, false));
+		return make_prereq(cmdline, false, false);
 	}
 	if (strcasecmp(word, "yxdomain") == 0) {
-		return (make_prereq(cmdline, true, false));
+		return make_prereq(cmdline, true, false);
 	}
 	if (strcasecmp(word, "nxrrset") == 0) {
-		return (make_prereq(cmdline, false, true));
+		return make_prereq(cmdline, false, true);
 	}
 	if (strcasecmp(word, "yxrrset") == 0) {
-		return (make_prereq(cmdline, true, true));
+		return make_prereq(cmdline, true, true);
 	}
 	if (strcasecmp(word, "update") == 0) {
-		return (evaluate_update(cmdline));
+		return evaluate_update(cmdline);
 	}
 	if (strcasecmp(word, "delete") == 0) {
-		return (update_addordelete(cmdline, true));
+		return update_addordelete(cmdline, true);
 	}
 	if (strcasecmp(word, "del") == 0) {
-		return (update_addordelete(cmdline, true));
+		return update_addordelete(cmdline, true);
 	}
 	if (strcasecmp(word, "add") == 0) {
-		return (update_addordelete(cmdline, false));
+		return update_addordelete(cmdline, false);
 	}
 	if (strcasecmp(word, "lease") == 0) {
-		return (evaluate_lease(cmdline));
+		return evaluate_lease(cmdline);
 	}
 	if (strcasecmp(word, "server") == 0) {
-		return (evaluate_server(cmdline));
+		return evaluate_server(cmdline);
 	}
 	if (strcasecmp(word, "local") == 0) {
-		return (evaluate_local(cmdline));
+		return evaluate_local(cmdline);
 	}
 	if (strcasecmp(word, "zone") == 0) {
-		return (evaluate_zone(cmdline));
+		return evaluate_zone(cmdline);
 	}
 	if (strcasecmp(word, "class") == 0) {
-		return (evaluate_class(cmdline));
+		return evaluate_class(cmdline);
 	}
 	if (strcasecmp(word, "send") == 0) {
-		return (STATUS_SEND);
+		return STATUS_SEND;
 	}
 	if (strcasecmp(word, "debug") == 0) {
 		if (debugging) {
@@ -2333,14 +2323,14 @@ do_next_command(char *cmdline) {
 		} else {
 			debugging = true;
 		}
-		return (STATUS_MORE);
+		return STATUS_MORE;
 	}
 	if (strcasecmp(word, "ttl") == 0) {
-		return (evaluate_ttl(cmdline));
+		return evaluate_ttl(cmdline);
 	}
 	if (strcasecmp(word, "show") == 0) {
 		show_message(stdout, updatemsg, "Outgoing update query:");
-		return (STATUS_MORE);
+		return STATUS_MORE;
 	}
 	if (strcasecmp(word, "answer") == 0) {
 		LOCK(&answer_lock);
@@ -2348,24 +2338,24 @@ do_next_command(char *cmdline) {
 			show_message(stdout, answer, "Answer:");
 		}
 		UNLOCK(&answer_lock);
-		return (STATUS_MORE);
+		return STATUS_MORE;
 	}
 	if (strcasecmp(word, "key") == 0) {
 		usegsstsig = false;
-		return (evaluate_key(cmdline));
+		return evaluate_key(cmdline);
 	}
 	if (strcasecmp(word, "realm") == 0) {
-		return (evaluate_realm(cmdline));
+		return evaluate_realm(cmdline);
 	}
 	if (strcasecmp(word, "check-names") == 0 ||
 	    strcasecmp(word, "checknames") == 0)
 	{
-		return (evaluate_checknames(cmdline));
+		return evaluate_checknames(cmdline);
 	}
 	if (strcasecmp(word, "check-svcb") == 0 ||
 	    strcasecmp(word, "checksvcb") == 0)
 	{
-		return (evaluate_checksvcb(cmdline));
+		return evaluate_checksvcb(cmdline);
 	}
 	if (strcasecmp(word, "gsstsig") == 0) {
 #if HAVE_GSSAPI
@@ -2373,7 +2363,7 @@ do_next_command(char *cmdline) {
 #else  /* HAVE_GSSAPI */
 		fprintf(stderr, "gsstsig not supported\n");
 #endif /* HAVE_GSSAPI */
-		return (STATUS_MORE);
+		return STATUS_MORE;
 	}
 	if (strcasecmp(word, "oldgsstsig") == 0) {
 #if HAVE_GSSAPI
@@ -2381,7 +2371,7 @@ do_next_command(char *cmdline) {
 #else  /* HAVE_GSSAPI */
 		fprintf(stderr, "gsstsig not supported\n");
 #endif /* HAVE_GSSAPI */
-		return (STATUS_MORE);
+		return STATUS_MORE;
 	}
 	if (strcasecmp(word, "help") == 0) {
 		fprintf(stdout, "nsupdate " PACKAGE_VERSION ":\n"
@@ -2421,14 +2411,14 @@ do_next_command(char *cmdline) {
 				"record to the zone)\n"
 				"[update] del[ete] ....    (remove the given "
 				"record(s) from the zone)\n");
-		return (STATUS_MORE);
+		return STATUS_MORE;
 	}
 	if (strcasecmp(word, "version") == 0) {
 		fprintf(stdout, "nsupdate " PACKAGE_VERSION "\n");
-		return (STATUS_MORE);
+		return STATUS_MORE;
 	}
 	fprintf(stderr, "incorrect section name: %s\n", word);
-	return (STATUS_SYNTAX);
+	return STATUS_SYNTAX;
 }

 static uint16_t
@@ -2460,7 +2450,7 @@ get_next_command(void) {
 		free(ptr);
 	}

-	return (result);
+	return result;
 }

 static bool
@@ -2475,9 +2465,9 @@ user_interaction(void) {
 		}
 	}
 	if (result == STATUS_SEND) {
-		return (true);
+		return true;
 	}
-	return (false);
+	return false;
 }

 static void
@@ -2522,10 +2512,10 @@ next_primary(const char *caller, isc_sockaddr_t *addr, isc_result_t eresult) {
 	fprintf(stderr, "; Communication with %s failed: %s\n", addrbuf,
 		isc_result_totext(eresult));
 	if (++primary_inuse >= primary_total) {
-		return (false);
+		return false;
 	}
 	ddebug("%s: trying next server", caller);
-	return (true);
+	return true;
 }

 static void
@@ -3493,9 +3483,6 @@ cleanup(void) {
 	}
 #endif /* ifdef HAVE_GSSAPI */

-	ddebug("Removing log context");
-	isc_log_destroy(&glctx);
-
 	ddebug("Destroying memory context");
 	if (memdebugging) {
 		isc_mem_stats(gmctx, stderr);
@@ -3503,12 +3490,6 @@ cleanup(void) {

 	isc_mutex_destroy(&answer_lock);

-	if (is_dst_up) {
-		ddebug("Destroy DST lib");
-		dst_lib_destroy();
-		is_dst_up = false;
-	}
-
 	ddebug("Shutting down managers");
 	isc_managers_destroy(&gmctx, &loopmgr, &netmgr);
 }
@@ -3575,8 +3556,8 @@ main(int argc, char **argv) {
 	cleanup();

 	if (seenerror) {
-		return (2);
+		return 2;
 	}

-	return (0);
+	return 0;
 }
@@ -32,7 +32,6 @@
 #include <dns/acl.h>
 #include <dns/db.h>
 #include <dns/enumtype.h>
-#include <dns/log.h>
 #include <dns/message.h>
 #include <dns/rdataset.h>
 #include <dns/types.h>
@@ -44,7 +43,6 @@

 #include <ns/client.h>
 #include <ns/hooks.h>
-#include <ns/log.h>
 #include <ns/query.h>
 #include <ns/types.h>

@@ -179,7 +177,7 @@ static const char *filter_a_enums[] = { "break-dnssec", NULL };

 static isc_result_t
 parse_filter_a(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
-	return (cfg_parse_enum_or_other(pctx, type, &cfg_type_boolean, ret));
+	return cfg_parse_enum_or_other(pctx, type, &cfg_type_boolean, ret);
 }

 static void
@@ -212,7 +210,7 @@ parse_filter_a_on(const cfg_obj_t *param_obj, const char *param_name,

 	result = cfg_map_get(param_obj, param_name, &obj);
 	if (result != ISC_R_SUCCESS) {
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	if (cfg_obj_isboolean(obj)) {
@@ -227,12 +225,11 @@ parse_filter_a_on(const cfg_obj_t *param_obj, const char *param_name,
 		result = ISC_R_UNEXPECTED;
 	}

-	return (result);
+	return result;
 }

 static isc_result_t
-check_syntax(cfg_obj_t *fmap, const void *cfg, isc_mem_t *mctx, isc_log_t *lctx,
-	     void *actx) {
+check_syntax(cfg_obj_t *fmap, const void *cfg, isc_mem_t *mctx, void *actx) {
 	isc_result_t result = ISC_R_SUCCESS;
 	const cfg_obj_t *aclobj = NULL;
 	dns_acl_t *acl = NULL;
@@ -240,23 +237,23 @@ check_syntax(cfg_obj_t *fmap, const void *cfg, isc_mem_t *mctx, isc_log_t *lctx,

 	cfg_map_get(fmap, "filter-a", &aclobj);
 	if (aclobj == NULL) {
-		return (result);
+		return result;
 	}

-	CHECK(cfg_acl_fromconfig(aclobj, (const cfg_obj_t *)cfg, lctx,
+	CHECK(cfg_acl_fromconfig(aclobj, (const cfg_obj_t *)cfg,
 				 (cfg_aclconfctx_t *)actx, mctx, 0, &acl));

 	CHECK(parse_filter_a_on(fmap, "filter-a-on-v6", &f6));
 	CHECK(parse_filter_a_on(fmap, "filter-a-on-v4", &f4));

 	if ((f4 != NONE || f6 != NONE) && dns_acl_isnone(acl)) {
-		cfg_obj_log(aclobj, lctx, ISC_LOG_WARNING,
+		cfg_obj_log(aclobj, ISC_LOG_WARNING,
 			    "\"filter-a\" is 'none;' but "
 			    "either filter-a-on-v6 or filter-a-on-v4 "
 			    "is enabled");
 		result = ISC_R_FAILURE;
 	} else if (f4 == NONE && f6 == NONE && !dns_acl_isnone(acl)) {
-		cfg_obj_log(aclobj, lctx, ISC_LOG_WARNING,
+		cfg_obj_log(aclobj, ISC_LOG_WARNING,
 			    "\"filter-a\" is set but "
 			    "neither filter-a-on-v6 or filter-a-on-v4 "
 			    "is enabled");
@@ -268,34 +265,34 @@ cleanup:
 		dns_acl_detach(&acl);
 	}

-	return (result);
+	return result;
 }

 static isc_result_t
 parse_parameters(filter_instance_t *inst, const char *parameters,
 		 const void *cfg, const char *cfg_file, unsigned long cfg_line,
-		 isc_mem_t *mctx, isc_log_t *lctx, void *actx) {
+		 isc_mem_t *mctx, void *actx) {
 	isc_result_t result = ISC_R_SUCCESS;
 	cfg_parser_t *parser = NULL;
 	cfg_obj_t *param_obj = NULL;
 	const cfg_obj_t *obj = NULL;
 	isc_buffer_t b;

-	CHECK(cfg_parser_create(mctx, lctx, &parser));
+	CHECK(cfg_parser_create(mctx, &parser));

 	isc_buffer_constinit(&b, parameters, strlen(parameters));
 	isc_buffer_add(&b, strlen(parameters));
 	CHECK(cfg_parse_buffer(parser, &b, cfg_file, cfg_line,
 			       &cfg_type_parameters, 0, &param_obj));

-	CHECK(check_syntax(param_obj, cfg, mctx, lctx, actx));
+	CHECK(check_syntax(param_obj, cfg, mctx, actx));

 	CHECK(parse_filter_a_on(param_obj, "filter-a-on-v6", &inst->v6_a));
 	CHECK(parse_filter_a_on(param_obj, "filter-a-on-v4", &inst->v4_a));

 	result = cfg_map_get(param_obj, "filter-a", &obj);
 	if (result == ISC_R_SUCCESS) {
-		CHECK(cfg_acl_fromconfig(obj, (const cfg_obj_t *)cfg, lctx,
+		CHECK(cfg_acl_fromconfig(obj, (const cfg_obj_t *)cfg,
 					 (cfg_aclconfctx_t *)actx, mctx, 0,
 					 &inst->a_acl));
 	} else {
@@ -309,7 +306,7 @@ cleanup:
 	if (parser != NULL) {
 		cfg_parser_destroy(&parser);
 	}
-	return (result);
+	return result;
 }

 /**
@@ -327,13 +324,12 @@ cleanup:
 */
 isc_result_t
 plugin_register(const char *parameters, const void *cfg, const char *cfg_file,
-		unsigned long cfg_line, isc_mem_t *mctx, isc_log_t *lctx,
-		void *actx, ns_hooktable_t *hooktable, void **instp) {
+		unsigned long cfg_line, isc_mem_t *mctx, void *actx,
+		ns_hooktable_t *hooktable, void **instp) {
 	filter_instance_t *inst = NULL;
 	isc_result_t result = ISC_R_SUCCESS;

-	isc_log_write(lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_HOOKS,
-		      ISC_LOG_INFO,
+	isc_log_write(NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_HOOKS, ISC_LOG_INFO,
 		      "registering 'filter-a' "
 		      "module from %s:%lu, %s parameters",
 		      cfg_file, cfg_line, parameters != NULL ? "with" : "no");
@@ -344,7 +340,7 @@ plugin_register(const char *parameters, const void *cfg, const char *cfg_file,

 	if (parameters != NULL) {
 		CHECK(parse_parameters(inst, parameters, cfg, cfg_file,
-				       cfg_line, mctx, lctx, actx));
+				       cfg_line, mctx, actx));
 	}

 	isc_ht_init(&inst->ht, mctx, 1, ISC_HT_CASE_SENSITIVE);
@@ -362,26 +358,25 @@ cleanup:
 		plugin_destroy((void **)&inst);
 	}

-	return (result);
+	return result;
 }

 isc_result_t
 plugin_check(const char *parameters, const void *cfg, const char *cfg_file,
-	     unsigned long cfg_line, isc_mem_t *mctx, isc_log_t *lctx,
-	     void *actx) {
+	     unsigned long cfg_line, isc_mem_t *mctx, void *actx) {
 	isc_result_t result = ISC_R_SUCCESS;
 	cfg_parser_t *parser = NULL;
 	cfg_obj_t *param_obj = NULL;
 	isc_buffer_t b;

-	CHECK(cfg_parser_create(mctx, lctx, &parser));
+	CHECK(cfg_parser_create(mctx, &parser));

 	isc_buffer_constinit(&b, parameters, strlen(parameters));
 	isc_buffer_add(&b, strlen(parameters));
 	CHECK(cfg_parse_buffer(parser, &b, cfg_file, cfg_line,
 			       &cfg_type_parameters, 0, &param_obj));

-	CHECK(check_syntax(param_obj, cfg, mctx, lctx, actx));
+	CHECK(check_syntax(param_obj, cfg, mctx, actx));

 cleanup:
 	if (param_obj != NULL) {
@@ -390,7 +385,7 @@ cleanup:
 	if (parser != NULL) {
 		cfg_parser_destroy(&parser);
 	}
-	return (result);
+	return result;
 }

 /*
@@ -420,7 +415,7 @@ plugin_destroy(void **instp) {
 */
 int
 plugin_version(void) {
-	return (NS_PLUGIN_VERSION);
+	return NS_PLUGIN_VERSION;
 }

 /**
@@ -445,14 +440,14 @@ typedef struct section_filter {
 static bool
 is_v4_client(ns_client_t *client) {
 	if (isc_sockaddr_pf(&client->peeraddr) == AF_INET) {
-		return (true);
+		return true;
 	}
 	if (isc_sockaddr_pf(&client->peeraddr) == AF_INET6 &&
 	    IN6_IS_ADDR_V4MAPPED(&client->peeraddr.type.sin6.sin6_addr))
 	{
-		return (true);
+		return true;
 	}
-	return (false);
+	return false;
 }

 /*
@@ -463,9 +458,9 @@ is_v6_client(ns_client_t *client) {
 	if (isc_sockaddr_pf(&client->peeraddr) == AF_INET6 &&
 	    !IN6_IS_ADDR_V4MAPPED(&client->peeraddr.type.sin6.sin6_addr))
 	{
-		return (true);
+		return true;
 	}
-	return (false);
+	return false;
 }

 static filter_data_t *
@@ -478,7 +473,7 @@ client_state_get(const query_ctx_t *qctx, filter_instance_t *inst) {
 			     sizeof(qctx->client), (void **)&client_state);
 	UNLOCK(&inst->hlock);

-	return (result == ISC_R_SUCCESS ? client_state : NULL);
+	return result == ISC_R_SUCCESS ? client_state : NULL;
 }

 static void
@@ -574,7 +569,7 @@ process_name(query_ctx_t *qctx, filter_a_t mode, const dns_name_t *name,
 	}

 cleanup:
-	return (modified);
+	return modified;
 }

 /*%
@@ -645,7 +640,7 @@ filter_qctx_initialize(void *arg, void *cbdata, isc_result_t *resp) {
 		client_state_create(qctx, inst);
 	}

-	return (NS_HOOK_CONTINUE);
+	return NS_HOOK_CONTINUE;
 }

 /*
@@ -663,7 +658,7 @@ filter_prep_response_begin(void *arg, void *cbdata, isc_result_t *resp) {
 	*resp = ISC_R_UNSET;

 	if (client_state == NULL) {
-		return (NS_HOOK_CONTINUE);
+		return NS_HOOK_CONTINUE;
 	}

 	if (inst->v4_a != NONE || inst->v6_a != NONE) {
@@ -680,7 +675,7 @@ filter_prep_response_begin(void *arg, void *cbdata, isc_result_t *resp) {
 		}
 	}

-	return (NS_HOOK_CONTINUE);
+	return NS_HOOK_CONTINUE;
 }

 /*
@@ -700,7 +695,7 @@ filter_respond_begin(void *arg, void *cbdata, isc_result_t *resp) {
 	*resp = ISC_R_UNSET;

 	if (client_state == NULL) {
-		return (NS_HOOK_CONTINUE);
+		return NS_HOOK_CONTINUE;
 	}

 	if (client_state->mode != BREAK_DNSSEC &&
@@ -708,7 +703,7 @@ filter_respond_begin(void *arg, void *cbdata, isc_result_t *resp) {
 	     (WANTDNSSEC(qctx->client) && qctx->sigrdataset != NULL &&
 	      dns_rdataset_isassociated(qctx->sigrdataset))))
 	{
-		return (NS_HOOK_CONTINUE);
+		return NS_HOOK_CONTINUE;
 	}

 	if (qctx->qtype == dns_rdatatype_a) {
@@ -781,11 +776,11 @@ filter_respond_begin(void *arg, void *cbdata, isc_result_t *resp) {

 		*resp = result;

-		return (NS_HOOK_RETURN);
+		return NS_HOOK_RETURN;
 	}

 	*resp = result;
-	return (NS_HOOK_CONTINUE);
+	return NS_HOOK_CONTINUE;
 }

 /*
@@ -818,7 +813,7 @@ filter_respond_any_found(void *arg, void *cbdata, isc_result_t *resp) {
 		process_section(&filter_answer);
 	}

-	return (NS_HOOK_CONTINUE);
+	return NS_HOOK_CONTINUE;
 }

 /*
@@ -855,7 +850,7 @@ filter_query_done_send(void *arg, void *cbdata, isc_result_t *resp) {
 		}
 	}

-	return (NS_HOOK_CONTINUE);
+	return NS_HOOK_CONTINUE;
 }

 /*
@@ -870,10 +865,10 @@ filter_qctx_destroy(void *arg, void *cbdata, isc_result_t *resp) {
 	*resp = ISC_R_UNSET;

 	if (!qctx->detach_client) {
-		return (NS_HOOK_CONTINUE);
+		return NS_HOOK_CONTINUE;
 	}

 	client_state_destroy(qctx, inst);

-	return (NS_HOOK_CONTINUE);
+	return NS_HOOK_CONTINUE;
 }
@@ -32,7 +32,6 @@
 #include <dns/acl.h>
 #include <dns/db.h>
 #include <dns/enumtype.h>
-#include <dns/log.h>
 #include <dns/message.h>
 #include <dns/rdataset.h>
 #include <dns/types.h>
@@ -44,7 +43,6 @@

 #include <ns/client.h>
 #include <ns/hooks.h>
-#include <ns/log.h>
 #include <ns/query.h>
 #include <ns/types.h>

@@ -179,7 +177,7 @@ static const char *filter_aaaa_enums[] = { "break-dnssec", NULL };

 static isc_result_t
 parse_filter_aaaa(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
-	return (cfg_parse_enum_or_other(pctx, type, &cfg_type_boolean, ret));
+	return cfg_parse_enum_or_other(pctx, type, &cfg_type_boolean, ret);
 }

 static void
@@ -213,7 +211,7 @@ parse_filter_aaaa_on(const cfg_obj_t *param_obj, const char *param_name,

 	result = cfg_map_get(param_obj, param_name, &obj);
 	if (result != ISC_R_SUCCESS) {
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	if (cfg_obj_isboolean(obj)) {
@@ -228,12 +226,11 @@ parse_filter_aaaa_on(const cfg_obj_t *param_obj, const char *param_name,
 		result = ISC_R_UNEXPECTED;
 	}

-	return (result);
+	return result;
 }

 static isc_result_t
-check_syntax(cfg_obj_t *fmap, const void *cfg, isc_mem_t *mctx, isc_log_t *lctx,
-	     void *actx) {
+check_syntax(cfg_obj_t *fmap, const void *cfg, isc_mem_t *mctx, void *actx) {
 	isc_result_t result = ISC_R_SUCCESS;
 	const cfg_obj_t *aclobj = NULL;
 	dns_acl_t *acl = NULL;
@@ -241,23 +238,23 @@ check_syntax(cfg_obj_t *fmap, const void *cfg, isc_mem_t *mctx, isc_log_t *lctx,

 	cfg_map_get(fmap, "filter-aaaa", &aclobj);
 	if (aclobj == NULL) {
-		return (result);
+		return result;
 	}

-	CHECK(cfg_acl_fromconfig(aclobj, (const cfg_obj_t *)cfg, lctx,
+	CHECK(cfg_acl_fromconfig(aclobj, (const cfg_obj_t *)cfg,
 				 (cfg_aclconfctx_t *)actx, mctx, 0, &acl));

 	CHECK(parse_filter_aaaa_on(fmap, "filter-aaaa-on-v4", &f4));
 	CHECK(parse_filter_aaaa_on(fmap, "filter-aaaa-on-v6", &f6));

 	if ((f4 != NONE || f6 != NONE) && dns_acl_isnone(acl)) {
-		cfg_obj_log(aclobj, lctx, ISC_LOG_WARNING,
+		cfg_obj_log(aclobj, ISC_LOG_WARNING,
 			    "\"filter-aaaa\" is 'none;' but "
 			    "either filter-aaaa-on-v4 or filter-aaaa-on-v6 "
 			    "is enabled");
 		result = ISC_R_FAILURE;
 	} else if (f4 == NONE && f6 == NONE && !dns_acl_isnone(acl)) {
-		cfg_obj_log(aclobj, lctx, ISC_LOG_WARNING,
+		cfg_obj_log(aclobj, ISC_LOG_WARNING,
 			    "\"filter-aaaa\" is set but "
 			    "neither filter-aaaa-on-v4 or filter-aaaa-on-v6 "
 			    "is enabled");
@@ -269,27 +266,27 @@ cleanup:
 		dns_acl_detach(&acl);
 	}

-	return (result);
+	return result;
 }

 static isc_result_t
 parse_parameters(filter_instance_t *inst, const char *parameters,
 		 const void *cfg, const char *cfg_file, unsigned long cfg_line,
-		 isc_mem_t *mctx, isc_log_t *lctx, void *actx) {
+		 isc_mem_t *mctx, void *actx) {
 	isc_result_t result = ISC_R_SUCCESS;
 	cfg_parser_t *parser = NULL;
 	cfg_obj_t *param_obj = NULL;
 	const cfg_obj_t *obj = NULL;
 	isc_buffer_t b;

-	CHECK(cfg_parser_create(mctx, lctx, &parser));
+	CHECK(cfg_parser_create(mctx, &parser));

 	isc_buffer_constinit(&b, parameters, strlen(parameters));
 	isc_buffer_add(&b, strlen(parameters));
 	CHECK(cfg_parse_buffer(parser, &b, cfg_file, cfg_line,
 			       &cfg_type_parameters, 0, &param_obj));

-	CHECK(check_syntax(param_obj, cfg, mctx, lctx, actx));
+	CHECK(check_syntax(param_obj, cfg, mctx, actx));

 	CHECK(parse_filter_aaaa_on(param_obj, "filter-aaaa-on-v4",
 				   &inst->v4_aaaa));
@@ -298,7 +295,7 @@ parse_parameters(filter_instance_t *inst, const char *parameters,

 	result = cfg_map_get(param_obj, "filter-aaaa", &obj);
 	if (result == ISC_R_SUCCESS) {
-		CHECK(cfg_acl_fromconfig(obj, (const cfg_obj_t *)cfg, lctx,
+		CHECK(cfg_acl_fromconfig(obj, (const cfg_obj_t *)cfg,
 					 (cfg_aclconfctx_t *)actx, mctx, 0,
 					 &inst->aaaa_acl));
 	} else {
@@ -312,7 +309,7 @@ cleanup:
 	if (parser != NULL) {
 		cfg_parser_destroy(&parser);
 	}
-	return (result);
+	return result;
 }

 /**
@@ -330,13 +327,12 @@ cleanup:
 */
 isc_result_t
 plugin_register(const char *parameters, const void *cfg, const char *cfg_file,
-		unsigned long cfg_line, isc_mem_t *mctx, isc_log_t *lctx,
-		void *actx, ns_hooktable_t *hooktable, void **instp) {
+		unsigned long cfg_line, isc_mem_t *mctx, void *actx,
+		ns_hooktable_t *hooktable, void **instp) {
 	filter_instance_t *inst = NULL;
 	isc_result_t result = ISC_R_SUCCESS;

-	isc_log_write(lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_HOOKS,
-		      ISC_LOG_INFO,
+	isc_log_write(NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_HOOKS, ISC_LOG_INFO,
 		      "registering 'filter-aaaa' "
 		      "module from %s:%lu, %s parameters",
 		      cfg_file, cfg_line, parameters != NULL ? "with" : "no");
@@ -348,7 +344,7 @@ plugin_register(const char *parameters, const void *cfg, const char *cfg_file,

 	if (parameters != NULL) {
 		CHECK(parse_parameters(inst, parameters, cfg, cfg_file,
-				       cfg_line, mctx, lctx, actx));
+				       cfg_line, mctx, actx));
 	}

 	isc_ht_init(&inst->ht, mctx, 1, ISC_HT_CASE_SENSITIVE);
@@ -366,26 +362,25 @@ cleanup:
 		plugin_destroy((void **)&inst);
 	}

-	return (result);
+	return result;
 }

 isc_result_t
 plugin_check(const char *parameters, const void *cfg, const char *cfg_file,
-	     unsigned long cfg_line, isc_mem_t *mctx, isc_log_t *lctx,
-	     void *actx) {
+	     unsigned long cfg_line, isc_mem_t *mctx, void *actx) {
 	isc_result_t result = ISC_R_SUCCESS;
 	cfg_parser_t *parser = NULL;
 	cfg_obj_t *param_obj = NULL;
 	isc_buffer_t b;

-	CHECK(cfg_parser_create(mctx, lctx, &parser));
+	CHECK(cfg_parser_create(mctx, &parser));

 	isc_buffer_constinit(&b, parameters, strlen(parameters));
 	isc_buffer_add(&b, strlen(parameters));
 	CHECK(cfg_parse_buffer(parser, &b, cfg_file, cfg_line,
 			       &cfg_type_parameters, 0, &param_obj));

-	CHECK(check_syntax(param_obj, cfg, mctx, lctx, actx));
+	CHECK(check_syntax(param_obj, cfg, mctx, actx));

 cleanup:
 	if (param_obj != NULL) {
@@ -394,7 +389,7 @@ cleanup:
 	if (parser != NULL) {
 		cfg_parser_destroy(&parser);
 	}
-	return (result);
+	return result;
 }

 /*
@@ -424,7 +419,7 @@ plugin_destroy(void **instp) {
 */
 int
 plugin_version(void) {
-	return (NS_PLUGIN_VERSION);
+	return NS_PLUGIN_VERSION;
 }

 /**
@@ -449,14 +444,14 @@ typedef struct section_filter {
 static bool
 is_v4_client(ns_client_t *client) {
 	if (isc_sockaddr_pf(&client->peeraddr) == AF_INET) {
-		return (true);
+		return true;
 	}
 	if (isc_sockaddr_pf(&client->peeraddr) == AF_INET6 &&
 	    IN6_IS_ADDR_V4MAPPED(&client->peeraddr.type.sin6.sin6_addr))
 	{
-		return (true);
+		return true;
 	}
-	return (false);
+	return false;
 }

 /*
@@ -467,9 +462,9 @@ is_v6_client(ns_client_t *client) {
 	if (isc_sockaddr_pf(&client->peeraddr) == AF_INET6 &&
 	    !IN6_IS_ADDR_V4MAPPED(&client->peeraddr.type.sin6.sin6_addr))
 	{
-		return (true);
+		return true;
 	}
-	return (false);
+	return false;
 }

 static filter_data_t *
@@ -482,7 +477,7 @@ client_state_get(const query_ctx_t *qctx, filter_instance_t *inst) {
 			     sizeof(qctx->client), (void **)&client_state);
 	UNLOCK(&inst->hlock);

-	return (result == ISC_R_SUCCESS ? client_state : NULL);
+	return result == ISC_R_SUCCESS ? client_state : NULL;
 }

 static void
@@ -578,7 +573,7 @@ process_name(query_ctx_t *qctx, filter_aaaa_t mode, const dns_name_t *name,
 	}

 cleanup:
-	return (modified);
+	return modified;
 }

 /*%
@@ -649,7 +644,7 @@ filter_qctx_initialize(void *arg, void *cbdata, isc_result_t *resp) {
 		client_state_create(qctx, inst);
 	}

-	return (NS_HOOK_CONTINUE);
+	return NS_HOOK_CONTINUE;
 }

 /*
@@ -667,7 +662,7 @@ filter_prep_response_begin(void *arg, void *cbdata, isc_result_t *resp) {
 	*resp = ISC_R_UNSET;

 	if (client_state == NULL) {
-		return (NS_HOOK_CONTINUE);
+		return NS_HOOK_CONTINUE;
 	}

 	if (inst->v4_aaaa != NONE || inst->v6_aaaa != NONE) {
@@ -684,7 +679,7 @@ filter_prep_response_begin(void *arg, void *cbdata, isc_result_t *resp) {
 		}
 	}

-	return (NS_HOOK_CONTINUE);
+	return NS_HOOK_CONTINUE;
 }

 /*
@@ -704,7 +699,7 @@ filter_respond_begin(void *arg, void *cbdata, isc_result_t *resp) {
 	*resp = ISC_R_UNSET;

 	if (client_state == NULL) {
-		return (NS_HOOK_CONTINUE);
+		return NS_HOOK_CONTINUE;
 	}

 	if (client_state->mode != BREAK_DNSSEC &&
@@ -712,7 +707,7 @@ filter_respond_begin(void *arg, void *cbdata, isc_result_t *resp) {
 	     (WANTDNSSEC(qctx->client) && qctx->sigrdataset != NULL &&
 	      dns_rdataset_isassociated(qctx->sigrdataset))))
 	{
-		return (NS_HOOK_CONTINUE);
+		return NS_HOOK_CONTINUE;
 	}

 	if (qctx->qtype == dns_rdatatype_aaaa) {
@@ -784,11 +779,11 @@ filter_respond_begin(void *arg, void *cbdata, isc_result_t *resp) {

 		*resp = result;

-		return (NS_HOOK_RETURN);
+		return NS_HOOK_RETURN;
 	}

 	*resp = result;
-	return (NS_HOOK_CONTINUE);
+	return NS_HOOK_CONTINUE;
 }

 /*
@@ -821,7 +816,7 @@ filter_respond_any_found(void *arg, void *cbdata, isc_result_t *resp) {
 		process_section(&filter_answer);
 	}

-	return (NS_HOOK_CONTINUE);
+	return NS_HOOK_CONTINUE;
 }

 /*
@@ -858,7 +853,7 @@ filter_query_done_send(void *arg, void *cbdata, isc_result_t *resp) {
 		}
 	}

-	return (NS_HOOK_CONTINUE);
+	return NS_HOOK_CONTINUE;
 }

 /*
@@ -873,10 +868,10 @@ filter_qctx_destroy(void *arg, void *cbdata, isc_result_t *resp) {
 	*resp = ISC_R_UNSET;

 	if (!qctx->detach_client) {
-		return (NS_HOOK_CONTINUE);
+		return NS_HOOK_CONTINUE;
 	}

 	client_state_destroy(qctx, inst);

-	return (NS_HOOK_CONTINUE);
+	return NS_HOOK_CONTINUE;
 }
@@ -87,7 +87,7 @@ static int32_t timeout = RNDC_TIMEOUT;
 static void
 rndc_startconnect(isc_sockaddr_t *addr);

-noreturn static void
+ISC_NORETURN static void
 usage(int status);

 static void
@@ -132,6 +132,9 @@ command is one of the following:\n\
  halt		Stop the server without saving pending updates.\n\
  halt -p	Stop the server without saving pending updates reporting\n\
 		process id.\n\
+  skr -import file zone [class [view]]\n\
+		Import a SKR file for the specified zone, for offline KSK\n\
+		signing.\n\
  loadkeys zone [class [view]]\n\
 		Update keys without signing immediately.\n\
  managed-keys refresh [class [view]]\n\
@@ -526,8 +529,8 @@ rndc_start(void *arg) {
 }

 static void
-parse_config(isc_mem_t *mctx, isc_log_t *log, const char *keyname,
-	     cfg_parser_t **pctxp, cfg_obj_t **configp) {
+parse_config(isc_mem_t *mctx, const char *keyname, cfg_parser_t **pctxp,
+	     cfg_obj_t **configp) {
 	isc_result_t result;
 	const char *conffile = admin_conffile;
 	const cfg_obj_t *addresses = NULL;
@@ -570,7 +573,7 @@ parse_config(isc_mem_t *mctx, isc_log_t *log, const char *keyname,
 			admin_keyfile, admin_conffile);
 	}

-	DO("create parser", cfg_parser_create(mctx, log, pctxp));
+	DO("create parser", cfg_parser_create(mctx, pctxp));

 	/*
 	 * The parser will output its own errors, so DO() is not used.
@@ -806,9 +809,7 @@ int
 main(int argc, char **argv) {
 	isc_result_t result = ISC_R_SUCCESS;
 	bool show_final_mem = false;
-	isc_log_t *log = NULL;
 	isc_logconfig_t *logconfig = NULL;
-	isc_logdestination_t logdest;
 	cfg_parser_t *pctx = NULL;
 	cfg_obj_t *config = NULL;
 	const char *keyname = NULL;
@@ -954,20 +955,15 @@ main(int argc, char **argv) {

 	isc_nm_settimeouts(netmgr, timeout, timeout, timeout, 0);

-	isc_log_create(rndc_mctx, &log, &logconfig);
-	isc_log_setcontext(log);
+	logconfig = isc_logconfig_get();
 	isc_log_settag(logconfig, progname);
-	logdest.file.stream = stderr;
-	logdest.file.name = NULL;
-	logdest.file.versions = ISC_LOG_ROLLNEVER;
-	logdest.file.maximum_size = 0;
-	isc_log_createchannel(logconfig, "stderr", ISC_LOG_TOFILEDESC,
-			      ISC_LOG_INFO, &logdest,
-			      ISC_LOG_PRINTTAG | ISC_LOG_PRINTLEVEL);
-	DO("enabling log channel",
-	   isc_log_usechannel(logconfig, "stderr", NULL, NULL));
+	isc_log_createandusechannel(
+		logconfig, "default_stderr", ISC_LOG_TOFILEDESC, ISC_LOG_INFO,
+		ISC_LOGDESTINATION_STDERR,
+		ISC_LOG_PRINTTAG | ISC_LOG_PRINTLEVEL, ISC_LOGCATEGORY_DEFAULT,
+		ISC_LOGMODULE_DEFAULT);

-	parse_config(rndc_mctx, log, keyname, &pctx, &config);
+	parse_config(rndc_mctx, keyname, &pctx, &config);

 	isc_buffer_allocate(rndc_mctx, &databuf, 2048);

@@ -1003,9 +999,6 @@ main(int argc, char **argv) {

 	isccc_ccmsg_invalidate(&rndc_ccmsg);

-	isc_log_destroy(&log);
-	isc_log_setcontext(NULL);
-
 	cfg_obj_destroy(pctx, &config);
 	cfg_parser_destroy(&pctx);

@@ -1020,8 +1013,8 @@ main(int argc, char **argv) {
 	isc_managers_destroy(&rndc_mctx, &loopmgr, &netmgr);

 	if (failed) {
-		return (1);
+		return 1;
 	}

-	return (0);
+	return 0;
 }
@@ -152,6 +152,15 @@ Currently supported commands are:

   See also :option:`rndc delzone` and :option:`rndc modzone`.

+.. option:: closelogs
+
+   This command closes currently open log files.  It is intended to be used
+   by external log rotation tools following this proceedure.
+
+   1) rename the log files
+   2) run ``rndc closelogs``
+   3) optionally compress the log files
+
 .. option:: delzone [-clean] zone [class [view]]

   This command deletes a zone while the server is running.
@@ -257,6 +266,11 @@ Currently supported commands are:

   See also :option:`rndc stop`.

+.. option:: skr -import file zone [class [view]]
+
+   This command allows you to import a SKR file for the specified zone, to
+   support offline KSK signing.
+
 .. option:: loadkeys [zone [class [view]]]

   This command fetches all DNSSEC keys for the given zone from the key directory. If
@@ -415,8 +429,10 @@ Currently supported commands are:

   The first list includes all unique clients that are waiting for
   recursion to complete, including the query that is awaiting a
-   response and the timestamp (seconds since the Unix epoch) of
-   when named started processing this client query.
+   response, the timestamp (seconds since the Unix epoch) of
+   when named started processing this client query, the client's
+   address, and the transport over which the the query was received
+   (UDP, TCP, TLS, or HTTP).

   The second list comprises of domains for which there are active
   (or recently active) fetches in progress.  It reports the number
@@ -444,14 +460,27 @@ Currently supported commands are:

 .. program:: rndc

-.. option:: retransfer zone [class [view]]
+.. option:: responselog [on | off]
+
+   This command enables or disables response logging. For backward compatibility,
+   this command can also be used without an argument to toggle response logging
+   on and off.
+
+   Unlike query logging, response logging cannot be enabled by explicitly directing
+   the ``responses`` ``category`` to a ``channel`` in the ``logging`` section
+   of :iscman:`named.conf`, but it can still be enabled by specifying
+   ``responselog yes;`` in the ``options`` section of :iscman:`named.conf`.
+
+.. option:: retransfer [-force] zone [class [view]]

   This command retransfers the given secondary zone from the primary server.

   If the zone is configured to use ``inline-signing``, the signed
   version of the zone is discarded; after the retransfer of the
   unsigned version is complete, the signed version is regenerated
-   with new signatures.
+   with new signatures. With the optional ``-force`` argument provided
+   if there is an ongoing zone transfer it will be aborted before a new zone
+   transfer is scheduled.

 .. option:: scan

@@ -462,9 +491,8 @@ Currently supported commands are:
 .. option:: secroots [-] [view ...]

   This command dumps the security roots (i.e., trust anchors configured via
-   ``trust-anchors``, or the ``managed-keys`` or ``trusted-keys`` statements
-   [both deprecated], or ``dnssec-validation auto``) and negative trust anchors
-   for the specified views. If no view is specified, all views are
+   ``trust-anchors`` statement, or ``dnssec-validation auto``) and negative
+   trust anchors for the specified views. If no view is specified, all views are
   dumped. Security roots indicate whether they are configured as trusted
   keys, managed keys, or initializing managed keys (managed keys that have not
   yet been updated by a successful key refresh query).
@@ -36,7 +36,7 @@ ISC_LANG_BEGINDECLS
 void
 notify(const char *fmt, ...) ISC_FORMAT_PRINTF(1, 2);

-noreturn void
+ISC_NORETURN void
 fatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);

 ISC_LANG_ENDDECLS
@@ -1,4 +1,4 @@
-#!/usr/bin/env python
+#!/usr/bin/env python3
 #
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
@@ -9,12 +9,14 @@ named.lock
 named.pid
 named.run
 /feature-test
+/legacy.run.sh
 /makejournal
 /random.data
 /*.log
 /*.trs
 /*.xml
 /resolve
+/legacy.run.sh
 /run.log
 /start.sh
 /stop.sh
@@ -11,10 +11,6 @@ dist-hook:

 SUBDIRS = dyndb/driver dlzexternal/driver hooks/driver

-if DNSRPS
-SUBDIRS += rpz/testlib
-endif
-
 AM_CPPFLAGS +=			\
 	$(LIBISC_CFLAGS) 	\
 	$(LIBDNS_CFLAGS)
@@ -31,8 +27,7 @@ noinst_PROGRAMS =		\
 	feature-test		\
 	makejournal		\
 	pipelined/pipequeries	\
-	rndc/gencheck		\
-	rpz/dnsrps
+	rndc/gencheck

 feature_test_CPPFLAGS =		\
 	$(AM_CPPFLAGS)		\
@@ -60,16 +55,6 @@ pipelined_pipequeries_LDADD =	\
 	$(LDADD)		\
 	$(LIBDNS_LIBS)

-rpz_dnsrps_CPPFLAGS =		\
-	$(AM_CPPFLAGS)		\
-	$(LIBDNS_CFLAGS)	\
-	-DLIBRPZ_LIB_OPEN=\"$(abs_builddir)/rpz/testlib/.libs/libdummyrpz.so\"
-
-rpz_dnsrps_LDADD =		\
-	$(LDADD)		\
-	$(LIBDNS_LIBS)		\
-	$(DLOPEN_LIBS)
-
 # Longer running tests are listed (and executed) first to take the most
 # advantage of parallel execution.
 TESTS =				\
@@ -86,6 +71,7 @@ TESTS =				\
 	autosign		\
 	builtin			\
 	cacheclean		\
+	camp			\
 	case			\
 	catz			\
 	cds			\
@@ -95,8 +81,8 @@ TESTS =				\
 	checknames		\
 	checkzone		\
 	cookie			\
+	cpu			\
 	database		\
-	dialup			\
 	digdelv			\
 	dispatch		\
 	dlzexternal		\
@@ -149,6 +135,7 @@ TESTS =				\
 	proxy			\
 	pipelined		\
 	qmin			\
+	query-source		\
 	reclimit		\
 	redirect		\
 	resolver		\
@@ -51,6 +51,7 @@ To run system tests, make sure you have the following dependencies installed:
 - perl
 - dnspython
 - pytest-xdist (for parallel execution)
+- python-jinja2 (for tests which use jinja templates)

 Individual system tests might also require additional dependencies. If those
 are missing, the affected tests will be skipped and should produce a message
@@ -154,9 +155,17 @@ system test directories may contain the following standard files:
 - `tests_*.py`: These python files are picked up by pytest as modules. If they
  contain any test functions, they're added to the test suite.

- `setup.sh`: This sets up the preconditions for the tests. Although optional,
-  virtually all tests will require such a file to set up the ports they should
-  use for the test.
+- `*.j2`: These jinja2 templates can be used for configuration files or any
+  other files which require certain variables filled in, e.g. ports from the
+  environment variables. During test setup, the pytest runner will automatically
+  fill those in and strip the filename extension .j2, e.g. `ns1/named.conf.j2`
+  becomes `ns1/named.conf`. When using advanced templating to conditionally
+  include/omit entire sections or when filling in custom variables used for the
+  test, ensure the templates always include the defaults. If you don't need the
+  file to be auto-templated during test setup, use `.j2.manual` instead and then
+  no defaults are needed.
+
+- `setup.sh`: This sets up the preconditions for the tests.

 - `tests.sh`: Any shell-based tests are located within this file. Runs the
  actual tests.
@@ -19,3 +19,9 @@ key rndc_key {
 	algorithm       hmac-sha256;
 	secret          "1234abcd8765";
 };
+
+/* Regresssion test for [GL #4991] */
+server example.com {
+	key rndc-key;
+	addresses { localhost; 127.0.0.1; ::1; };
+};
@@ -1,25 +0,0 @@
-#!/bin/sh
-
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# SPDX-License-Identifier: MPL-2.0
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0.  If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-#
-# Clean up after zone transfer tests.
-#
-
-rm -f dig.out.*
-rm -f ns2/example.db ns2/tsigzone.db ns2/example.db.jnl
-rm -f */named.conf
-rm -f */named.memstats
-rm -f */named.run
-rm -f ns*/_default.nzf
-rm -f ns*/_default.nzd*
-rm -f ns*/managed-keys.bind* ns*/*.mkeys*
@@ -13,7 +13,6 @@

 . ../conf.sh

-$SHELL clean.sh
 $SHELL ${TOP_SRCDIR}/bin/tests/system/genzone.sh 2 3 >ns2/example.db
 $SHELL ${TOP_SRCDIR}/bin/tests/system/genzone.sh 2 3 >ns2/tsigzone.db
 copy_setports ns2/named1.conf.in ns2/named.conf
@@ -9,6 +9,18 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

+import pytest
+
+pytestmark = pytest.mark.extra_artifacts(
+    [
+        "dig.out*",
+        "ns*/_default.nzd*",
+        "ns*/_default.nzf*",
+        "ns2/example.db",
+        "ns2/tsigzone.db",
+    ]
+)
+

 def test_acl(run_tests_sh):
    run_tests_sh()
@@ -1,22 +0,0 @@
-#!/bin/sh
-
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# SPDX-License-Identifier: MPL-2.0
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0.  If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-#
-# Clean up after tests.
-#
-
-rm -f dig.out.*
-rm -f */named.memstats
-rm -f */named.conf
-rm -f */named.run
-rm -f ns*/managed-keys.bind*
@@ -13,7 +13,6 @@

 . ../conf.sh

-$SHELL clean.sh
 copy_setports ns1/named1.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
@@ -9,6 +9,14 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

+import pytest
+
+pytestmark = pytest.mark.extra_artifacts(
+    [
+        "dig.out.*",
+    ]
+)
+

 def test_additional(run_tests_sh):
    run_tests_sh()
@@ -1,43 +0,0 @@
-#!/bin/sh
-
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# SPDX-License-Identifier: MPL-2.0
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0.  If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-rm -f ./dig.out.*
-rm -f ./rndc.out*
-rm -f ./showzone.out*
-rm -f ./zonestatus.out*
-rm -f ./*/named.conf
-rm -f ./*/named.memstats
-rm -f ./ns1/*.nzf ./ns1/*.nzf~
-rm -f ./ns1/*.nzd ./ns1/*.nzd-lock
-rm -f ./ns2/*.nzf ./ns2/*.nzf~
-rm -f ./ns2/*.nzd ./ns2/*.nzd-lock
-rm -f ./ns3/*.nzf ./ns3/*.nzf~
-rm -f ./ns3/*.nzd ./ns3/*.nzd-lock
-rm -f ./ns2/core*
-rm -f ./ns2/inline.db.jbk
-rm -f ./ns2/inline.db.signed
-rm -f ./ns2/inlinesec.bk*
-rm -rf ./ns2/new-zones
-rm -f ./ns*/named.run ./ns*/named.run.prev
-rm -f ./ns2/nzf-*
-rm -f ./ns3/named.conf
-rm -f ./ns3/*.nzf ./ns3/*.nzf~
-rm -f ./ns3/*.nzd ns3/*.nzd-lock
-rm -f ./ns3/inlinesec.db
-rm -f ./ns1/redirect.db
-rm -f ./ns2/redirect.db
-rm -f ./ns2/redirect.bk
-rm -f ./ns3/redirect.db
-rm -f ./ns*/managed-keys.bind* ns*/*.mkeys*
-rm -f ./nzd2nzf.out.*
-rm -f ./wait_for_message.*
--- a/Show More
+++ b/Show More