Update release.md

2019-08-29 19:57:45 -04:00
966 changed files with 23248 additions and 42603 deletions
@@ -15,6 +15,9 @@
 	       (expand-file-name
 		(concat directory-of-current-dir-locals-file "./"))
 	       ;; current directory
 	       (expand-file-name (concat default-directory "./"))
 	       ;; libisc
 	       (expand-file-name
 		(concat directory-of-current-dir-locals-file "lib/isc/unix/include"))
@@ -22,16 +25,11 @@
 		(concat directory-of-current-dir-locals-file "lib/isc/pthreads/include"))
 	       (expand-file-name
 		(concat directory-of-current-dir-locals-file "lib/isc/include"))
 	       (expand-file-name
 		(concat directory-of-current-dir-locals-file "lib/isc"))
 	       (expand-file-name
 		(concat directory-of-current-dir-locals-file "lib/isc/netmgr"))
 	       ;; libdns
 	       (expand-file-name
 		(concat directory-of-current-dir-locals-file "lib/dns/include"))
 	       (expand-file-name
 		(concat directory-of-current-dir-locals-file "lib/dns"))
 	       ;; libisccc
 	       (expand-file-name
@@ -53,30 +51,6 @@
 	       (expand-file-name
 		(concat directory-of-current-dir-locals-file "lib/bind9/include"))
 	       ;; bin
 	       (expand-file-name
 		(concat directory-of-current-dir-locals-file "bin/check"))
 	       (expand-file-name
 		(concat directory-of-current-dir-locals-file "bin/confgen/include"))
 	       (expand-file-name
 		(concat directory-of-current-dir-locals-file "bin/confgen"))
 	       (expand-file-name
 		(concat directory-of-current-dir-locals-file "bin/confgen/include"))	       
 	       (expand-file-name
 		(concat directory-of-current-dir-locals-file "bin/dig/include"))
 	       (expand-file-name
 		(concat directory-of-current-dir-locals-file "bin/named/include"))
 	       (expand-file-name
 		(concat directory-of-current-dir-locals-file "bin/named/unix/include"))
 	       (expand-file-name
 		(concat directory-of-current-dir-locals-file "bin/rndc/include"))
 	       (expand-file-name
 		(concat directory-of-current-dir-locals-file "bin/dnssec/include"))
 	       (expand-file-name
 		(concat directory-of-current-dir-locals-file "bin/named/include"))
 	       (expand-file-name
 		(concat directory-of-current-dir-locals-file "bin/rndc/include"))
 	       (expand-file-name "/usr/local/opt/openssl@1.1/include")
 	       (expand-file-name "/usr/local/opt/libxml2/include/libxml2")
 	       (expand-file-name "/usr/local/opt/json-c/include/json-c/")
@@ -1,10 +1,2 @@
 *.sln.in eol=crlf
 *.vcxproj.* eol=crlf
 .gitignore			 export-ignore
 /conftools			 export-ignore
 /doc/design			 export-ignore
 /doc/dev			 export-ignore
 /util/**			 export-ignore
 /util/bindkeys.pl		-export-ignore
 /util/mksymtbl.pl		-export-ignore
@@ -10,7 +10,6 @@
 *.rej
 *.so
 *_test
 *.ipch # vscode/intellisense precompiled header
 *~
 .ccache/
 .cproject
@@ -57,7 +56,3 @@ kyua.log
 named.memstats
 named.run
 timestamp
 /compile_commands.json
 /cppcheck_html/
 /cppcheck.results
 /tsan
@@ -11,24 +11,9 @@ variables:
  # VirtualBox driver needs to set build_dir to "/builds" in gitlab-runner.toml
  KYUA_RESULT: "$CI_PROJECT_DIR/kyua.results"
  GIT_DEPTH: 1
  BUILD_PARALLEL_JOBS: 6
  TEST_PARALLEL_JOBS: 6
  MAKE: make
  CONFIGURE: ./configure
  SCAN_BUILD: scan-build-9
  SYMBOLIZER: /usr/lib/llvm-9/bin/llvm-symbolizer
  ASAN_SYMBOLIZER_PATH: "$SYMBOLIZER"
  CFLAGS_COMMON: -fno-omit-frame-pointer -fno-optimize-sibling-calls -O1 -g -Wall -Wextra 
  # Pass run-time flags to AddressSanitizer to get core dumps on error.
  ASAN_OPTIONS_COMMON: abort_on_error=1:disable_coredump=0:unmap_shadow_on_exit=1
  TARBALL_COMPRESSOR: xz
  TARBALL_EXTENSION: xz
 stages:
  - precheck
  - build
@@ -36,18 +21,9 @@ stages:
  - system
  - docs
  - push
  - postcheck
  - release
 ### Runner Tag Templates
 # Note: BSD runners extract the operating system version to use from job name
 .freebsd-amd64: &freebsd_amd64
  tags:
    - freebsd
    - amd64
 .linux-amd64: &linux_amd64
  tags:
    - linux
@@ -58,17 +34,12 @@ stages:
    - linux
    - i386
 .openbsd-amd64: &openbsd_amd64
  tags:
    - openbsd
    - amd64
 ### Docker Image Templates
 # Alpine Linux
-.alpine-3.11-amd64: &alpine_3_11_amd64_image
+.alpine-3.10-amd64: &alpine_3_10_amd64_image
-  image: "$CI_REGISTRY_IMAGE:alpine-3.11-amd64"
+  image: "$CI_REGISTRY_IMAGE:alpine-3.10-amd64"
  <<: *linux_amd64
 # CentOS
@@ -81,10 +52,6 @@ stages:
  image: "$CI_REGISTRY_IMAGE:centos-centos7-amd64"
  <<: *linux_amd64
 .centos-centos8-amd64: &centos_centos8_amd64_image
  image: "$CI_REGISTRY_IMAGE:centos-centos8-amd64"
  <<: *linux_amd64
 # Debian
 .debian-jessie-amd64: &debian_jessie_amd64_image
@@ -101,7 +68,7 @@ stages:
 .debian-buster-amd64: &debian_buster_amd64_image
  image: "$CI_REGISTRY_IMAGE:debian-buster-amd64"
-  <<: *linux_amd64
+  <<: *linux_i386
 .debian-sid-amd64: &debian_sid_amd64_image
  image: "$CI_REGISTRY_IMAGE:debian-sid-amd64"
@@ -111,16 +78,10 @@ stages:
  image: "$CI_REGISTRY_IMAGE:debian-sid-i386"
  <<: *linux_i386
 # openSUSE Tumbleweed
 .tumbleweed-latest-amd64: &tumbleweed_latest_amd64_image
  image: "$CI_REGISTRY_IMAGE:tumbleweed-latest-amd64"
  <<: *linux_amd64
 # Fedora
-.fedora-31-amd64: &fedora_31_amd64_image
+.fedora-30-amd64: &fedora_30_amd64_image
-  image: "$CI_REGISTRY_IMAGE:fedora-31-amd64"
+  image: "$CI_REGISTRY_IMAGE:fedora-30-amd64"
  <<: *linux_amd64
 # Ubuntu
@@ -148,16 +109,6 @@ stages:
    - merge_requests
    - tags
    - web
    - schedules
 .release-branch-triggering-rules: &release_branch_triggering_rules
  only:
    - merge_requests
    - tags
    - web
    - schedules
    - master@isc-projects/bind9
    - /^v9_[1-9][0-9]$/@isc-projects/bind9
 .precheck: &precheck_job
  <<: *default_triggering_rules
@@ -165,21 +116,17 @@ stages:
  stage: precheck
 .autoconf: &autoconf_job
-  <<: *release_branch_triggering_rules
+  <<: *default_triggering_rules
  <<: *debian_sid_amd64_image
  stage: precheck
  script:
    - autoreconf -fi
  artifacts:
-    paths:
+    untracked: true
-      - aclocal.m4
+    expire_in: "1 hour"
      - configure
      - ltmain.sh
      - m4/libtool.m4
    expire_in: "1 week"
 .configure: &configure |
-    ${CONFIGURE} \
+    ./configure \
    --disable-maintainer-mode \
    --enable-developer \
    --with-libtool \
@@ -191,16 +138,15 @@ stages:
    --without-make-clean \
    $EXTRA_CONFIGURE \
    || cat config.log
-
+    
 .build: &build_job
  <<: *default_triggering_rules
  stage: build
  before_script:
    - test -w "${CCACHE_DIR}" && export PATH="/usr/lib/ccache:${PATH}"
    - test -n "${OOT_BUILD_WORKSPACE}" && mkdir "${OOT_BUILD_WORKSPACE}" && cd "${OOT_BUILD_WORKSPACE}"
  script:
    - *configure
-    - ${MAKE} -j${BUILD_PARALLEL_JOBS:-1} -k all V=1
+    - make -j${BUILD_PARALLEL_JOBS:-1} -k all V=1
    - test -z "${RUN_MAKE_INSTALL}" || make install
  dependencies:
    - autoreconf:sid:amd64
@@ -208,37 +154,7 @@ stages:
    - autoreconf:sid:amd64
  artifacts:
    untracked: true
-    expire_in: "1 week"
+    expire_in: "1 hour"
 .windows_build: &windows_build_job
  stage: build
  tags:
    - windows
    - amd64
  script:
    - 'Push-Location "C:/Program Files (x86)/Microsoft Visual Studio/2017/BuildTools/VC/Auxiliary/Build"'
    - '& cmd.exe /C "vcvarsall.bat x64 & set" | Foreach-Object { if ($_ -match "(.*?)=(.*)") { Set-Item -force -path "Env:\$($matches[1])" -value "$($matches[2])" } }'
    - 'Pop-Location'
    - 'Set-Location win32utils'
    - '& "C:/Strawberry/perl/bin/perl.exe" Configure
         "with-tools-version=15.0"
         "with-platform-toolset=v141"
         "with-platform-version=10.0.17763.0"
         "with-vcredist=C:/Program Files (x86)/Microsoft Visual Studio/2017/BuildTools/VC/Redist/MSVC/14.16.27012/vcredist_x64.exe"
         "with-openssl=C:/OpenSSL"
         "with-libxml2=C:/libxml2"
         "with-libuv=C:/libuv"
         "without-python"
         "with-system-tests"
         x64'
    - 'Set-Item -path "Env:CL" -value "/MP$([Math]::Truncate($BUILD_PARALLEL_JOBS/2))"'
    - '& msbuild.exe /maxCpuCount:2 /t:Build /p:Configuration=$VSCONF bind9.sln'
  dependencies: []
  needs:
    - autoreconf:sid:amd64
  artifacts:
    untracked: true
    expire_in: "1 week"
 .setup_interfaces: &setup_interfaces |
    if [ "$(id -u)" -eq "0" ]; then
@@ -248,16 +164,17 @@ stages:
    fi
 .setup_softhsm: &setup_softhsm |
-    sh -x bin/tests/prepare-softhsm2.sh
+    sh -x util/prepare-softhsm2.sh
 .system_test: &system_test_job
  <<: *default_triggering_rules
  stage: system
  retry: 2
  before_script:
    - *setup_interfaces
    - *setup_softhsm
  script:
-    - ( cd bin/tests/system && make -j${TEST_PARALLEL_JOBS:-1} -k test V=1 )
+    - ( cd bin/tests && make -j${TEST_PARALLEL_JOBS:-1} -k test V=1 )
    - test -s bin/tests/system/systests.output
  artifacts:
    untracked: true
@@ -265,36 +182,12 @@ stages:
    when: on_failure
 .kyua_report: &kyua_report_html |
-  kyua --logfile /dev/null report-html \
+  kyua report-html \
       --force \
       --results-file "$KYUA_RESULT" \
       --results-filter "" \
       --output kyua_html
 .windows_system_test: &windows_system_test_job
  stage: system
  tags:
    - windows
    - amd64
  script:
    - 'Push-Location bin/tests/system'
    - '$ifIndex = Get-NetIPInterface -AddressFamily IPv4 -InterfaceMetric 75 | Select-Object -ExpandProperty ifIndex'
    - '& C:/tools/cygwin/bin/sed.exe -i "s/^exit.*/netsh interface ipv4 set dnsservers $ifIndex dhcp/; s/\(name\|interface\)=Loopback/$ifIndex/;" ifconfig.bat'
    - '& C:/tools/cygwin/bin/sed.exe -i "s/kill -f/kill -W/;" conf.sh stop.pl'
    - '& cmd.exe /C ifconfig.bat up; ""'
    - 'Start-Sleep 2'
    - '$Env:Path = "C:/tools/cygwin/bin;$Env:Path"'
    - '& sh.exe runall.sh $TEST_PARALLEL_JOBS'
    - 'If (Test-Path C:/CrashDumps/*) { dir C:/CrashDumps; Throw }'
  artifacts:
    untracked: true
    expire_in: "1 week"
    when: on_failure
  only:
    - schedules
    - tags
    - web
 .unit_test: &unit_test_job
  <<: *default_triggering_rules
  stage: unit
@@ -312,44 +205,6 @@ stages:
    expire_in: "1 week"
    when: on_failure
 .cppcheck_args: &run_cppcheck |
  cppcheck --enable=warning,performance,portability,information,missingInclude \
           --include=config.h \
           --quiet \
           --std=c11 \
           --language=c \
           --project=compile_commands.json \
           --error-exitcode=2 \
           -j ${TEST_PARALLEL_JOBS:-1} \
           --xml \
           --output-file=cppcheck.results \
           --relative-paths="$CI_PROJECT_DIR" \
           --inline-suppr \
           --suppressions-list=util/suppressions.txt
 .cppcheck_report: &cppcheck_report_html |
  cppcheck-htmlreport --title="BIND 9 ($CI_COMMIT_SHORT_SHA) Cppcheck Report" \
                      --file=cppcheck.results \
                      --report-dir=cppcheck_html/
 .cppcheck: &cppcheck_job
  <<: *default_triggering_rules
  stage: postcheck
  before_script:
    - export GCC_VERSION=$(gcc --version | sed -n 's/.*\([0-9]\+\)\.[0-9]\+\.[0-9]\+.*/\1/p')
    - sed -i "/gcc\",/a\"-DCPPCHECK\", \"-D__STDC__\", \"-D__GNUC__=${GCC_VERSION}\"," compile_commands.json
  script:
    - *run_cppcheck
  after_script:
    - *cppcheck_report_html
  artifacts:
    paths:
      - compile_commands.json
      - cppcheck.results
      - cppcheck_html/
    expire_in: "1 week"
    when: on_failure
 ### Job Definitions
 # Jobs in the precheck stage
@@ -383,32 +238,13 @@ misc:sid:amd64:
 🐞:sid:amd64:
  <<: *precheck_job
  <<: *debian_buster_amd64_image
  script:
    - util/check-cocci
    - if test "$(git status --porcelain | grep -Ev '\?\?' | wc -l)" -gt "0"; then git status --short; exit 1; fi
 tarball-create:sid:amd64:
  <<: *debian_sid_amd64_image
  stage: precheck
  script:
    - source version
    - export BIND_DIRECTORY="bind-${MAJORVER}.${MINORVER}.${PATCHVER}${RELEASETYPE}${RELEASEVER}"
    - git archive --prefix="${BIND_DIRECTORY}/" --output="${BIND_DIRECTORY}.tar" HEAD
    - mkdir "${BIND_DIRECTORY}"
    - echo "SRCID=$(git rev-list --max-count=1 HEAD | cut -b1-7)" > "${BIND_DIRECTORY}/srcid"
    - tar --append --file="${BIND_DIRECTORY}.tar" "${BIND_DIRECTORY}/srcid"
    - ${TARBALL_COMPRESSOR} "${BIND_DIRECTORY}.tar"
  artifacts:
    paths:
      - bind-*.tar.${TARBALL_EXTENSION}
  only:
    - tags
 # Jobs for doc builds on Debian Sid (amd64)
 docs:sid:amd64:
  <<: *release_branch_triggering_rules
  <<: *debian_sid_amd64_image
  stage: docs
  script:
@@ -423,6 +259,12 @@ docs:sid:amd64:
    paths:
      - doc/arm/
    expire_in: "1 month"
  only:
    - merge_requests
    - tags
    - web
    - master@isc-projects/bind9
    - /^v9_[1-9][0-9]$/@isc-projects/bind9
 push:docs:sid:amd64:
  <<: *debian_sid_amd64_image
@@ -434,36 +276,36 @@ push:docs:sid:amd64:
    - master@isc-projects/bind9
    - /^v9_[1-9][0-9]$/@isc-projects/bind9
-# Jobs for regular GCC builds on Alpine Linux 3.11 (amd64)
+# Jobs for regular GCC builds on Alpine Linux 3.10 (amd64)
-gcc:alpine3.11:amd64:
+gcc:alpine3.10:amd64:
  variables:
    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON}"
+    CFLAGS: "-Wall -Wextra -O2 -g"
    EXTRA_CONFIGURE: "--enable-dnstap"
-  <<: *alpine_3_11_amd64_image
+  <<: *alpine_3_10_amd64_image
  <<: *build_job
-system:gcc:alpine3.11:amd64:
+system:gcc:alpine3.10:amd64:
-  <<: *alpine_3_11_amd64_image
+  <<: *alpine_3_10_amd64_image
  <<: *system_test_job
  dependencies:
-    - gcc:alpine3.11:amd64
+    - gcc:alpine3.10:amd64
-  needs: ["gcc:alpine3.11:amd64"]
+  needs: ["gcc:alpine3.10:amd64"]
-unit:gcc:alpine3.11:amd64:
+unit:gcc:alpine3.10:amd64:
-  <<: *alpine_3_11_amd64_image
+  <<: *alpine_3_10_amd64_image
  <<: *unit_test_job
  dependencies:
-    - gcc:alpine3.11:amd64
+    - gcc:alpine3.10:amd64
-  needs: ["gcc:alpine3.11:amd64"]
+  needs: ["gcc:alpine3.10:amd64"]
 # Jobs for regular GCC builds on CentOS 6 (amd64)
 gcc:centos6:amd64:
  variables:
    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON}"
+    CFLAGS: "-Wall -Wextra -O2 -g"
    EXTRA_CONFIGURE: "--with-libidn2 --disable-warn-error"
  <<: *centos_centos6_amd64_image
  <<: *build_job
@@ -487,7 +329,7 @@ unit:gcc:centos6:amd64:
 gcc:centos7:amd64:
  variables:
    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON}"
+    CFLAGS: "-Wall -Wextra -O2 -g"
    EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2"
  <<: *centos_centos7_amd64_image
  <<: *build_job
@@ -506,36 +348,12 @@ unit:gcc:centos7:amd64:
    - gcc:centos7:amd64
  needs: ["gcc:centos7:amd64"]
 # Jobs for regular GCC builds on CentOS 8 (amd64)
 gcc:centos8:amd64:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON}"
    EXTRA_CONFIGURE: "--with-libidn2"
  <<: *centos_centos8_amd64_image
  <<: *build_job
 system:gcc:centos8:amd64:
  <<: *centos_centos8_amd64_image
  <<: *system_test_job
  dependencies:
    - gcc:centos8:amd64
  needs: ["gcc:centos8:amd64"]
 unit:gcc:centos8:amd64:
  <<: *centos_centos8_amd64_image
  <<: *unit_test_job
  dependencies:
    - gcc:centos8:amd64
  needs: ["gcc:centos8:amd64"]
 # Jobs for regular GCC builds on Debian 8 Jessie (amd64)
 gcc:jessie:amd64:
  variables:
    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -O2"
+    CFLAGS: "-Wall -Wextra -O2 -g"
    EXTRA_CONFIGURE: "--without-cmocka --with-python --disable-geoip"
  <<: *debian_jessie_amd64_image
  <<: *build_job
@@ -559,7 +377,7 @@ unit:gcc:jessie:amd64:
 gcc:stretch:amd64:
  variables:
    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -O2"
+    CFLAGS: "-Wall -Wextra -O2 -g"
  <<: *debian_stretch_amd64_image
  <<: *build_job
@@ -582,7 +400,7 @@ unit:gcc:stretch:amd64:
 gcc:buster:amd64:
  variables:
    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON}"
+    CFLAGS: "-Wall -Wextra -O2 -g"
  <<: *debian_buster_amd64_image
  <<: *build_job
@@ -600,47 +418,14 @@ unit:gcc:buster:amd64:
    - gcc:buster:amd64
  needs: ["gcc:buster:amd64"]
 # Jobs for scan-build builds on Debian Buster (amd64)
 .scan_build: &scan_build |
  ${SCAN_BUILD} --html-title="BIND 9 ($CI_COMMIT_SHORT_SHA)" \
                --keep-cc \
                --status-bugs \
                --keep-going \
                -o scan-build.reports \
                make -j${BUILD_PARALLEL_JOBS:-1} all V=1
 scan-build:buster:amd64:
  <<: *default_triggering_rules
  <<: *debian_buster_amd64_image
  stage: postcheck
  variables:
    CC: clang-9
    CFLAGS: "${CFLAGS_COMMON}"
    CONFIGURE: "${SCAN_BUILD} ./configure"
    EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2"
  script:
    - *configure
    - *scan_build
  dependencies:
    - autoreconf:sid:amd64
  needs:
    - autoreconf:sid:amd64
  artifacts:
    paths:
      - scan-build.reports/
    expire_in: "1 week"
    when: on_failure
 # Jobs for regular GCC builds on Debian Sid (amd64)
 gcc:sid:amd64:
  variables:
    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -O3"
+    CFLAGS: "-Wall -Wextra -O3 -g"
    EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2"
    RUN_MAKE_INSTALL: 1
    MAKE: bear make
  <<: *debian_sid_amd64_image
  <<: *build_job
@@ -658,74 +443,12 @@ unit:gcc:sid:amd64:
    - gcc:sid:amd64
  needs: ["gcc:sid:amd64"]
 cppcheck:gcc:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *cppcheck_job
  dependencies:
    - gcc:sid:amd64
  needs: ["gcc:sid:amd64"]
 # Job for out-of-tree GCC build on Debian Sid (amd64)
 oot:sid:amd64:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -O3"
    CONFIGURE: ../configure
    EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2"
    RUN_MAKE_INSTALL: 1
    OOT_BUILD_WORKSPACE: workspace
  <<: *debian_sid_amd64_image
  <<: *build_job
 # Jobs for tarball GCC builds on Debian Sid (amd64)
 tarball:sid:amd64:
  variables:
    CC: gcc
    EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2"
    RUN_MAKE_INSTALL: 1
  <<: *debian_sid_amd64_image
  <<: *build_job
  before_script:
    - tar --extract --file bind-*.tar.${TARBALL_EXTENSION}
    - rm -f bind-*.tar.${TARBALL_EXTENSION}
    - cd bind-*
  dependencies:
    - tarball-create:sid:amd64
  needs: ["tarball-create:sid:amd64"]
  only:
    - tags
 system:tarball:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *system_test_job
  before_script:
    - cd bind-*
    - *setup_interfaces
  dependencies:
    - tarball:sid:amd64
  needs: ["tarball:sid:amd64"]
  only:
    - tags
 unit:tarball:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *unit_test_job
  before_script:
    - cd bind-*
  dependencies:
    - tarball:sid:amd64
  needs: ["tarball:sid:amd64"]
  only:
    - tags
 # Jobs for regular GCC builds on Debian Sid (i386)
 gcc:sid:i386:
  variables:
    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON}"
+    CFLAGS: "-Wall -Wextra -O3 -g"
    EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2 --without-python"
  <<: *debian_sid_i386_image
  <<: *build_job
@@ -744,60 +467,36 @@ unit:gcc:sid:i386:
    - gcc:sid:i386
  needs: ["gcc:sid:i386"]
-# Jobs for regular GCC builds on openSUSE Tumbleweed (amd64)
+# Jobs for regular GCC builds on Fedora 30 (amd64)
-gcc:tumbleweed:amd64:
+gcc:fedora30:amd64:
  variables:
    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON}"
+    CFLAGS: "-Wall -Wextra -O2 -g"
    EXTRA_CONFIGURE: "--with-libidn2"
-  <<: *tumbleweed_latest_amd64_image
+  <<: *fedora_30_amd64_image
  <<: *build_job
-system:gcc:tumbleweed:amd64:
+system:gcc:fedora30:amd64:
-  <<: *tumbleweed_latest_amd64_image
+  <<: *fedora_30_amd64_image
  <<: *system_test_job
  dependencies:
-    - gcc:tumbleweed:amd64
+    - gcc:fedora30:amd64
-  needs: ["gcc:tumbleweed:amd64"]
+  needs: ["gcc:fedora30:amd64"]
-unit:gcc:tumbleweed:amd64:
+unit:gcc:fedora30:amd64:
-  <<: *tumbleweed_latest_amd64_image
+  <<: *fedora_30_amd64_image
  <<: *unit_test_job
  dependencies:
-    - gcc:tumbleweed:amd64
+    - gcc:fedora30:amd64
-  needs: ["gcc:tumbleweed:amd64"]
+  needs: ["gcc:fedora30:amd64"]
 # Jobs for regular GCC builds on Fedora 31 (amd64)
 gcc:fedora31:amd64:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -O1"
    EXTRA_CONFIGURE: "--with-libidn2"
  <<: *fedora_31_amd64_image
  <<: *build_job
 system:gcc:fedora31:amd64:
  <<: *fedora_31_amd64_image
  <<: *system_test_job
  dependencies:
    - gcc:fedora31:amd64
  needs: ["gcc:fedora31:amd64"]
 unit:gcc:fedora31:amd64:
  <<: *fedora_31_amd64_image
  <<: *unit_test_job
  dependencies:
    - gcc:fedora31:amd64
  needs: ["gcc:fedora31:amd64"]
 # Jobs for regular GCC builds on Ubuntu 16.04 Xenial Xerus (amd64)
 gcc:xenial:amd64:
  variables:
    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -O2"
+    CFLAGS: "-Wall -Wextra -O2 -g"
    EXTRA_CONFIGURE: "--disable-geoip"
  <<: *ubuntu_xenial_amd64_image
  <<: *build_job
@@ -821,7 +520,7 @@ unit:gcc:xenial:amd64:
 gcc:bionic:amd64:
  variables:
    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -Og"
+    CFLAGS: "-Wall -Wextra -O2 -g"
    EXTRA_CONFIGURE: "--with-libidn2"
  <<: *ubuntu_bionic_amd64_image
  <<: *build_job
@@ -845,15 +544,13 @@ unit:gcc:bionic:amd64:
 asan:sid:amd64:
  variables:
    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -fsanitize=address,undefined -DISC_MEM_USE_INTERNAL_MALLOC=0"
+    CFLAGS: "-Wall -Wextra -O2 -g -fsanitize=address,undefined -DISC_MEM_USE_INTERNAL_MALLOC=0"
    LDFLAGS: "-fsanitize=address,undefined"
    EXTRA_CONFIGURE: "--with-libidn2"
  <<: *debian_sid_amd64_image
  <<: *build_job
 system:asan:sid:amd64:
  variables:
    ASAN_OPTIONS: ${ASAN_OPTIONS_COMMON}
  <<: *debian_sid_amd64_image
  <<: *system_test_job
  dependencies:
@@ -861,75 +558,16 @@ system:asan:sid:amd64:
  needs: ["asan:sid:amd64"]
 unit:asan:sid:amd64:
  variables:
    ASAN_OPTIONS: ${ASAN_OPTIONS_COMMON}
  <<: *debian_sid_amd64_image
  <<: *unit_test_job
  dependencies:
    - asan:sid:amd64
  needs: ["asan:sid:amd64"]
 # Jobs for GCC builds with TSAN enabled on Debian Sid (amd64)
 tsan:buster:amd64:
  <<: *debian_buster_amd64_image
  <<: *build_job
  variables:
    CC: clang-9
    CFLAGS: "${CFLAGS_COMMON} -fsanitize=thread -DISC_MEM_USE_INTERNAL_MALLOC=0"
    LDFLAGS: "-fsanitize=thread"
    EXTRA_CONFIGURE: "--with-libidn2 --enable-pthread-rwlock"
 system:tsan:buster:amd64:
  variables:
    TSAN_OPTIONS: "second_deadlock_stack=1 history_size=7 log_exe_name=true log_path=tsan external_symbolizer_path=$SYMBOLIZER exitcode=0"
  before_script:
    - *setup_interfaces
    - echo $TSAN_OPTIONS
  <<: *debian_buster_amd64_image
  <<: *system_test_job
  dependencies:
    - tsan:buster:amd64
  needs: ["tsan:buster:amd64"]
  allow_failure: true
  after_script:
    - find bin -name 'tsan.*' -exec python3 util/parse_tsan.py {} \;
  artifacts:
    expire_in: "1 week"
    paths:
      - bin/tests/system/*/tsan.*
      - bin/tests/system/*/*/tsan.*
      - tsan/
    when: on_failure
 unit:tsan:buster:amd64:
  variables:
    TSAN_OPTIONS: "second_deadlock_stack=1 history_size=7 log_exe_name=true log_path=tsan external_symbolizer_path=$SYMBOLIZER"
  before_script:
    - echo $TSAN_OPTIONS
    - lib/isc/tests/result_test
  <<: *debian_buster_amd64_image
  <<: *unit_test_job
  dependencies:
    - tsan:buster:amd64
  needs: ["tsan:buster:amd64"]
  allow_failure: true
  after_script:
    - find lib -name 'tsan.*' -exec python3 util/parse_tsan.py {} \;
  artifacts:
    expire_in: "1 week"
    paths:
      - lib/*/tests/tsan.*
      - tsan/
      - kyua.log
      - kyua.results
      - kyua_html/
    when: on_failure
 rwlock:sid:amd64:
  variables:
    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -Wall -Wextra -O2 -g -DISC_MEM_USE_INTERNAL_MALLOC=0"
+    CFLAGS: "-Wall -Wextra -O2 -g -DISC_MEM_USE_INTERNAL_MALLOC=0"
    EXTRA_CONFIGURE: "--with-libidn2 --enable-pthread-rwlock"
  <<: *debian_sid_amd64_image
  <<: *build_job
@@ -952,7 +590,7 @@ unit:rwlock:sid:amd64:
 mutexatomics:sid:amd64:
  variables:
    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -DISC_MEM_USE_INTERNAL_MALLOC=0"
+    CFLAGS: "-Wall -Wextra -O2 -g -DISC_MEM_USE_INTERNAL_MALLOC=0"
    EXTRA_CONFIGURE: "--with-libidn2 --enable-mutex-atomics"
  <<: *debian_sid_amd64_image
  <<: *build_job
@@ -977,7 +615,7 @@ mutexatomics:sid:amd64:
 clang:stretch:amd64:
  variables:
    CC: clang
-    CFLAGS: "${CFLAGS_COMMON} -Wenum-conversion"
+    CFLAGS: "-Wall -Wextra -Wenum-conversion -O2 -g"
    EXTRA_CONFIGURE: "--with-python=python3"
  <<: *debian_stretch_amd64_image
  <<: *build_job
@@ -994,7 +632,7 @@ unit:clang:stretch:amd64:
 clang:stretch:i386:
  variables:
    CC: clang
-    CFLAGS: "${CFLAGS_COMMON} -Wenum-conversion"
+    CFLAGS: "-Wall -Wextra -Wenum-conversion -O2 -g"
    EXTRA_CONFIGURE: "--with-python=python2"
  <<: *debian_stretch_i386_image
  <<: *build_job
@@ -1004,7 +642,7 @@ clang:stretch:i386:
 pkcs11:sid:amd64:
  variables:
    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON}"
+    CFLAGS: "-Wall -Wextra -O2 -g"
    EXTRA_CONFIGURE: "--enable-native-pkcs11 --with-pkcs11=/usr/lib/softhsm/libsofthsm2.so"
  <<: *debian_sid_amd64_image
  <<: *build_job
@@ -1023,76 +661,12 @@ unit:pkcs11:sid:amd64:
    - pkcs11:sid:amd64
  needs: ["pkcs11:sid:amd64"]
 # Jobs for Clang builds on FreeBSD 11.3 (amd64)
 clang:freebsd11.3:amd64:
  variables:
    CFLAGS: "${CFLAGS_COMMON}"
  <<: *freebsd_amd64
  <<: *build_job
 system:clang:freebsd11.3:amd64:
  <<: *freebsd_amd64
  <<: *system_test_job
  dependencies:
    - clang:freebsd11.3:amd64
  needs: ["clang:freebsd11.3:amd64"]
 unit:clang:freebsd11.3:amd64:
  <<: *freebsd_amd64
  <<: *unit_test_job
  dependencies:
    - clang:freebsd11.3:amd64
  needs: ["clang:freebsd11.3:amd64"]
 # Jobs for Clang builds on FreeBSD 12.0 (amd64)
 clang:freebsd12.0:amd64:
  variables:
    CFLAGS: "${CFLAGS_COMMON}"
    EXTRA_CONFIGURE: "--enable-dnstap"
  <<: *freebsd_amd64
  <<: *build_job
 system:clang:freebsd12.0:amd64:
  <<: *freebsd_amd64
  <<: *system_test_job
  dependencies:
    - clang:freebsd12.0:amd64
  needs: ["clang:freebsd12.0:amd64"]
 unit:clang:freebsd12.0:amd64:
  <<: *freebsd_amd64
  <<: *unit_test_job
  dependencies:
    - clang:freebsd12.0:amd64
  needs: ["clang:freebsd12.0:amd64"]
 # Jobs for Clang builds on OpenBSD 6.5 (amd64)
 clang:openbsd6.5:amd64:
  variables:
    CC: clang
  <<: *openbsd_amd64
  <<: *build_job
 system:clang:openbsd6.5:amd64:
  <<: *openbsd_amd64
  <<: *system_test_job
  dependencies:
    - clang:openbsd6.5:amd64
  needs: ["clang:openbsd6.5:amd64"]
  only:
    - schedules
    - tags
    - web
 # Jobs with libtool disabled
 nolibtool:sid:amd64:
  variables:
    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON}"
+    CFLAGS: "-Wall -Wextra -Og -g"
    EXTRA_CONFIGURE: "--with-libidn2 --without-libtool --with-dlopen"
  <<: *debian_sid_amd64_image
  <<: *build_job
@@ -1110,78 +684,3 @@ unit:nolibtool:sid:amd64:
  dependencies:
    - nolibtool:sid:amd64
  needs: ["nolibtool:sid:amd64"]
 # Jobs for Visual Studio 2017 builds on Windows (amd64)
 msvc:windows:amd64:
  <<: *windows_build_job
  <<: *default_triggering_rules
  variables:
    VSCONF: Release
 system:msvc:windows:amd64:
  <<: *windows_system_test_job
  variables:
    VSCONF: Release
  dependencies:
    - msvc:windows:amd64
  needs: ["msvc:windows:amd64"]
 msvc-debug:windows:amd64:
  <<: *windows_build_job
  variables:
    VSCONF: Debug
  only:
    - schedules
    - tags
    - web
 system:msvc-debug:windows:amd64:
  <<: *windows_system_test_job
  variables:
    VSCONF: Debug
  dependencies:
    - msvc-debug:windows:amd64
  needs: ["msvc-debug:windows:amd64"]
 # Job producing a release tarball
 release:sid:amd64:
  <<: *debian_sid_amd64_image
  stage: release
  script:
    # Determine BIND version
    - source version
    - export BIND_DIRECTORY="bind-${MAJORVER}.${MINORVER}.${PATCHVER}${RELEASETYPE}${RELEASEVER}"
    # Remove redundant files and system test utilities from Windows build artifacts
    - find Build/Release/ -name "*.pdb" -print -delete
    - find Build/Debug/ \( -name "*.bsc" -o -name "*.idb" \) -print -delete
    - find Build/ -regextype posix-extended -regex "Build/.*/($(find bin/tests/ -type f | sed -nE "s|^bin/tests(/system)?/win32/(.*)\.vcxproj$|\2|p" | paste -d"|" -s))\..*" -print -delete
    # Create Windows zips
    - openssl dgst -sha256 "${BIND_DIRECTORY}.tar.${TARBALL_EXTENSION}" | tee Build/Release/SHA256 Build/Debug/SHA256
    - ( cd Build/Release; zip "../../BIND${BIND_DIRECTORY#bind-}.x64.zip" * )
    - ( cd Build/Debug; zip "../../BIND${BIND_DIRECTORY#bind-}.debug.x64.zip" * )
    # Prepare release tarball contents (tarballs + zips + documentation)
    - mkdir -p release/doc/arm
    - pushd release
    - mv "../${BIND_DIRECTORY}.tar.${TARBALL_EXTENSION}" ../BIND*.zip .
    - tar --extract --file="${BIND_DIRECTORY}.tar.${TARBALL_EXTENSION}"
    - mv "${BIND_DIRECTORY}"/{CHANGES*,COPYRIGHT,LICENSE,README,srcid} .
    - mv "${BIND_DIRECTORY}"/doc/arm/{Bv9ARM{*.html,.pdf},man.*,notes.{html,pdf,txt}} doc/arm/
    - rm -rf "${BIND_DIRECTORY}"
    - cp doc/arm/notes.html "RELEASE-NOTES-${BIND_DIRECTORY}.html"
    - cp doc/arm/notes.pdf "RELEASE-NOTES-${BIND_DIRECTORY}.pdf"
    - cp doc/arm/notes.txt "RELEASE-NOTES-${BIND_DIRECTORY}.txt"
    - popd
    # Create release tarball
    - tar --create --file="${CI_COMMIT_TAG}.tar.gz" --gzip release/
  dependencies:
    - tarball-create:sid:amd64
    - msvc:windows:amd64
    - msvc-debug:windows:amd64
  only:
    - tags
  artifacts:
    paths:
      - "*.tar.gz"
    expire_in: "1 week"
@@ -1,65 +0,0 @@
 ## Release Schedule
 **Tagging Deadline:**
 **Public Release:**
 ## Release Checklist
 ## 2 Working Days Before the Tagging Deadline
 - [ ] ***(QA)*** Check whether all issues assigned to the release milestone are resolved[^1].
 - [ ] ***(QA)*** Ensure that there are no outstanding merge requests in the private repository[^1] (Subscription Edition only).
 - [ ] ***(QA)*** Ensure all merge requests marked for backporting have been indeed backported.
 ## Before the Tagging Deadline
 - [ ] ***(QA)*** Inform Support/Marketing of impending release (and give estimated release dates).
 - [ ] ***(QA)*** Check Perflab to ensure there has been no unexplained drop in performance for the versions being released.
 - [ ] ***(SwEng)*** Update API files for libraries with new version information.
 - [ ] ***(SwEng)*** Change software version and library versions in `configure.ac` (new major release only).
 - [ ] ***(SwEng)*** Rebuild `configure` using Autoconf on `docs.isc.org`.
 - [ ] ***(SwEng)*** Update `CHANGES`.
 - [ ] ***(SwEng)*** Update `CHANGES.SE` (Subscription Edition only).
 - [ ] ***(SwEng)*** Update `README.md`.
 - [ ] ***(SwEng)*** Update `version`.
 - [ ] ***(SwEng)*** Build documentation on `docs.isc.org`.
 - [ ] ***(QA)*** Check that all the above steps were performed correctly.
 - [ ] ***(QA)*** Check that the contents of release notes match the merge requests comprising the releases.
 - [ ] ***(QA)*** Check that the formatting is correct for text, PDF, and HTML versions of release notes.
 - [ ] ***(SwEng)*** Tag the releases[^2].  (Tags may only be pushed to the public repository for releases which are *not* security releases.)
 - [ ] ***(SwEng)*** If this is the first tag for a release (e.g. beta), create a release branch named `release_v9_X_Y` to allow development to continue on the maintenance branch whilst release engineering continues.
 ## Before the ASN Deadline (for ASN Releases) or the Public Release Date (for Regular Releases)
 - [ ] ***(QA)*** Verify GitLab CI results for the tags created and prepare a QA report for the releases to be published.
 - [ ] ***(QA)*** Request signatures for the tarballs, providing their location and checksums.
 - [ ] ***(Signers)*** Validate tarball checksums, sign tarballs, and upload signatures.
 - [ ] ***(QA)*** Verify tarball signatures and check tarball checksums again.
 - [ ] ***(Support)*** Pre-publish ASN and/or Subscription Edition tarballs so that packages can be built.
 - [ ] ***(QA)*** Build and test ASN and/or Subscription Edition packages.
 - [ ] ***(QA)*** Notify Support that the releases have been prepared.
 - [ ] ***(Support)*** Send out ASNs (if applicable).
 ## On the Day of Public Release
 - [ ] ***(Support)*** Wait for clearance from Security Officer to proceed with the public release (if applicable).
 - [ ] ***(Support)*** Place tarballs in public location on FTP site.
 - [ ] ***(Support)*** Publish links to downloads on ISC website.
 - [ ] ***(Support)*** Write release email to *bind-announce*.
 - [ ] ***(Support)*** Write email to *bind-users* (if a major release).
 - [ ] ***(Support)*** Update tickets in case of waiting support customers.
 - [ ] ***(QA)*** Build and test any outstanding private packages.
 - [ ] ***(QA)*** Build public packages (`*.deb`, RPMs).
 - [ ] ***(QA)*** Inform Marketing of the release.
 - [ ] ***(QA)*** Update the internal [BIND release dates wiki page](https://wiki.isc.org/bin/view/Main/BindReleaseDates) when public announcement has been made.
 - [ ] ***(Marketing)*** Post short note to Twitter.
 - [ ] ***(Marketing)*** Update [Wikipedia entry for BIND](https://en.wikipedia.org/wiki/BIND).
 - [ ] ***(Marketing)*** Write blog article (if a major release).
 - [ ] ***(QA)*** Ensure all new tags are annotated and signed.
 - [ ] ***(SwEng)*** Push tags for the published releases to the public repository.
 - [ ] ***(SwEng)*** Merge the automatically prepared `prep 9.X.Y` commit which updates `version` and documentation on the release branch into the relevant maintenance branch (`v9_X`).
 [^1]: If not, use the time remaining until the tagging deadline to ensure all outstanding issues are either resolved or moved to a different milestone.
 [^2]: Preferred command line: `git tag -u <DEVELOPER_KEYID> -a -s -m "BIND 9.X.Y[alphatag]" v9_X_Y[alphatag]`, where `[alphatag]` is an optional string such as `b1`, `rc1`, etc.
@@ -0,0 +1,47 @@
 ## Release Checklist
 - [ ] (Manager) Check for the presence of a milestone for the release:
    - If there is a milestone, are all the issues for the milestone resolved? (other than this checklist).
 - [ ] (Manager) Inform Support/Marketing of impending release (and give estimated release dates).
 - (SwEng) Prepare the sources for tarball generation:
   - [ ] Check perflab to ensure there has been no unexplained drop in performance for the version being released.
   - [ ] Ensure that there are no outstanding merge requests in the private repository (subscription version only).
   - [ ] Update API files for libraries with new version information.
   - [ ] Change software version and library versions in configure.in (new major release only).
   - [ ] Rebuild configure using autoconf on docs.isc.org.
   - [ ] Update CHANGES.
   - [ ] Update CHANGES.SE (subscription branch only).
   - [ ] Update "version".
   - [ ] Update "readme.md".
   - Check the release notes are correct:
     - [ ] Compare content with merge requests for the release.
     - [ ] Check formatting.
   - [ ] Build documentation on docs.isc.org.
   - [ ] Commit changes and make sure the gitlab-ci tests are passing.
   - [ ] Push the changes and tag ("alphatag" is an optional string such as "b1", "rc1" etc.). (```git tag -u <DEVELOPER_KEYID> -a -s -m "BIND 9.X.Y[alphatag]" v9_X_Y[alphatag]```)
   - [ ] If this is the first tag for a release (e.g. beta), create a release branch named `release_v9_X_Y` (this allows development to continue on the release branch whilst release engineering continues).
 - [ ] (SwEng) Run the "make release" Jenkins job to produce the tarballs and zips.
 - [ ] (SwEng) Ask QA to sanity check the tarball and zips (passing to them the number of the Jenkins job).
 - [ ] (QA) Sanity check the tarballs.
 - [ ] (QA) Request the signature on the tarballs.
 - [ ] (QA) Check signatures on tarballs.
 - [ ] (QA) Tell Support to handle notification of release.
 - [ ] (Manager) Inform Marketing of the release
 - [ ] (Manager) Update the internal [BIND release dates wiki page](https://wiki.isc.org/bin/view/Main/BindReleaseDates) when public announcement has been made.
 - [ ] (SwEng) Update DEB and RPM packages
 - [ ] (SwEng) Merge the automatically prepared `prep 9.X.Y` commit which updates `version` and documentation on the release branch into the relevant maintenance branch (`v9_X`)
 ## Support
 - [ ] Make tarballs and signatures available to download.
 - [ ] Write release email to bind9-announce.
 - [ ] Write email to bind9-users (if a major release).
 - [ ] Update tickets in case of waiting support customers.
 ## Marketing
 - [ ] Update BIND Product page if needed
 - [ ] Update BIND Significant Features Matrix in KB if needed
 - [ ] Update BIND -S Edition data sheet if S Edition feature change
 - [ ] Announce on social media
 - [ ] Update [Wikipedia entry for BIND](http://en.wikipedia.org/wiki/BIND).
 - [ ] Write blog article (if a major release).
@@ -1,242 +1,3 @@
 5345.	[func]		Key-style trust anchors and DS-style trust anchors
 			can now both be used for the same name. [GL !2892]
 5344.	[bug]		Handle accept() errors properly in netmgr. [GL !2880]
 5343.	[func]		Add statistics counters to the netmgr. [GL #1311]
 5342.	[bug]		Disable pktinfo for ipv6 - bind to all interfaces
 			explicitly as libuv doesn't pass us pktinfo structure,
 			[GL #1558]
 5341.	[func]		Simplify passing the bound TCP socket to child
 			threads by using isc_uv_export/import functions.
 			[GL !2825]
 5340.	[bug]		Don't deadlock when binding to a TCP socket fails.
 			[GL #1499]
 5339.	[bug]		With some libmaxminddb versions, named could erroneously
 			match an IP address not belonging to any subnet defined
 			in a given GeoIP2 database to one of the existing
 			entries in that database. [GL #1552]
 5338.	[bug]		Fix line spacing in `rndc secroots`.
 			Thanks to Tony Finch. [GL !2478]
 5337.	[func]		'named -V' now reports maxminddb and protobuf-c
 			versions. [GL !2686]
 	--- 9.15.7 released ---
 5336.	[bug]		The TCP high-water statistic could report an
 			incorrect value on startup. [GL #1392]
 5335.	[func]		Make TCP listening code multithreaded. [GL !2659]
 5334.	[doc]		Update documentation with dnssec-policy clarifications.
 			Also change some defaults. [GL !2711]
 5333.	[bug]		Fix duration printing on Solaris when value is not
 			an ISO 8601 duration. [GL #1460]
 5332.	[func]		Renamed "dnssec-keys" configuration statement
 			to the more descriptive "trust-anchors". [GL !2702]
 5331.	[func]		Use compiler-provided mechanisms for thread local
 			storage, and make the requirement for such mechanisms
 			explicit in configure. [GL #1444]
 5330.	[bug]		'configure --without-python' was ineffective if
 			PYTHON was set in the environment. [GL #1434]
 5329.	[bug]		Reconfiguring named caused memory to be leaked when any
 			GeoIP2 database was in use. [GL #1445]
 5328.	[bug]		rbtdb.c:rdataset_{get,set}ownercase failed to obtain
 			a node lock. [GL #1417]
 5327.	[func]		Added a statistics counter to track queries
 			dropped because the recursive-clients quota was
 			exceeded. [GL #1399]
 5326.	[bug]		Add Python dependency on 'distutils.core' to configure.
 			'distutils.core' is required for installation.
 			[GL #1397]
 5325.	[bug]		Addressed several issues with TCP connections in
 			the netmgr: restored support for TCP connection
 			timeouts, restored TCP backlog support, actively
 			close all open sockets during shutdown. [GL #1312]
 5324.	[bug]		Change the category of some log messages from general
 			to the more appopriate catergory of xfer-in. [GL #1394]
 5323.	[bug]		Fix a bug in DNSSEC trust anchor verification.
 			[GL !2609]
 5322.	[placeholder]
 5321.	[bug]		Obtain write lock before updating version->records
 			and version->bytes. [GL #1341]
 5320.	[cleanup]	Silence TSAN on header->count. [GL #1344]
 	--- 9.15.6 released ---
 5319.	[func]		Trust anchors can now be configured using DS
 			format to represent a key digest, by using the
 			new "initial-ds" or "static-ds" keywords in
 			the "dnssec-keys" statement.
 			Note: DNSKEY-format and DS-format trust anchors
 			cannot both be used for the same domain name.
 			[GL #622]
 5318.	[cleanup]	The DNSSEC validation code has been refactored
 			for clarity and to reduce code duplication.
 			[GL #622]
 5317.	[func]		A new asynchronous network communications system
 			based on libuv is now used for listening for
 			incoming requests and responding to them. (The
 			old isc_socket API remains in use for sending
 			iterative queries and processing responses; this
 			will be changed too in a later release.)
 			This change will make it easier to improve
 			performance and implement new protocol layers
 			(e.g., DNS over TLS) in the future. [GL #29]
 5316.	[func]		A new "dnssec-policy" option has been added to
 			named.conf to implement a key and signing policy
 			(KASP) for zones. When this option is in use,
 			named can generate new keys as needed and
 			automatically roll both ZSK and KSK keys. (Note
 			that the syntax for this statement differs from
 			the dnssec policy used by dnssec-keymgr.)
 			See the ARM for configuration details. [GL #1134]
 5315.	[bug]		Apply the inital RRSIG expiration spread fixed
 			to all dynamically created records in the zone
 			including NSEC3. Also fix the signature clusters
 			when the server has been offline for prolonged
 			period of times. [GL #1256]
 5314.	[func]		Added a new statistics variable "tcp-highwater"
 			that reports the maximum number of simultaneous TCP
 			clients BIND has handled while running. [GL #1206]
 5313.	[bug]		The default GeoIP2 database location did not match
 			the ARM.  'named -V' now reports the default
 			location. [GL #1301]
 5312.	[bug]		Do not flush the cache for `rndc validation status`.
 			Thanks to Tony Finch. [GL !2462]
 5311.	[cleanup]	Include all views in output of `rndc validation status`.
 			Thanks to Tony Finch. [GL !2461]
 5310.	[bug]		TCP failures were affecting EDNS statistics. [GL #1059]
 5309.	[placeholder]
 5308.	[bug]		Don't log DNS_R_UNCHANGED from sync_secure_journal()
 			at ERROR level in receive_secure_serial(). [GL #1288]
 5307.	[bug]		Fix hang when named-compilezone output is sent to pipe.
 			Thanks to Tony Finch. [GL !2481]
 5306.	[security]	Set a limit on number of simultaneous pipelined TCP
 			queries. (CVE-2019-6477) [GL #1264]
 5305.	[bug]		NSEC Aggressive Cache ("synth-from-dnssec") has been
 			disabled by default because it was found to have
 			a significant performance impact on the recursive
 			service. [GL #1265]
 5304.	[bug]		"dnskey-sig-validity 0;" was not being accepted.
 			[GL #876]
 5303.	[placeholder]
 5302.	[bug]		Fix checking that "dnstap-output" is defined when
 			"dnstap" is specified in a view. [GL #1281]
 5301.	[bug]		Detect partial prefixes / incomplete IPv4 address in
 			acls. [GL #1143]
 5300.	[bug]		dig/mdig/delv: Add a colon after EDNS option names,
 			even when the option is empty, to improve
 			readability and allow correct parsing of YAML
 			output. [GL #1226]
 	--- 9.15.5 released ---
 5299.	[security]	A flaw in DNSSEC verification when transferring
 			mirror zones could allow data to be incorrectly
 			marked valid. (CVE-2019-6475) [GL #1252]
 5298.	[security]	Named could assert if a forwarder returned a
 			referral, rather than resolving the query, when QNAME
 			minimization was enabled. (CVE-2019-6476) [GL #1051]
 5297.	[bug]		Check whether a previous QNAME minimization fetch
 			is still running before starting a new one; return
 			SERVFAIL and log an error if so. [GL #1191]
 5296.	[placeholder]
 5295.	[cleanup]	Split dns_name_copy() calls into dns_name_copy() and
 			dns_name_copynf() for those calls that can potentially
 			fail and those that should not fail respectively.
 			[GL !2265]
 5294.	[func]		Fallback to ACE name on output in locale, which does not
 			support converting it to unicode.  [GL #846]
 5293.	[bug]		On Windows, named crashed upon any attempt to fetch XML
 			statistics from it. [GL #1245]
 5292.	[bug]		Queue 'rndc nsec3param' requests while signing inline
 			zone changes. [GL #1205]
 	--- 9.15.4 released ---
 5291.	[placeholder]
 5290.	[placeholder]
 5289.	[bug]		Address NULL pointer dereference in rpz.c:rpz_detach.
 			[GL #1210]
 5288.	[bug]		dnssec-must-be-secure was not always honored.
 			[GL #1209]
 5287.	[placeholder]
 5286.	[contrib]	Address potential NULL pointer dereferences in
 			dlz_mysqldyn_mod.c. [GL #1207]
 5285.	[port]		win32: implement "-T maxudpXXX". [GL #837]
 5284.	[func]		Added +unexpected command line option to dig.
 			By default, dig won't accept a reply from a source
 			other than the one to which it sent the query.
 			Invoking dig with +unexpected argument will allow it
 			to process replies from unexpected sources.
 5283.	[bug]		When a response-policy zone expires, ensure that
 			its policies are removed from the RPZ summary
 			database. [GL #1146]
 5282.	[bug]		Fixed a bug in searching for possible wildcard matches
 			for query names in the RPZ summary database. [GL #1146]
 5281.	[cleanup]	Don't escape commas when reporting named's command
 			line. [GL #1189]
 5280.	[protocol]	Add support for displaying EDNS option LLQ. [GL #1201]
 5279.	[bug]		When loading, reject zones containing CDS or CDNSKEY
@@ -288,7 +49,7 @@
 5268.	[placeholder]
-5267.	[func]		Allow statistics groups display to be toggle-able.
+5267.	[func]		Allow statistics groups display to be toggleable.
 			[GL #1030]
 5266.	[bug]		named-checkconf failed to report dnstap-output
@@ -396,7 +157,7 @@
 			code in a high-load cold-cache resolver scenario.
 			[GL #943]
-5242.	[bug]		In relaxed qname minimization mode, fall back to
+5242.	[bug]		In relaxed qname minimizatiom mode, fall back to
 			normal resolution when encountering a lame
 			delegation, and use _.domain/A queries rather
 			than domain/NS. [GL #1055]
@@ -1,4 +1,4 @@
-Copyright (C) 1996-2020  Internet Systems Consortium, Inc. ("ISC")
+Copyright (C) 1996-2019  Internet Systems Consortium, Inc. ("ISC")
 This Source Code Form is subject to the terms of the Mozilla Public
 License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -181,6 +181,67 @@ SUCH DAMAGE.
 -----------------------------------------------------------------------------
 Copyright (c) 1998 Doug Rabson
 All rights reserved.
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions
 are met:
 1. Redistributions of source code must retain the above copyright
   notice, this list of conditions and the following disclaimer.
 2. Redistributions in binary form must reproduce the above copyright
   notice, this list of conditions and the following disclaimer in the
   documentation and/or other materials provided with the distribution.
 THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
 ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 SUCH DAMAGE.
 -----------------------------------------------------------------------------
 Copyright ((c)) 2002, Rice University
 All rights reserved.
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are
 met:
    * Redistributions of source code must retain the above copyright
    notice, this list of conditions and the following disclaimer.
    * Redistributions in binary form must reproduce the above
    copyright notice, this list of conditions and the following
    disclaimer in the documentation and/or other materials provided
    with the distribution.
    * Neither the name of Rice University (RICE) nor the names of its
    contributors may be used to endorse or promote products derived
    from this software without specific prior written permission.
 This software is provided by RICE and the contributors on an "as is"
 basis, without any representations or warranties of any kind, express
 or implied including, but not limited to, representations or
 warranties of non-infringement, merchantability or fitness for a
 particular purpose. In no event shall RICE or contributors be liable
 for any direct, indirect, incidental, special, exemplary, or
 consequential damages (including, but not limited to, procurement of
 substitute goods or services; loss of use, data, or profits; or
 business interruption) however caused and on any theory of liability,
 whether in contract, strict liability, or tort (including negligence
 or otherwise) arising in any way out of the use of this software, even
 if advised of the possibility of such damage.
 -----------------------------------------------------------------------------
 Copyright (c) 1993 by Digital Equipment Corporation.
 Permission to use, copy, modify, and distribute this software for any
@@ -201,6 +262,61 @@ SOFTWARE.
 -----------------------------------------------------------------------------
 Copyright 2000 Aaron D. Gifford.  All rights reserved.
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions
 are met:
 1. Redistributions of source code must retain the above copyright
   notice, this list of conditions and the following disclaimer.
 2. Redistributions in binary form must reproduce the above copyright
   notice, this list of conditions and the following disclaimer in the
   documentation and/or other materials provided with the distribution.
 3. Neither the name of the copyright holder nor the names of contributors
   may be used to endorse or promote products derived from this software
   without specific prior written permission.
 THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) AND CONTRIBUTOR(S) ``AS IS'' AND
 ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR(S) OR CONTRIBUTOR(S) BE LIABLE
 FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 SUCH DAMAGE.
 -----------------------------------------------------------------------------
 Copyright (c) 1998 Doug Rabson.
 Copyright (c) 2001 Jake Burkholder.
 All rights reserved.
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions
 are met:
 1. Redistributions of source code must retain the above copyright
   notice, this list of conditions and the following disclaimer.
 2. Redistributions in binary form must reproduce the above copyright
   notice, this list of conditions and the following disclaimer in the
   documentation and/or other materials provided with the distribution.
 THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
 ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 SUCH DAMAGE.
 -----------------------------------------------------------------------------
 Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
 All rights reserved.
@@ -247,6 +363,49 @@ SOFTWARE.
 -----------------------------------------------------------------------------
 Copyright (c) 2000-2002 Japan Network Information Center.  All rights reserved.
 By using this file, you agree to the terms and conditions set forth bellow.
                        LICENSE TERMS AND CONDITIONS 
 The following License Terms and Conditions apply, unless a different
 license is obtained from Japan Network Information Center ("JPNIC"),
 a Japanese association, Kokusai-Kougyou-Kanda Bldg 6F, 2-3-4 Uchi-Kanda,
 Chiyoda-ku, Tokyo 101-0047, Japan.
 1. Use, Modification and Redistribution (including distribution of any
   modified or derived work) in source and/or binary forms is permitted
   under this License Terms and Conditions.
 2. Redistribution of source code must retain the copyright notices as they
   appear in each source code file, this License Terms and Conditions.
 3. Redistribution in binary form must reproduce the Copyright Notice,
   this License Terms and Conditions, in the documentation and/or other
   materials provided with the distribution.  For the purposes of binary
   distribution the "Copyright Notice" refers to the following language:
   "Copyright (c) 2000-2002 Japan Network Information Center.  All rights
   reserved."
 4. The name of JPNIC may not be used to endorse or promote products
   derived from this Software without specific prior written approval of
   JPNIC.
 5. Disclaimer/Limitation of Liability: THIS SOFTWARE IS PROVIDED BY JPNIC
   "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
   LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
   PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL JPNIC BE LIABLE
   FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
   CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
   SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
   BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
   WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
   OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
   ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
 -----------------------------------------------------------------------------
 Copyright (C) 2004  Nominet, Ltd.
 Permission to use, copy, modify, and distribute this software for any
@@ -263,6 +422,24 @@ PERFORMANCE OF THIS SOFTWARE.
 -----------------------------------------------------------------------------
 Portions Copyright RSA Security Inc.
 License to copy and use this software is granted provided that it is
 identified as "RSA Security Inc. PKCS #11 Cryptographic Token Interface
 (Cryptoki)" in all material mentioning or referencing this software.
 License is also granted to make and use derivative works provided that
 such works are identified as "derived from the RSA Security Inc. PKCS #11
 Cryptographic Token Interface (Cryptoki)" in all material mentioning or
 referencing the derived work.
 RSA Security Inc. makes no representations concerning either the
 merchantability of this software or the suitability of this software for
 any particular purpose. It is provided "as is" without express or implied
 warranty of any kind.
 -----------------------------------------------------------------------------
 Copyright (c) 1996, David Mazieres <dm@uun.org>
 Copyright (c) 2008, Damien Miller <djm@openbsd.org>
@@ -280,6 +457,54 @@ OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 -----------------------------------------------------------------------------
 Copyright (c) 2000-2001 The OpenSSL Project.  All rights reserved.
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions
 are met:
 1. Redistributions of source code must retain the above copyright
   notice, this list of conditions and the following disclaimer.
 2. Redistributions in binary form must reproduce the above copyright
   notice, this list of conditions and the following disclaimer in
   the documentation and/or other materials provided with the
   distribution.
 3. All advertising materials mentioning features or use of this
   software must display the following acknowledgment:
   "This product includes software developed by the OpenSSL Project
   for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
   endorse or promote products derived from this software without
   prior written permission. For written permission, please contact
   licensing@OpenSSL.org.
 5. Products derived from this software may not be called "OpenSSL"
   nor may "OpenSSL" appear in their names without prior written
   permission of the OpenSSL Project.
 6. Redistributions of any form whatsoever must retain the following
   acknowledgment:
   "This product includes software developed by the OpenSSL Project
   for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
 THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
 EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
 ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 OF THE POSSIBILITY OF SUCH DAMAGE.
 -----------------------------------------------------------------------------
 Copyright (c) 1995, 1997, 1998 The NetBSD Foundation, Inc.
 All rights reserved.
@@ -104,7 +104,7 @@ PLATFORMS: PLATFORMS.md
 		sed -e '$${/^$$/d;}' > $@
 CODE_OF_CONDUCT: CODE_OF_CONDUCT.md
-	${PANDOC} --email-obfuscation=none -s --metadata title="CODE OF CONDUCT" -f markdown-smart -t html CODE_OF_CONDUCT.md | \
+	${PANDOC} --email-obfuscation=none -s --metadata title="CODE OF CONDUCT" -f markdown-smart -t html $< | \
 		${W3M} -dump -cols 75 -O ascii -T text/html | \
 		sed -e '$${/^$$/d;}' > $@
@@ -3,30 +3,11 @@ PLATFORMS
 Supported platforms
 In general, this version of BIND will build and run on any POSIX-compliant
-system with a C11-compliant C compiler, BSD-style sockets with
+system with a C99-compliant C compiler, BSD-style sockets with
-RFC-compliant IPv6 support, POSIX-compliant threads, the libuv
+RFC-compliant IPv6 support, POSIX-compliant threads, and the OpenSSL
-asynchronous I/O library, and the OpenSSL cryptography library.
+cryptography library. Atomic operations support from the compiler is
-
+needed, either in the form of builtin operations, C11 atomics or the
-The following C11 features are used in BIND 9:
+Interlocked family of functions on Windows.
  * Atomic operations support from the compiler is needed, either in the
    form of builtin operations, C11 atomics, or the Interlocked family of
    functions on Windows.
  * Thread Local Storage support from the compiler is needed, either in
    the form of C11 _Thread_local/thread_local, the __thread GCC
    extension, or the __declspec(thread) MSVC extension on Windows.
 BIND 9.15 requires a fairly recent version of libuv (at least 1.x). For
 some of the older systems listed below, you will have to install an
 updated libuv package from sources such as EPEL, PPA, or other native
 sources for updated packages. The other option is to build and install
 libuv from source.
 Certain optional BIND features have additional library dependencies. These
 include libxml2 and libjson-c for statistics, libmaxminddb for
 geolocation, libfstrm and libprotobuf-c for DNSTAP, and libidn2 for
 internationalized domain name conversion.
 ISC regularly tests BIND on many operating systems and architectures, but
 lacks the resources to test all of them. Consequently, ISC is only able to
@@ -34,16 +15,15 @@ offer support on a "best effort" basis for some.
 Regularly tested platforms
-As of Dec 2019, BIND 9.15 is fully supported and regularly tested on the
+As of Feb 2019, BIND 9.15 is fully supported and regularly tested on the
 following systems:
-  * Debian 9, 10
+  * Debian 8, 9, 10
-  * Ubuntu LTS 16.04, 18.04
+  * Ubuntu 16.04, 18.04
-  * Fedora 31
+  * Fedora 28, 29
-  * Red Hat Enterprise Linux / CentOS 7, 8
+  * Red Hat Enterprise Linux / CentOS 6, 7
-  * FreeBSD 11.3, 12.0
+  * FreeBSD 11.x
-  * OpenBSD 6.5
+  * OpenBSD 6.2, 6.3
  * Alpine Linux
 The amd64, i386, armhf and arm64 CPU architectures are all fully
 supported.
@@ -60,30 +40,17 @@ Server 2012 R2, none of these are tested regularly by ISC.
  * Windows 10 / x64
  * macOS 10.12+
  * Solaris 11
  * FreeBSD 10.x, 12.0+
  * OpenBSD 6.4+
  * NetBSD
  * Other Linux distributions still supported by their vendors, such as:
-      + Ubuntu 19.04+
+      + Ubuntu 14.04, 18.10+
      + Gentoo
      + Arch Linux
      + Alpine Linux
  * OpenWRT/LEDE 17.01+
  * Other CPU architectures (mips, mipsel, sparc, ...)
 Community maintained
 These systems may not all have the required dependencies for building BIND
 easily available, although it will be possible in many cases to compile
 those directly from source. The community and interested parties may wish
 to help with maintenance, and we welcome patch contributions, although we
 cannot guarantee that we will accept them. All contributions will be
 assessed against the risk of adverse effect on officially supported
 platforms.
  * Platforms past or close to their respective EOL dates, such as:
      + Ubuntu 14.04, 18.10
      + CentOS 6
      + Debian Jessie
      + FreeBSD 10.x
 Unsupported platforms
 These are platforms on which BIND 9.15 is known not to build or run:
@@ -96,4 +63,13 @@ These are platforms on which BIND 9.15 is known not to build or run:
  * Platforms that don't support atomic operations (via compiler or
    library)
  * Linux without NPTL (Native POSIX Thread Library)
-  * Platforms on which libuv cannot be compiled
+
 Platform quirks
 NetBSD 6 i386
 The i386 build of NetBSD requires the libatomic library, available from
 the gcc5-libs package. Because this library is in a non-standard path, its
 location must be specified in the configure command line:
 LDFLAGS="-L/usr/pkg/gcc5/i486--netbsdelf/lib/ -Wl,-R/usr/pkg/gcc5/i486--netbsdelf/lib/" ./configure
@@ -11,30 +11,11 @@
 ## Supported platforms
 In general, this version of BIND will build and run on any POSIX-compliant
-system with a C11-compliant C compiler, BSD-style sockets with RFC-compliant
+system with a C99-compliant C compiler, BSD-style sockets with RFC-compliant
-IPv6 support, POSIX-compliant threads, the `libuv` asynchronous I/O library,
+IPv6 support, POSIX-compliant threads, and the OpenSSL cryptography library.
-and the OpenSSL cryptography library.
+Atomic operations support from the compiler is needed, either in the form of
-
+builtin operations, C11 atomics or the Interlocked family of functions on
-The following C11 features are used in BIND 9:
+Windows.
 * Atomic operations support from the compiler is needed, either in the form of
  builtin operations, C11 atomics, or the `Interlocked` family of functions on
  Windows.
 * Thread Local Storage support from the compiler is needed, either in the form
  of C11 `_Thread_local`/`thread_local`, the `__thread` GCC extension, or
  the `__declspec(thread)` MSVC extension on Windows.
 BIND 9.15 requires a fairly recent version of `libuv` (at least 1.x).  For
 some of the older systems listed below, you will have to install an updated
 `libuv` package from sources such as EPEL, PPA, or other native sources for
 updated packages. The other option is to build and install `libuv` from
 source.
 Certain optional BIND features have additional library dependencies.
 These include `libxml2` and `libjson-c` for statistics, `libmaxminddb` for
 geolocation, `libfstrm` and `libprotobuf-c` for DNSTAP, and `libidn2` for
 internationalized domain name conversion.
 ISC regularly tests BIND on many operating systems and architectures, but
 lacks the resources to test all of them. Consequently, ISC is only able to
@@ -42,16 +23,15 @@ offer support on a "best effort" basis for some.
 ### Regularly tested platforms
-As of Dec 2019, BIND 9.15 is fully supported and regularly tested on the
+As of Feb 2019, BIND 9.15 is fully supported and regularly tested on the
 following systems:
-* Debian 9, 10
+* Debian 8, 9, 10
-* Ubuntu LTS 16.04, 18.04
+* Ubuntu 16.04, 18.04
-* Fedora 31
+* Fedora 28, 29
-* Red Hat Enterprise Linux / CentOS 7, 8
+* Red Hat Enterprise Linux / CentOS 6, 7
-* FreeBSD 11.3, 12.0
+* FreeBSD 11.x
-* OpenBSD 6.5
+* OpenBSD 6.2, 6.3
 * Alpine Linux
 The amd64, i386, armhf and arm64 CPU architectures are all fully supported.
@@ -67,30 +47,17 @@ Server 2012 R2, none of these are tested regularly by ISC.
 * Windows 10 / x64
 * macOS 10.12+
 * Solaris 11
 * FreeBSD 10.x, 12.0+
 * OpenBSD 6.4+
 * NetBSD
 * Other Linux distributions still supported by their vendors, such as:
-    * Ubuntu 19.04+
+    * Ubuntu 14.04, 18.10+
    * Gentoo
    * Arch Linux
    * Alpine Linux
 * OpenWRT/LEDE 17.01+
 * Other CPU architectures (mips, mipsel, sparc, ...)
 ### Community maintained
 These systems may not all have the required dependencies for building BIND
 easily available, although it will be possible in many cases to compile
 those directly from source. The community and interested parties may wish
 to help with maintenance, and we welcome patch contributions, although we
 cannot guarantee that we will accept them.  All contributions will be
 assessed against the risk of adverse effect on officially supported
 platforms.
 * Platforms past or close to their respective EOL dates, such as:
    * Ubuntu 14.04, 18.10
    * CentOS 6
    * Debian Jessie
    * FreeBSD 10.x
 ## Unsupported platforms
 These are platforms on which BIND 9.15 is known *not* to build or run:
@@ -102,4 +69,15 @@ These are platforms on which BIND 9.15 is known *not* to build or run:
 * Platforms that don't support IPv6 Advanced Socket API (RFC 3542)
 * Platforms that don't support atomic operations (via compiler or library)
 * Linux without NPTL (Native POSIX Thread Library)
-* Platforms on which `libuv` cannot be compiled
+
 ## Platform quirks
 ### NetBSD 6 i386
 The i386 build of NetBSD requires the `libatomic` library, available from
 the `gcc5-libs` package.  Because this library is in a non-standard path,
 its location must be specified in the `configure` command line:
 ```
 LDFLAGS="-L/usr/pkg/gcc5/i486--netbsdelf/lib/ -Wl,-R/usr/pkg/gcc5/i486--netbsdelf/lib/" ./configure
 ```
@@ -48,8 +48,8 @@ the file HISTORY.
 For a detailed list of changes made throughout the history of BIND 9, see
 the file CHANGES. See below for details on the CHANGES file format.
-For up-to-date versions and release notes, see https://www.isc.org/
+For up-to-date release notes and errata, see http://www.isc.org/software/
-download/.
+bind9/releasenotes
 For information about supported platforms, see PLATFORMS.
@@ -71,9 +71,6 @@ If the bug you are reporting is a potential security issue, such as an
 assertion failure or other crash in named, please do NOT use GitLab to
 report it. Instead, please send mail to security-officer@isc.org.
 For a general overview of ISC security policies, read the Knowledge Base
 article at https://kb.isc.org/docs/aa-00861.
 Professional support and training for BIND are available from ISC at
 https://www.isc.org/support.
@@ -94,7 +91,7 @@ General information: CONTRIBUTING.md - Code of Conduct: CODE_OF_CONDUCT.md
 - BIND 9 code style: doc/dev/style.md - BIND architecture and developer
 guide: doc/dev/dev.md
-Patches for BIND may be submitted as merge requests in the ISC GitLab
+Patches for BIND may be submitted as Merge Requests in the ISC GitLab
 server at at https://gitlab.isc.org/isc-projects/bind9/merge_requests.
 By default, external contributors don't have ability to fork BIND in the
@@ -111,33 +108,26 @@ BIND 9.15 features
 BIND 9.15 is the newest development branch of BIND 9. It includes a number
 of changes from BIND 9.14 and earlier releases. New features include:
  * New "dnssec-policy" statement to configure a key and signing policy
    for zones, enabling automatic key regeneration and rollover.
  * New new network manager based on libuv.
  * Support for the new GeoIP2 geolocation API
-  * Improved DNSSEC trust anchor configuration using the trust-anchors
+  * Improved DNSSEC key configuration using dnssec-keys
    statement, permitting configuration of trust anchors in DS as well as
    DNSKEY format.
  * YAML output for dig, mdig, and delv.
 Building BIND
 Minimally, BIND requires a UNIX or Linux system with an ANSI C compiler,
-basic POSIX support, and a 64-bit integer type. BIND also requires the
+basic POSIX support, and a 64-bit integer type. Successful builds have
-libuv asynchronous I/O library, and a cryptography provider library such
+been observed on many versions of Linux and UNIX, including RedHat,
-as OpenSSL or a hardware service module supporting PKCS#11. On Linux, BIND
+Fedora, Debian, Ubuntu, SuSE, Slackware, FreeBSD, NetBSD, OpenBSD, Mac OS
-requires the libcap library to set process privileges, though this
+X, Solaris, HP-UX, and OpenWRT.
 requirement can be overridden by disabling capability support at compile
 time. See Compile-time options below for details on other libraries that
 may be required to support optional features.
-Successful builds have been observed on many versions of Linux and UNIX,
+BIND requires a cryptography provider library such as OpenSSL or a
-including RHEL/CentOS, Fedora, Debian, Ubuntu, SLES, openSUSE, Slackware,
+hardware service module supporting PKCS#11. On Linux, BIND requires the
-Alpine, FreeBSD, NetBSD, OpenBSD, macOS, Solaris, OpenIndiana, OmniOS CE,
+libcap library to set process privileges, though this requirement can be
-HP-UX, and OpenWRT.
+overridden by disabling capability support at compile time. See
 Compile-time options below for details on other libraries that may be
 required to support optional features.
-BIND is also available for Windows Server 2012 R2 and higher. See win32utils/
+BIND is also available for Windows 2008 and higher. See win32utils/
-build.txt for details on building for Windows systems.
+readme1st.txt for details on building for Windows systems.
 To build on a UNIX or Linux system, use:
@@ -165,25 +155,26 @@ STD_CDEFINES   Defaults to empty string. For a list of possible settings,
 LDFLAGS        Linker flags. Defaults to empty string.
 BUILD_CC       Needed when cross-compiling: the native C compiler to use
               when building for the target system.
-BUILD_CFLAGS   CFLAGS for the target system during cross-compiling.
+BUILD_CFLAGS   Optional, used for cross-compiling
-BUILD_CPPFLAGS CPPFLAGS for the target system during cross-compiling.
+BUILD_CPPFLAGS
-BUILD_LDFLAGS  LDFLAGS for the target system during cross-compiling.
+BUILD_LDFLAGS
-BUILD_LIBS     LIBS for the target system during cross-compiling.
+BUILD_LIBS
 macOS
 Building on macOS assumes that the "Command Tools for Xcode" is installed.
 This can be downloaded from https://developer.apple.com/download/more/ or
-if you have Xcode already installed you can run xcode-select --install.
+if you have Xcode already installed you can run "xcode-select --install".
 This will add /usr/include to the system and install the compiler and
 other tools so that they can be easily found.
 Dependencies
 Portions of BIND that are written in Python, including dnssec-keymgr,
 dnssec-coverage, dnssec-checkds, and some of the system tests, require the
-argparse, ply and distutils.core modules to be available. argparse is a
+'argparse' and 'ply' modules to be available. 'argparse' is a standard
-standard module as of Python 2.7 and Python 3.2. ply is available from
+module as of Python 2.7 and Python 3.2. 'ply' is available from https://
-https://pypi.python.org/pypi/ply. distutils.core is required for
+pypi.python.org/pypi/ply.
 installation.
 Compile-time options
@@ -201,9 +192,8 @@ operations, specify the path to the PKCS#11 provider library using
 --with-pkcs11=<PREFIX>, and configure BIND with --enable-native-pkcs11.
 To support the HTTP statistics channel, the server must be linked with at
-least one of the following libraries: libxml2 http://xmlsoft.org or json-c
+least one of the following: libxml2 http://xmlsoft.org or json-c https://
-https://github.com/json-c/json-c. If these are installed at a nonstandard
+github.com/json-c. If these are installed at a nonstandard location, then:
 location, then:
  * for libxml2, specify the prefix using --with-libxml2=/prefix,
  * for json-c, adjust PKG_CONFIG_PATH.
@@ -236,8 +226,8 @@ smaller systems.
 On Linux, process capabilities are managed in user space using the libcap
 library, which can be installed on most Linux systems via the libcap-dev
-or libcap-devel package. Process capability support can also be disabled
+or libcap-devel module. Process capability support can also be disabled by
-by configuring with --disable-linux-caps.
+configuring with --disable-linux-caps.
 On some platforms it is necessary to explicitly request large file support
 to handle files bigger than 2GB. This can be done by using
@@ -271,7 +261,7 @@ ifconfig.sh up as root.
 Some tests require Perl and the Net::DNS and/or IO::Socket::INET6 modules,
 and will be skipped if these are not available. Some tests require Python
-and the dnspython module and will be skipped if these are not available.
+and the 'dnspython' module and will be skipped if these are not available.
 See bin/tests/system/README for further details.
 Unit tests are implemented using the CMocka unit testing framework. To
@@ -282,7 +272,7 @@ tests can be run via make test or make unit.
 Documentation
 The BIND 9 Administrator Reference Manual is included with the source
-distribution, in DocBook XML, HTML, and PDF format, in the doc/arm
+distribution, in DocBook XML, HTML and PDF format, in the doc/arm
 directory.
 Some of the programs in the BIND 9 distribution have man pages in their
@@ -337,16 +327,16 @@ issue number. Prior to 2018, these were usually of the form [RT #NNN] and
 referred to entries in the "bind9-bugs" RT database, which was not open to
 the public. More recent entries use the form [GL #NNN] or, less often, [GL
 !NNN], which, respectively, refer to issues or merge requests in the
-GitLab database. Most of these are publicly readable, unless they include
+Gitlab database. Most of these are publicly readable, unless they include
-information which is confidential or security sensitive.
+information which is confidential or security senstive.
-To look up a GitLab issue by its number, use the URL https://
+To look up a Gitlab issue by its number, use the URL https://
 gitlab.isc.org/isc-projects/bind9/issues/NNN. To look up a merge request,
 use https://gitlab.isc.org/isc-projects/bind9/merge_requests/NNN.
 In rare cases, an issue or merge request number may be followed with the
 letter "P". This indicates that the information is in the private ISC
-GitLab instance, which is not visible to the public.
+Gitlab instance, which is not visible to the public.
 Acknowledgments
@@ -57,8 +57,8 @@ For a detailed list of changes made throughout the history of BIND 9, see
 the file [CHANGES](CHANGES). See [below](#changes) for details on the
 CHANGES file format.
-For up-to-date versions and release notes, see
+For up-to-date release notes and errata, see
-[https://www.isc.org/download/](https://www.isc.org/download/).
+[http://www.isc.org/software/bind9/releasenotes](http://www.isc.org/software/bind9/releasenotes)
 For information about supported platforms, see [PLATFORMS](PLATFORMS.md).
@@ -82,9 +82,6 @@ assertion failure or other crash in `named`, please do *NOT* use GitLab to
 report it. Instead, please send mail to
 [security-officer@isc.org](mailto:security-officer@isc.org).
 For a general overview of ISC security policies, read the Knowledge Base
 article at [https://kb.isc.org/docs/aa-00861](https://kb.isc.org/docs/aa-00861).
 Professional support and training for BIND are available from
 ISC at [https://www.isc.org/support](https://www.isc.org/support).
@@ -107,7 +104,7 @@ Information for BIND contributors can be found in the following files:
 - BIND architecture and developer guide: [doc/dev/dev.md](doc/dev/dev.md)
 Patches for BIND may be submitted as
-[merge requests](https://gitlab.isc.org/isc-projects/bind9/merge_requests)
+[Merge Requests](https://gitlab.isc.org/isc-projects/bind9/merge_requests)
 in the [ISC GitLab server](https://gitlab.isc.org) at
 at [https://gitlab.isc.org/isc-projects/bind9/merge_requests](https://gitlab.isc.org/isc-projects/bind9/merge_requests).
@@ -127,34 +124,27 @@ BIND 9.15 is the newest development branch of BIND 9. It includes a
 number of changes from BIND 9.14 and earlier releases. New features
 include:
 * New "dnssec-policy" statement to configure a key and signing policy
  for zones, enabling automatic key regeneration and rollover.
 * New new network manager based on libuv.
 * Support for the new GeoIP2 geolocation API
-* Improved DNSSEC trust anchor configuration using the `trust-anchors`
+* Improved DNSSEC key configuration using `dnssec-keys`
-  statement, permitting configuration of trust anchors in DS as well as
+* YAML output for dig, mdig, and delv.
  DNSKEY format.
 * YAML output for `dig`, `mdig`, and `delv`.
 ### <a name="build"/> Building BIND
 Minimally, BIND requires a UNIX or Linux system with an ANSI C compiler,
-basic POSIX support, and a 64-bit integer type.  BIND also requires the
+basic POSIX support, and a 64-bit integer type. Successful builds have been
-`libuv` asynchronous I/O library, and a cryptography provider library
+observed on many versions of Linux and UNIX, including RedHat, Fedora,
-such as OpenSSL or a hardware service module supporting PKCS#11. On
+Debian, Ubuntu, SuSE, Slackware, FreeBSD, NetBSD, OpenBSD, Mac OS X,
-Linux, BIND requires the `libcap` library to set process privileges,
+Solaris, HP-UX, and OpenWRT.
 though this requirement can be overridden by disabling capability
 support at compile time. See [Compile-time options](#opts) below
 for details on other libraries that may be required to support
 optional features.
-Successful builds have been observed on many versions of Linux and
+BIND requires a cryptography provider library such as OpenSSL or a
-UNIX, including RHEL/CentOS, Fedora, Debian, Ubuntu, SLES, openSUSE,
+hardware service module supporting PKCS#11. On Linux, BIND requires
-Slackware, Alpine, FreeBSD, NetBSD, OpenBSD, macOS, Solaris,
+the `libcap` library to set process privileges, though this requirement
-OpenIndiana, OmniOS CE, HP-UX, and OpenWRT.
+can be overridden by disabling capability support at compile time.
 See [Compile-time options](#opts) below for details on other libraries
 that may be required to support optional features.
-BIND is also available for Windows Server 2012 R2 and higher.  See
+BIND is also available for Windows 2008 and higher.  See
-`win32utils/build.txt` for details on building for Windows
+`win32utils/readme1st.txt` for details on building for Windows
 systems.
 To build on a UNIX or Linux system, use:
@@ -176,26 +166,26 @@ affect compilation:
 |`STD_CDEFINES`|Any additional preprocessor symbols you want defined.  Defaults to empty string. For a list of possible settings, see the file [OPTIONS](OPTIONS.md).|
 |`LDFLAGS`|Linker flags. Defaults to empty string.|
 |`BUILD_CC`|Needed when cross-compiling: the native C compiler to use when building for the target system.|
-|`BUILD_CFLAGS`|`CFLAGS` for the target system during cross-compiling.|
+|`BUILD_CFLAGS`|Optional, used for cross-compiling|
-|`BUILD_CPPFLAGS`|`CPPFLAGS` for the target system during cross-compiling.|
+|`BUILD_CPPFLAGS`||
-|`BUILD_LDFLAGS`|`LDFLAGS` for the target system during cross-compiling.|
+|`BUILD_LDFLAGS`||
-|`BUILD_LIBS`|`LIBS` for the target system during cross-compiling.|
+|`BUILD_LIBS`||
 #### <a name="macos"> macOS
 Building on macOS assumes that the "Command Tools for Xcode" is installed.
-This can be downloaded from [https://developer.apple.com/download/more/](https://developer.apple.com/download/more/)
+This can be downloaded from https://developer.apple.com/download/more/
-or if you have Xcode already installed you can run `xcode-select --install`.
+or if you have Xcode already installed you can run "xcode-select --install".
 This will add /usr/include to the system and install the compiler and other
 tools so that they can be easily found.
 ### <a name="dependencies"/> Dependencies
 Portions of BIND that are written in Python, including
 `dnssec-keymgr`, `dnssec-coverage`, `dnssec-checkds`, and some of the
-system tests, require the `argparse`, `ply` and `distutils.core` modules
+system tests, require the 'argparse' and 'ply' modules to be available.
-to be available.
+'argparse' is a standard module as of Python 2.7 and Python 3.2.
-`argparse` is a standard module as of Python 2.7 and Python 3.2.
+'ply' is available from [https://pypi.python.org/pypi/ply](https://pypi.python.org/pypi/ply).
 `ply` is available from [https://pypi.python.org/pypi/ply](https://pypi.python.org/pypi/ply).
 `distutils.core` is required for installation.
 #### <a name="opts"/> Compile-time options
@@ -213,16 +203,16 @@ path to the PKCS#11 provider library using `--with-pkcs11=<PREFIX>`, and
 configure BIND with `--enable-native-pkcs11`.
 To support the HTTP statistics channel, the server must be linked with at
-least one of the following libraries: `libxml2`
+least one of the following: libxml2
-[http://xmlsoft.org](http://xmlsoft.org) or `json-c`
+[http://xmlsoft.org](http://xmlsoft.org) or json-c
-[https://github.com/json-c/json-c](https://github.com/json-c/json-c).
+[https://github.com/json-c](https://github.com/json-c).  If these are
-If these are installed at a nonstandard location, then:
+installed at a nonstandard location, then:
-* for `libxml2`, specify the prefix using `--with-libxml2=/prefix`,
+* for libxml2, specify the prefix using `--with-libxml2=/prefix`,
-* for `json-c`, adjust `PKG_CONFIG_PATH`.
+* for json-c, adjust `PKG_CONFIG_PATH`.
 To support compression on the HTTP statistics channel, the server must be
-linked against `libzlib`.  If this is installed in a nonstandard location,
+linked against libzlib.  If this is installed in a nonstandard location,
 specify the prefix using `--with-zlib=/prefix`.
 To support storing configuration data for runtime-added zones in an LMDB
@@ -235,9 +225,9 @@ found; if the library is installed in a nonstandard location,
 specify the prefix using `--with-maxminddb=/prefix`. GeoIP2 support
 can be switched off with `--disable-geoip`.
-For DNSTAP packet logging, you must have installed `libfstrm`
+For DNSTAP packet logging, you must have installed libfstrm
 [https://github.com/farsightsec/fstrm](https://github.com/farsightsec/fstrm)
-and `libprotobuf-c`
+and libprotobuf-c
 [https://developers.google.com/protocol-buffers](https://developers.google.com/protocol-buffers),
 and BIND must be configured with `--enable-dnstap`.
@@ -250,7 +240,7 @@ performance on smaller systems.
 On Linux, process capabilities are managed in user space using
 the `libcap` library, which can be installed on most Linux systems via
-the `libcap-dev` or `libcap-devel` package. Process capability support can
+the `libcap-dev` or `libcap-devel` module. Process capability support can
 also be disabled by configuring with `--disable-linux-caps`.
 On some platforms it is necessary to explicitly request large file support
@@ -283,21 +273,20 @@ multiple servers to run locally and communicate with one another).  These
 IP addresses can be configured by running the command
 `bin/tests/system/ifconfig.sh up` as root.
-Some tests require Perl and the `Net::DNS` and/or `IO::Socket::INET6` modules,
+Some tests require Perl and the Net::DNS and/or IO::Socket::INET6 modules,
 and will be skipped if these are not available. Some tests require Python
-and the `dnspython` module and will be skipped if these are not available.
+and the 'dnspython' module and will be skipped if these are not available.
 See bin/tests/system/README for further details.
-Unit tests are implemented using the [CMocka unit testing framework](https://cmocka.org/).
+Unit tests are implemented using the CMocka unit testing framework.
 To build them, use `configure --with-cmocka`. Execution of tests is done
-by the [Kyua test execution engine](https://github.com/jmmv/kyua); if the
+by the Kyua test execution engine; if the `kyua` command is available,
-`kyua` command is available, then unit tests can be run via `make test`
+then unit tests can be run via `make test` or `make unit`.
 or `make unit`.
 ### <a name="doc"/> Documentation
 The *BIND 9 Administrator Reference Manual* is included with the source
-distribution, in DocBook XML, HTML, and PDF format, in the `doc/arm`
+distribution, in DocBook XML, HTML and PDF format, in the `doc/arm`
 directory.
 Some of the programs in the BIND 9 distribution have man pages in their
@@ -347,17 +336,17 @@ issue number. Prior to 2018, these were usually of the form `[RT #NNN]`
 and referred to entries in the "bind9-bugs" RT database, which was not open
 to the public. More recent entries use the form `[GL #NNN]` or, less often,
 `[GL !NNN]`, which, respectively, refer to issues or merge requests in the
-GitLab database. Most of these are publicly readable, unless they include
+Gitlab database. Most of these are publicly readable, unless they include
-information which is confidential or security sensitive.
+information which is confidential or security senstive.
-To look up a GitLab issue by its number, use the URL
+To look up a Gitlab issue by its number, use the URL
 [https://gitlab.isc.org/isc-projects/bind9/issues/NNN](https://gitlab.isc.org/isc-projects/bind9/issues).
 To look up a merge request, use
 [https://gitlab.isc.org/isc-projects/bind9/merge_requests/NNN](https://gitlab.isc.org/isc-projects/bind9/merge_requests).
 In rare cases, an issue or merge request number may be followed with the
 letter "P". This indicates that the information is in the private ISC
-GitLab instance, which is not visible to the public.
+Gitlab instance, which is not visible to the public.
 ### <a name="ack"/> Acknowledgments
@@ -127,7 +127,9 @@ add(char *key, int value) {
 	isc_symvalue_t symvalue;
 	if (sym_mctx == NULL) {
-		isc_mem_create(&sym_mctx);
+		result = isc_mem_create(0, 0, &sym_mctx);
 		if (result != ISC_R_SUCCESS)
 			return;
 	}
 	if (symtab == NULL) {
@@ -716,7 +718,7 @@ dump_zone(const char *zonename, dns_zone_t *zone, const char *filename,
 	FILE *output = stdout;
 	const char *flags;
-	flags = (fileformat == dns_masterformat_text) ? "w" : "wb";
+	flags = (fileformat == dns_masterformat_text) ? "w+" : "wb+";
 	if (debug) {
 		if (filename != NULL && strcmp(filename, "-") != 0)
@@ -421,7 +421,7 @@ configure_zone(const char *vclass, const char *view,
 	obj = NULL;
 	if (get_maps(maps, "max-zone-ttl", &obj)) {
-		maxttl = cfg_obj_asduration(obj);
+		maxttl = cfg_obj_asuint32(obj);
 		zone_options |= DNS_ZONEOPT_CHECKTTL;
 	}
@@ -585,7 +585,7 @@ main(int argc, char **argv) {
 	}
 	isc_commandline_reset = true;
-	isc_mem_create(&mctx);
+	RUNTIME_CHECK(isc_mem_create(0, 0, &mctx) == ISC_R_SUCCESS);
 	while ((c = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != EOF) {
 		switch (c) {
@@ -709,6 +709,8 @@ main(int argc, char **argv) {
 	cfg_parser_destroy(&parser);
 	dns_name_destroy();
 	isc_log_destroy(&logc);
 	isc_mem_destroy(&mctx);
@@ -41,7 +41,6 @@
      <year>2016</year>
      <year>2018</year>
      <year>2019</year>
      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -85,9 +85,9 @@ usage(void) {
 static void
 destroy(void) {
-	if (zone != NULL) {
+	if (zone != NULL)
 		dns_zone_detach(&zone);
-	}
+	dns_name_destroy();
 }
 /*% main processing routine */
@@ -517,7 +517,7 @@ main(int argc, char **argv) {
 	InitSockets();
 #endif
-	isc_mem_create(&mctx);
+	RUNTIME_CHECK(isc_mem_create(0, 0, &mctx) == ISC_R_SUCCESS);
 	if (!quiet)
 		RUNTIME_CHECK(setup_logging(mctx, errout, &lctx)
 			      == ISC_R_SUCCESS);
@@ -44,7 +44,6 @@
      <year>2016</year>
      <year>2018</year>
      <year>2019</year>
      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <ItemGroup Label="ProjectConfigurations">
    <ProjectConfiguration Include="Debug|@PLATFORM@">
      <Configuration>Debug</Configuration>
@@ -14,21 +14,18 @@
    <ProjectGuid>{03A96113-CB14-43AA-AEB2-48950E3915C5}</ProjectGuid>
    <Keyword>Win32Proj</Keyword>
    <RootNamespace>checkconf</RootNamespace>
    @WINDOWS_TARGET_PLATFORM_VERSION@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>true</UseDebugLibraries>
    <CharacterSet>MultiByte</CharacterSet>
    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>false</UseDebugLibraries>
    <WholeProgramOptimization>true</WholeProgramOptimization>
    <CharacterSet>MultiByte</CharacterSet>
    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
  <ImportGroup Label="ExtensionSettings">
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <ItemGroup Label="ProjectConfigurations">
    <ProjectConfiguration Include="Debug|@PLATFORM@">
      <Configuration>Debug</Configuration>
@@ -17,21 +17,18 @@
    <ProjectGuid>{2C1F7096-C5B5-48D4-846F-A7ACA454335D}</ProjectGuid>
    <Keyword>Win32Proj</Keyword>
    <RootNamespace>checktool</RootNamespace>
    @WINDOWS_TARGET_PLATFORM_VERSION@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>StaticLibrary</ConfigurationType>
    <UseDebugLibraries>true</UseDebugLibraries>
    <CharacterSet>MultiByte</CharacterSet>
    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>StaticLibrary</ConfigurationType>
    <UseDebugLibraries>false</UseDebugLibraries>
    <WholeProgramOptimization>true</WholeProgramOptimization>
    <CharacterSet>MultiByte</CharacterSet>
    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
  <ImportGroup Label="ExtensionSettings">
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <ItemGroup Label="ProjectConfigurations">
    <ProjectConfiguration Include="Debug|@PLATFORM@">
      <Configuration>Debug</Configuration>
@@ -14,21 +14,18 @@
    <ProjectGuid>{66028555-7DD5-4016-B601-9EF9A1EE8BFA}</ProjectGuid>
    <Keyword>Win32Proj</Keyword>
    <RootNamespace>checkzone</RootNamespace>
    @WINDOWS_TARGET_PLATFORM_VERSION@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>true</UseDebugLibraries>
    <CharacterSet>MultiByte</CharacterSet>
    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>false</UseDebugLibraries>
    <WholeProgramOptimization>true</WholeProgramOptimization>
    <CharacterSet>MultiByte</CharacterSet>
    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
  <ImportGroup Label="ExtensionSettings">
@@ -66,15 +63,15 @@
      <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
      <BrowseInformation>true</BrowseInformation>
      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
-      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;..\..\..\lib\bind9\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
      <CompileAs>CompileAsC</CompileAs>
    </ClCompile>
    <Link>
      <SubSystem>Console</SubSystem>
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
    <PostBuildEvent>
      <Command>cd ..\..\..\Build\$(Configuration)
@@ -100,7 +97,7 @@ copy /Y named-checkzone.ilk named-compilezone.ilk
      <ObjectFileName>.\$(Configuration)\</ObjectFileName>
      <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
-      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;..\..\..\lib\bind9\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
      <CompileAs>CompileAsC</CompileAs>
    </ClCompile>
    <Link>
@@ -109,8 +106,8 @@ copy /Y named-checkzone.ilk named-compilezone.ilk
      <EnableCOMDATFolding>true</EnableCOMDATFolding>
      <OptimizeReferences>true</OptimizeReferences>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
    </Link>
    <PostBuildEvent>
@@ -207,7 +207,7 @@ main(int argc, char **argv) {
 	/* Use canonical algorithm name */
 	algname = alg_totext(alg);
-	isc_mem_create(&mctx);
+	DO("create memory context", isc_mem_create(0, 0, &mctx));
 	if (keyname == NULL) {
 		const char *suffix = NULL;
@@ -38,7 +38,6 @@
      <year>2016</year>
      <year>2018</year>
      <year>2019</year>
      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -209,7 +209,7 @@ main(int argc, char **argv) {
 		keysize = alg_bits(alg);
 	algname = alg_totext(alg);
-	isc_mem_create(&mctx);
+	DO("create memory context", isc_mem_create(0, 0, &mctx));
 	isc_buffer_init(&key_txtbuffer, &key_txtsecret, sizeof(key_txtsecret));
 	generate_key(mctx, alg, keysize, &key_txtbuffer);
@@ -45,7 +45,6 @@
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <ItemGroup Label="ProjectConfigurations">
    <ProjectConfiguration Include="Debug|@PLATFORM@">
      <Configuration>Debug</Configuration>
@@ -14,21 +14,18 @@
    <ProjectGuid>{64964B03-4815-41F0-9057-E766A94AF197}</ProjectGuid>
    <Keyword>Win32Proj</Keyword>
    <RootNamespace>confgentool</RootNamespace>
    @WINDOWS_TARGET_PLATFORM_VERSION@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>StaticLibrary</ConfigurationType>
    <UseDebugLibraries>true</UseDebugLibraries>
    <CharacterSet>MultiByte</CharacterSet>
    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>StaticLibrary</ConfigurationType>
    <UseDebugLibraries>false</UseDebugLibraries>
    <WholeProgramOptimization>true</WholeProgramOptimization>
    <CharacterSet>MultiByte</CharacterSet>
    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
  <ImportGroup Label="ExtensionSettings">
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <ItemGroup Label="ProjectConfigurations">
    <ProjectConfiguration Include="Debug|@PLATFORM@">
      <Configuration>Debug</Configuration>
@@ -14,21 +14,18 @@
    <ProjectGuid>{1EA4FC64-F33B-4A50-970A-EA052BBE9CF1}</ProjectGuid>
    <Keyword>Win32Proj</Keyword>
    <RootNamespace>ddnsconfgen</RootNamespace>
    @WINDOWS_TARGET_PLATFORM_VERSION@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>true</UseDebugLibraries>
    <CharacterSet>MultiByte</CharacterSet>
    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>false</UseDebugLibraries>
    <WholeProgramOptimization>true</WholeProgramOptimization>
    <CharacterSet>MultiByte</CharacterSet>
    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
  <ImportGroup Label="ExtensionSettings">
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <ItemGroup Label="ProjectConfigurations">
    <ProjectConfiguration Include="Debug|@PLATFORM@">
      <Configuration>Debug</Configuration>
@@ -14,21 +14,18 @@
    <ProjectGuid>{1E2C1635-3093-4D59-80E7-4743AC10F22F}</ProjectGuid>
    <Keyword>Win32Proj</Keyword>
    <RootNamespace>rndcconfgen</RootNamespace>
    @WINDOWS_TARGET_PLATFORM_VERSION@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>true</UseDebugLibraries>
    <CharacterSet>MultiByte</CharacterSet>
    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>false</UseDebugLibraries>
    <WholeProgramOptimization>true</WholeProgramOptimization>
    <CharacterSet>MultiByte</CharacterSet>
    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
  <ImportGroup Label="ExtensionSettings">
@@ -144,7 +144,7 @@ options\&.
 Note: When reading the trust anchor file,
 \fBdelv\fR
 treats
-\fBtrust\-anchors\fR\fBinitial\-key\fR
+\fBdnssec\-keys\fR\fBinitial\-key\fR
 and
 \fBstatic\-key\fR
 entries identically\&. That is, even if a key is configured with
@@ -409,11 +409,6 @@ Controls whether to use TCP when sending queries\&. The default is to use UDP un
 .RS 4
 Print all RDATA in unknown RR type presentation format (RFC 3597)\&. The default is to print RDATA for known types in the type\*(Aqs presentation format\&.
 .RE
 .PP
 \fB+[no]yaml\fR
 .RS 4
 Print response data in YAML format\&.
 .RE
 .SH "FILES"
 .PP
 /etc/bind\&.keys
@@ -33,10 +33,8 @@
 #include <isc/app.h>
 #include <isc/base64.h>
 #include <isc/buffer.h>
 #include <isc/hex.h>
 #include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/md.h>
 #include <isc/mem.h>
 #ifdef WIN32
 #include <isc/ntpaths.h>
@@ -140,7 +138,7 @@ static dns_fixedname_t afn;
 static dns_name_t *anchor_name = NULL;
 /* Default bind.keys contents */
-static char anchortext[] = TRUST_ANCHORS;
+static char anchortext[] = DNSSEC_KEYS;
 /*
 * Static function prototypes
@@ -160,44 +158,43 @@ usage(void) {
 "        q-class  is one of (in,hs,ch,...) [default: in]\n"
 "        q-type   is one of (a,any,mx,ns,soa,hinfo,axfr,txt,...) [default:a]\n"
 "        q-opt    is one of:\n"
-"                 -4                  (use IPv4 query transport only)\n"
+"                 -x dot-notation     (shortcut for reverse lookups)\n"
-"                 -6                  (use IPv6 query transport only)\n"
+"                 -d level            (set debugging level)\n"
 "                 -a anchor-file      (specify root trust anchor)\n"
 "                 -b address[#port]   (bind to source address/port)\n"
 "                 -c class            (option included for compatibility;\n"
 "                 -d level            (set debugging level)\n"
 "                 -h                  (print help and exit)\n"
 "                 -i                  (disable DNSSEC validation)\n"
 "                 -m                  (enable memory usage debugging)\n"
 "                 -p port             (specify port number)\n"
 "                 -q name             (specify query name)\n"
 "                 -t type             (specify query type)\n"
 "                 -c class            (option included for compatibility;\n"
 "                                      only IN is supported)\n"
-"                 -v                  (print version and exit)\n"
+"                 -4                  (use IPv4 query transport only)\n"
-"                 -x dot-notation     (shortcut for reverse lookups)\n"
+"                 -6                  (use IPv6 query transport only)\n"
 "                 -i                  (disable DNSSEC validation)\n"
 "                 -m                  (enable memory usage debugging)\n"
 "        d-opt    is of the form +keyword[=value], where keyword is:\n"
 "                 +[no]all            (Set or clear all display flags)\n"
 "                 +[no]class          (Control display of class)\n"
 "                 +[no]comments       (Control display of comment lines)\n"
 "                 +[no]crypto         (Control display of cryptographic\n"
 "                                      fields in records)\n"
 "                 +[no]dlv            (Obsolete)\n"
 "                 +[no]dnssec         (Display DNSSEC records)\n"
 "                 +[no]mtrace         (Trace messages received)\n"
 "                 +[no]multiline      (Print records in an expanded format)\n"
-"                 +[no]root           (DNSSEC validation trust anchor)\n"
+"                 +[no]comments       (Control display of comment lines)\n"
 "                 +[no]rrcomments     (Control display of per-record "
 				       "comments)\n"
-"                 +[no]rtrace         (Trace resolver fetches)\n"
+"                 +[no]unknownformat  (Print RDATA in RFC 3597 "
 					"\"unknown\" format)\n"
 "                 +[no]short          (Short form answer)\n"
 "                 +[no]split=##       (Split hex/base64 fields into chunks)\n"
 "                 +[no]tcp            (TCP mode)\n"
 "                 +[no]ttl            (Control display of ttls in records)\n"
 "                 +[no]trust          (Control display of trust level)\n"
-"                 +[no]unknownformat  (Print RDATA in RFC 3597 "
+"                 +[no]rtrace         (Trace resolver fetches)\n"
-					"\"unknown\" format)\n"
+"                 +[no]mtrace         (Trace messages received)\n"
 "                 +[no]vtrace         (Trace validation process)\n"
-"                 +[no]yaml           (Present the results as YAML)\n",
+"                 +[no]dlv            (Obsolete)\n"
 "                 +[no]root           (DNSSEC validation trust anchor)\n"
 "                 +[no]dnssec         (Display DNSSEC records)\n"
 "        -h                           (print help and exit)\n"
 "        -v                           (print version and exit)\n",
 	stderr);
 	exit(1);
 }
@@ -498,17 +495,14 @@ printdata(dns_rdataset_t *rdataset, dns_name_t *owner,
 				dns_rdata_reset(&rdata);
 			}
 		} else {
 			dns_indent_t indent = { "  ", 2 };
 			if (!yaml && (rdataset->attributes &
 				      DNS_RDATASETATTR_NEGATIVE) != 0)
 			{
 				isc_buffer_putstr(&target, "; ");
 			}
 			result = dns_master_rdatasettotext(owner, rdataset,
-							   style,
+							   style, &target);
 							   yaml ? &indent :
 								  NULL,
 							   &target);
 		}
 		if (result == ISC_R_NOSPACE) {
@@ -535,11 +529,13 @@ setup_style(dns_master_style_t **stylep) {
 	isc_result_t result;
 	dns_master_style_t *style = NULL;
-	REQUIRE(stylep != NULL && *stylep == NULL);
+	REQUIRE(stylep != NULL || *stylep == NULL);
 	styleflags |= DNS_STYLEFLAG_REL_OWNER;
 	if (yaml) {
 		styleflags |= DNS_STYLEFLAG_YAML;
 		dns_master_indentstr = "  ";
 		dns_master_indent = 2;
 	} else {
 		if (showcomments) {
 			styleflags |= DNS_STYLEFLAG_COMMENT;
@@ -612,12 +608,11 @@ convert_name(dns_fixedname_t *fn, dns_name_t **name, const char *text) {
 static isc_result_t
 key_fromconfig(const cfg_obj_t *key, dns_client_t *client) {
-	dns_rdata_dnskey_t dnskey;
+	dns_rdata_dnskey_t keystruct;
-	dns_rdata_ds_t ds;
+	uint32_t flags, proto, alg;
-	uint32_t rdata1, rdata2, rdata3;
+	const char *keystr, *keynamestr;
-	const char *datastr = NULL, *keynamestr = NULL, *atstr = NULL;
+	unsigned char keydata[4096];
-	unsigned char data[4096];
+	isc_buffer_t keydatabuf;
 	isc_buffer_t databuf;
 	unsigned char rrdata[4096];
 	isc_buffer_t rrdatabuf;
 	isc_region_t r;
@@ -625,13 +620,6 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client) {
 	dns_name_t *keyname;
 	isc_result_t result;
 	bool match_root = false;
 	enum {
 		INITIAL_KEY,
 		STATIC_KEY,
 		INITIAL_DS,
 		STATIC_DS,
 		TRUSTED
 	} anchortype;
 	keynamestr = cfg_obj_asstring(cfg_tuple_get(key, "name"));
 	CHECK(convert_name(&fkeyname, &keyname, keynamestr));
@@ -647,125 +635,55 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client) {
 	if (!match_root) {
 		return (ISC_R_SUCCESS);
 	}
-
+	if (!root_validation && match_root) {
 	if (!root_validation) {
 		return (ISC_R_SUCCESS);
 	}
-	delv_log(ISC_LOG_DEBUG(3), "adding trust anchor %s", trust_anchor);
+	if (match_root) {
-
+		delv_log(ISC_LOG_DEBUG(3), "adding trust anchor %s",
-	/* if DNSKEY, flags; if DS, key tag */
+			  trust_anchor);
 	rdata1 = cfg_obj_asuint32(cfg_tuple_get(key, "rdata1"));
 	/* if DNSKEY, protocol; if DS, algorithm */
 	rdata2 = cfg_obj_asuint32(cfg_tuple_get(key, "rdata2"));
 	/* if DNSKEY, algorithm; if DS, digest type */
 	rdata3 = cfg_obj_asuint32(cfg_tuple_get(key, "rdata3"));
 	/* What type of trust anchor is this? */
 	atstr = cfg_obj_asstring(cfg_tuple_get(key, "anchortype"));
 	if (strcasecmp(atstr, "static-key") == 0) {
 		anchortype = STATIC_KEY;
 	} else if (strcasecmp(atstr, "static-ds") == 0) {
 		anchortype = STATIC_DS;
 	} else if (strcasecmp(atstr, "initial-key") == 0) {
 		anchortype = INITIAL_KEY;
 	} else if (strcasecmp(atstr, "initial-ds") == 0) {
 		anchortype = INITIAL_DS;
 	} else {
 		delv_log(ISC_LOG_ERROR,
 			 "key '%s': invalid initialization method '%s'",
 			 keynamestr, atstr);
 		result = ISC_R_FAILURE;
 		goto cleanup;
 	}
-	isc_buffer_init(&databuf, data, sizeof(data));
+	flags = cfg_obj_asuint32(cfg_tuple_get(key, "flags"));
 	proto = cfg_obj_asuint32(cfg_tuple_get(key, "protocol"));
 	alg = cfg_obj_asuint32(cfg_tuple_get(key, "algorithm"));
 	keystruct.common.rdclass = dns_rdataclass_in;
 	keystruct.common.rdtype = dns_rdatatype_dnskey;
 	/*
 	 * The key data in keystruct is not dynamically allocated.
 	 */
 	keystruct.mctx = NULL;
 	ISC_LINK_INIT(&keystruct.common, link);
 	if (flags > 0xffff)
 		CHECK(ISC_R_RANGE);
 	if (proto > 0xff)
 		CHECK(ISC_R_RANGE);
 	if (alg > 0xff)
 		CHECK(ISC_R_RANGE);
 	keystruct.flags = (uint16_t)flags;
 	keystruct.protocol = (uint8_t)proto;
 	keystruct.algorithm = (uint8_t)alg;
 	isc_buffer_init(&keydatabuf, keydata, sizeof(keydata));
 	isc_buffer_init(&rrdatabuf, rrdata, sizeof(rrdata));
-	if (rdata1 > 0xffff) {
+	keystr = cfg_obj_asstring(cfg_tuple_get(key, "key"));
-		CHECK(ISC_R_RANGE);
+	CHECK(isc_base64_decodestring(keystr, &keydatabuf));
-	}
+	isc_buffer_usedregion(&keydatabuf, &r);
-	if (rdata2 > 0xff) {
+	keystruct.datalen = r.length;
-		CHECK(ISC_R_RANGE);
+	keystruct.data = r.base;
 	}
 	if (rdata3 > 0xff) {
 		CHECK(ISC_R_RANGE);
 	}
-	switch (anchortype) {
+	CHECK(dns_rdata_fromstruct(NULL,
-	case STATIC_KEY:
+				   keystruct.common.rdclass,
-	case INITIAL_KEY:
+				   keystruct.common.rdtype,
-	case TRUSTED:
+				   &keystruct, &rrdatabuf));
 		dnskey.common.rdclass = dns_rdataclass_in;
 		dnskey.common.rdtype = dns_rdatatype_dnskey;
 		dnskey.mctx = NULL;
 		ISC_LINK_INIT(&dnskey.common, link);
 		dnskey.flags = (uint16_t)rdata1;
 		dnskey.protocol = (uint8_t)rdata2;
 		dnskey.algorithm = (uint8_t)rdata3;
 		datastr = cfg_obj_asstring(cfg_tuple_get(key, "data"));
 		CHECK(isc_base64_decodestring(datastr, &databuf));
 		isc_buffer_usedregion(&databuf, &r);
 		dnskey.datalen = r.length;
 		dnskey.data = r.base;
 		CHECK(dns_rdata_fromstruct(NULL, dnskey.common.rdclass,
 					   dnskey.common.rdtype,
 					   &dnskey, &rrdatabuf));
 		CHECK(dns_client_addtrustedkey(client, dns_rdataclass_in,
 					       dns_rdatatype_dnskey,
 					       keyname, &rrdatabuf));
 		break;
 	case INITIAL_DS:
 	case STATIC_DS:
 		ds.common.rdclass = dns_rdataclass_in;
 		ds.common.rdtype = dns_rdatatype_ds;
 		ds.mctx = NULL;
 		ISC_LINK_INIT(&ds.common, link);
 		ds.key_tag = (uint16_t)rdata1;
 		ds.algorithm = (uint8_t)rdata2;
 		ds.digest_type = (uint8_t)rdata3;
 		datastr = cfg_obj_asstring(cfg_tuple_get(key, "data"));
 		CHECK(isc_hex_decodestring(datastr, &databuf));
 		isc_buffer_usedregion(&databuf, &r);
 		switch (ds.digest_type) {
 		case DNS_DSDIGEST_SHA1:
 			if (r.length != ISC_SHA1_DIGESTLENGTH) {
 				CHECK(ISC_R_UNEXPECTEDEND);
 			}
 			break;
 		case DNS_DSDIGEST_SHA256:
 			if (r.length != ISC_SHA256_DIGESTLENGTH) {
 				CHECK(ISC_R_UNEXPECTEDEND);
 			}
 			break;
 		case DNS_DSDIGEST_SHA384:
 			if (r.length != ISC_SHA384_DIGESTLENGTH) {
 				CHECK(ISC_R_UNEXPECTEDEND);
 			}
 			break;
 		}
 		ds.length = r.length;
 		ds.digest = r.base;
 		CHECK(dns_rdata_fromstruct(NULL, ds.common.rdclass,
 					   ds.common.rdtype,
 					   &ds, &rrdatabuf));
 		CHECK(dns_client_addtrustedkey(client, dns_rdataclass_in,
 					       dns_rdatatype_ds,
 					       keyname, &rrdatabuf));
 	};
 	CHECK(dns_client_addtrustedkey(client, dns_rdataclass_in,
 				       keyname, &rrdatabuf));
 	num_keys++;
 cleanup:
@@ -819,7 +737,7 @@ setup_dnsseckeys(dns_client_t *client) {
 	cfg_parser_t *parser = NULL;
 	const cfg_obj_t *trusted_keys = NULL;
 	const cfg_obj_t *managed_keys = NULL;
-	const cfg_obj_t *trust_anchors = NULL;
+	const cfg_obj_t *dnssec_keys = NULL;
 	cfg_obj_t *bindkeys = NULL;
 	const char *filename = anchorfile;
@@ -878,7 +796,7 @@ setup_dnsseckeys(dns_client_t *client) {
 	INSIST(bindkeys != NULL);
 	cfg_map_get(bindkeys, "trusted-keys", &trusted_keys);
 	cfg_map_get(bindkeys, "managed-keys", &managed_keys);
-	cfg_map_get(bindkeys, "trust-anchors", &trust_anchors);
+	cfg_map_get(bindkeys, "dnssec-keys", &dnssec_keys);
 	if (trusted_keys != NULL) {
 		CHECK(load_keys(trusted_keys, client));
@@ -886,8 +804,8 @@ setup_dnsseckeys(dns_client_t *client) {
 	if (managed_keys != NULL) {
 		CHECK(load_keys(managed_keys, client));
 	}
-	if (trust_anchors != NULL) {
+	if (dnssec_keys != NULL) {
-		CHECK(load_keys(trust_anchors, client));
+		CHECK(load_keys(dnssec_keys, client));
 	}
 	result = ISC_R_SUCCESS;
@@ -1724,7 +1642,9 @@ main(int argc, char *argv[]) {
 	if (result != ISC_R_SUCCESS)
 		fatal("dns_lib_init failed: %d", result);
-	isc_mem_create(&mctx);
+	result = isc_mem_create(0, 0, &mctx);
 	if (result != ISC_R_SUCCESS)
 		fatal("failed to create mctx");
 	CHECK(isc_appctx_create(mctx, &actx));
 	CHECK(isc_taskmgr_createinctx(mctx, 1, 0, &taskmgr));
@@ -40,7 +40,6 @@
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -216,7 +215,7 @@
 	  </para>
 	  <para>
 	    Note: When reading the trust anchor file,
-	    <command>delv</command> treats <option>trust-anchors</option>
+	    <command>delv</command> treats <option>dnssec-keys</option>
 	    <option>initial-key</option> and <option>static-key</option>
 	    entries identically.  That is, even if a key is configured
 	    with <command>initial-key</command>, indicating that it is
@@ -197,7 +197,7 @@
 	  </p>
 	  <p>
 	    Note: When reading the trust anchor file,
-	    <span class="command"><strong>delv</strong></span> treats <code class="option">trust-anchors</code>
+	    <span class="command"><strong>delv</strong></span> treats <code class="option">dnssec-keys</code>
 	    <code class="option">initial-key</code> and <code class="option">static-key</code>
 	    entries identically.  That is, even if a key is configured
 	    with <span class="command"><strong>initial-key</strong></span>, indicating that it is
@@ -548,12 +548,6 @@
 	      in the type's presentation format.
 	    </p>
 	  </dd>
 <dt><span class="term"><code class="option">+[no]yaml</code></span></dt>
 <dd>
 	    <p>
 	      Print response data in YAML format.
 	    </p>
 	  </dd>
 </dl></div>
 <p>
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <ItemGroup Label="ProjectConfigurations">
    <ProjectConfiguration Include="Debug|@PLATFORM@">
      <Configuration>Debug</Configuration>
@@ -14,21 +14,18 @@
    <ProjectGuid>{BE172EFE-C1DC-4812-BFB9-8C5F8ADB7E9F}</ProjectGuid>
    <Keyword>Win32Proj</Keyword>
    <RootNamespace>delv</RootNamespace>
    @WINDOWS_TARGET_PLATFORM_VERSION@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>true</UseDebugLibraries>
    <CharacterSet>MultiByte</CharacterSet>
    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>false</UseDebugLibraries>
    <WholeProgramOptimization>true</WholeProgramOptimization>
    <CharacterSet>MultiByte</CharacterSet>
    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
  <ImportGroup Label="ExtensionSettings">
@@ -744,13 +744,6 @@ Display [do not display] the TTL when printing the record\&.
 Display [do not display] the TTL in friendly human\-readable time units of "s", "m", "h", "d", and "w", representing seconds, minutes, hours, days and weeks\&. Implies +ttlid\&.
 .RE
 .PP
 \fB+[no]unexpected\fR
 .RS 4
 Accept [do not accept] answers from unexpected sources\&. By default,
 \fBdig\fR
 won\*(Aqt accept a reply from a source other than the one to which it sent the query\&.
 .RE
 .PP
 \fB+[no]unknownformat\fR
 .RS 4
 Print all RDATA in unknown RR type presentation format (RFC 3597)\&. The default is to print RDATA for known types in the type\*(Aqs presentation format\&.
@@ -763,13 +756,6 @@ Use [do not use] TCP when querying name servers\&. This alternate syntax to
 is provided for backwards compatibility\&. The "vc" stands for "virtual circuit"\&.
 .RE
 .PP
 \fB+[no]yaml\fR
 .RS 4
 Print the responses (and, if
 \fB+qr\fR
 is in use, also the outgoing queries) in a detailed YAML format\&.
 .RE
 .PP
 \fB+[no]zflag\fR
 .RS 4
 Set [do not set] the last unassigned DNS header flag in a DNS query\&. This flag is off by default\&.
@@ -54,7 +54,7 @@
 dig_lookup_t *default_lookup = NULL;
-static atomic_uintptr_t batchname = ATOMIC_VAR_INIT(0);
+static char *batchname = NULL;
 static FILE *batchfp = NULL;
 static char *argv0;
 static int addresscount = 0;
@@ -64,7 +64,8 @@ static char hexcookie[81];
 static bool short_form = false, printcmd = true,
 	plusquest = false, pluscomm = false,
-	ipv4only = false, ipv6only = false, digrc = true;
+	ipv4only = false, ipv6only = false, digrc = true,
 	yaml = false;
 static uint32_t splitwidth = 0xffffffff;
 /*% opcode text */
@@ -234,12 +235,9 @@ help(void) {
 "                 +tries=###          (Set number of UDP attempts) [3]\n"
 "                 +[no]ttlid          (Control display of ttls in records)\n"
 "                 +[no]ttlunits       (Display TTLs in human-readable units)\n"
 "                 +[no]unexpected     (Print replies from unexpected sources\n"
 "                                      default=off)\n"
 "                 +[no]unknownformat  (Print RDATA in RFC 3597 \"unknown\" "
 					"format)\n"
 "                 +[no]vc             (TCP mode (+[no]tcp))\n"
 "                 +[no]yaml           (Present the results as YAML)\n"
 "                 +[no]zflag          (Set Z flag in query)\n"
 "        global d-opts and servers (before host name) affect all queries.\n"
 "        local d-opts and servers (after host name) affect only that lookup.\n"
@@ -487,8 +485,8 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf,
 	styleflags |= DNS_STYLEFLAG_REL_OWNER;
 	if (yaml) {
-		msg->indent.string = "  ";
+		dns_master_indentstr = "  ";
-		msg->indent.count = 3;
+		dns_master_indent = 3;
 		styleflags |= DNS_STYLEFLAG_YAML;
 	} else {
 		if (query->lookup->comments) {
@@ -1669,25 +1667,8 @@ plus_option(char *option, bool is_batchfile,
 		}
 		break;
 	case 'u':
-		switch (cmd[1]) {
+		FULLCHECK("unknownformat");
-		case 'n':
+		lookup->print_unknown_format = state;
 			switch (cmd[2]) {
 			case 'e':
 				FULLCHECK("unexpected");
 				lookup->accept_reply_unexpected_src = state;
 				break;
 			case 'k':
 				FULLCHECK("unknownformat");
 				lookup->print_unknown_format = state;
 				break;
 			default:
 				goto invalid_option;
 			}
 			break;
 		default:
 			goto invalid_option;
 		}
 		break;
 	case 'v':
 		FULLCHECK("vc");
@@ -1874,7 +1855,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 				value);
 		return (value_from_next);
 	case 'f':
-		atomic_store(&batchname, (uintptr_t)value);
+		batchname = value;
 		return (value_from_next);
 	case 'k':
 		strlcpy(keyfile, value, sizeof(keyfile));
@@ -2327,15 +2308,13 @@ parse_args(bool is_batchfile, bool config_only,
 	 * first entry, then trust the callback in dighost_shutdown
 	 * to get the rest
 	 */
-	char *filename = (char *)atomic_load(&batchname);
+	if ((batchname != NULL) && !(is_batchfile)) {
-	if ((filename != NULL) && !(is_batchfile)) {
+		if (strcmp(batchname, "-") == 0)
 		if (strcmp(filename, "-") == 0) {
 			batchfp = stdin;
-		} else {
+		else
-			batchfp = fopen(filename, "r");
+			batchfp = fopen(batchname, "r");
 		}
 		if (batchfp == NULL) {
-			perror(filename);
+			perror(batchname);
 			if (exitcode < 8)
 				exitcode = 8;
 			fatal("couldn't open specified batch file");
@@ -2390,14 +2369,14 @@ query_finished(void) {
 	int bargc;
 	char *bargv[16];
-	if (atomic_load(&batchname) == 0) {
+	if (batchname == NULL) {
 		isc_app_shutdown();
 		return;
 	}
 	fflush(stdout);
 	if (feof(batchfp)) {
-		atomic_store(&batchname, 0);
+		batchname = NULL;
 		isc_app_shutdown();
 		if (batchfp != stdin)
 			fclose(batchfp);
@@ -2411,7 +2390,7 @@ query_finished(void) {
 		parse_args(true, false, bargc, (char **)bargv);
 		start_lookup();
 	} else {
-		atomic_store(&batchname, 0);
+		batchname = NULL;
 		if (batchfp != stdin)
 			fclose(batchfp);
 		isc_app_shutdown();
@@ -2448,36 +2427,6 @@ dig_error(const char *format, ...) {
 	}
 }
 static void
 dig_warning(const char *format, ...) {
 	va_list args;
 	if (!yaml) {
 		printf(";; ");
 		va_start(args, format);
 		vprintf(format, args);
 		va_end(args);
 		printf("\n");
 	}
 }
 static void
 dig_comments(dig_lookup_t *lookup, const char *format, ...) {
 	va_list args;
 	if (lookup->comments && !yaml) {
 		printf(";; ");
 		va_start(args, format);
 		vprintf(format, args);
 		va_end(args);
 		printf("\n");
 	}
 }
 void
 dig_setup(int argc, char **argv) {
 	isc_result_t result;
@@ -2494,8 +2443,6 @@ dig_setup(int argc, char **argv) {
 	dighost_trying = trying;
 	dighost_shutdown = query_finished;
 	dighost_error = dig_error;
 	dighost_warning = dig_warning;
 	dighost_comments = dig_comments;
 	progname = argv[0];
 	preparse_args(argc, argv);
@@ -2541,11 +2488,10 @@ void dig_query_start()
 void
 dig_shutdown() {
 	destroy_lookup(default_lookup);
-	if (atomic_load(&batchname) != 0) {
+	if (batchname != NULL) {
-		if (batchfp != stdin) {
+		if (batchfp != stdin)
 			fclose(batchfp);
-		}
+		batchname = NULL;
 		atomic_store(&batchname, 0);
 	}
 	cancel_all();
 	destroy_libs();
@@ -53,7 +53,6 @@
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -1270,17 +1269,6 @@
 	  </listitem>
 	</varlistentry>
 	<varlistentry>
 	  <term><option>+[no]unexpected</option></term>
 	  <listitem>
 	    <para>
 	      Accept [do not accept] answers from unexpected sources.  By
 	      default, <command>dig</command> won't accept a reply from a
 	      source other than the one to which it sent the query.
 	    </para>
 	  </listitem>
 	</varlistentry>
 	<varlistentry>
 	  <term><option>+[no]unknownformat</option></term>
 	  <listitem>
@@ -1000,14 +1000,6 @@
 	      seconds, minutes, hours, days and weeks.  Implies +ttlid.
 	    </p>
 	  </dd>
 <dt><span class="term"><code class="option">+[no]unexpected</code></span></dt>
 <dd>
 	    <p>
 	      Accept [do not accept] answers from unexpected sources.  By
 	      default, <span class="command"><strong>dig</strong></span> won't accept a reply from a
 	      source other than the one to which it sent the query.
 	    </p>
 	  </dd>
 <dt><span class="term"><code class="option">+[no]unknownformat</code></span></dt>
 <dd>
 	    <p>
@@ -1025,13 +1017,6 @@
 	      stands for "virtual circuit".
 	    </p>
 	  </dd>
 <dt><span class="term"><code class="option">+[no]yaml</code></span></dt>
 <dd>
 	    <p>
 	      Print the responses (and, if <code class="option">+qr</code> is in use,
 	      also the outgoing queries) in a detailed YAML format.
 	    </p>
 	  </dd>
 <dt><span class="term"><code class="option">+[no]zflag</code></span></dt>
 <dd>
 	    <p>
@@ -112,8 +112,7 @@ bool
 	showsearch = false,
 	is_dst_up = false,
 	keep_open = false,
-	verbose = false,
+	verbose = false;
 	yaml = false;
 in_port_t port = 53;
 unsigned int timeout = 0;
 unsigned int extrabytes;
@@ -191,30 +190,6 @@ dig_lookup_t *current_lookup = NULL;
 		     "isc_mutex_unlock");\
 }
 static void
 default_warnerr(const char *format, ...) {
 	va_list args;
 	printf(";; ");
 	va_start(args, format);
 	vprintf(format, args);
 	va_end(args);
 	printf("\n");
 };
 static void
 default_comments(dig_lookup_t *lookup, const char *format, ...) {
 	va_list args;
 	if (lookup->comments) {
 		printf(";; ");
 		va_start(args, format);
 		vprintf(format, args);
 		va_end(args);
 		printf("\n");
 	}
 };
 /* dynamic callbacks */
 isc_result_t
@@ -222,13 +197,7 @@ isc_result_t
 			dns_message_t *msg, bool headers);
 void
-(*dighost_error)(const char *format, ...) = default_warnerr;
+(*dighost_error)(const char *format, ...);
 void
 (*dighost_warning)(const char *format, ...) = default_warnerr;
 void
 (*dighost_comments)(dig_lookup_t *lookup, const char *format, ...) = default_comments;
 void
 (*dighost_received)(unsigned int bytes, isc_sockaddr_t *from,
@@ -649,9 +618,9 @@ make_empty_lookup(void) {
 	looknew->use_usec = false;
 	looknew->nocrypto = false;
 	looknew->ttlunits = false;
 	looknew->ttlunits = false;
 	looknew->expandaaaa = false;
 	looknew->qr = false;
 	looknew->accept_reply_unexpected_src = false;
 #ifdef HAVE_LIBIDN2
 	looknew->idnin = isatty(1)?(getenv("IDN_DISABLE") == NULL):false;
 	looknew->idnout = looknew->idnin;
@@ -797,8 +766,6 @@ clone_lookup(dig_lookup_t *lookold, bool servers) {
 	looknew->ttlunits = lookold->ttlunits;
 	looknew->expandaaaa = lookold->expandaaaa;
 	looknew->qr = lookold->qr;
 	looknew->accept_reply_unexpected_src =
 		lookold->accept_reply_unexpected_src;
 	looknew->idnin = lookold->idnin;
 	looknew->idnout = lookold->idnout;
 	looknew->udpsize = lookold->udpsize;
@@ -835,8 +802,8 @@ clone_lookup(dig_lookup_t *lookold, bool servers) {
 		memmove(looknew->ecs_addr, lookold->ecs_addr, len);
 	}
-	dns_name_copynf(dns_fixedname_name(&lookold->fdomain),
+	dns_name_copy(dns_fixedname_name(&lookold->fdomain),
-			   dns_fixedname_name(&looknew->fdomain));
+		      dns_fixedname_name(&looknew->fdomain), NULL);
 	if (servers)
 		clone_server_list(lookold->my_server_list,
@@ -1364,7 +1331,8 @@ setup_libs(void) {
 	if (!have_ipv6 && !have_ipv4)
 		fatal("can't find either v4 or v6 networking");
-	isc_mem_create(&mctx);
+	result = isc_mem_create(0, 0, &mctx);
 	check_result(result, "isc_mem_create");
 	isc_mem_setname(mctx, "dig", NULL);
 	result = isc_log_create(mctx, &lctx, &logconfig);
@@ -1379,7 +1347,7 @@ setup_libs(void) {
 	isc_log_setdebuglevel(lctx, 0);
-	result = isc_taskmgr_create(mctx, 1, 0, NULL, &taskmgr);
+	result = isc_taskmgr_create(mctx, 1, 0, &taskmgr);
 	check_result(result, "isc_taskmgr_create");
 	result = isc_task_create(taskmgr, 0, &global_task);
@@ -1789,15 +1757,12 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section)
 			namereln = dns_name_fullcompare(name, domain,
 							&order, &nlabels);
 			if (namereln == dns_namereln_equal) {
-				if (!horizontal) {
+				if (!horizontal)
-					dighost_warning("BAD (HORIZONTAL) "
+					printf(";; BAD (HORIZONTAL) REFERRAL\n");
 							"REFERRAL");
 				}
 				horizontal = true;
 			} else if (namereln != dns_namereln_subdomain) {
-				if (!bad) {
+				if (!bad)
-					dighost_warning( "BAD REFERRAL");
+					printf(";; BAD REFERRAL\n");
 				}
 				bad = true;
 				continue;
 			}
@@ -1841,7 +1806,7 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section)
 				if (lookup->ns_search_only)
 					lookup->recurse = false;
 				domain = dns_fixedname_name(&lookup->fdomain);
-				dns_name_copynf(name, domain);
+				dns_name_copy(name, domain, NULL);
 			}
 			debug("adding server %s", namestr);
 			num = getaddresses(lookup, namestr, &lresult);
@@ -2045,9 +2010,6 @@ setup_lookup(dig_lookup_t *lookup) {
 	char cookiebuf[256];
 	char *origin = NULL;
 	char *textname = NULL;
 	REQUIRE(lookup != NULL);
 #ifdef HAVE_LIBIDN2
 	char idn_origin[MXNAME], idn_textname[MXNAME];
@@ -2056,6 +2018,7 @@ setup_lookup(dig_lookup_t *lookup) {
 	check_result(result, "dns_name_settotextfilter");
 #endif /* HAVE_LIBIDN2 */
 	REQUIRE(lookup != NULL);
 	INSIST(!free_now);
 	debug("setup_lookup(%p)", lookup);
@@ -2156,26 +2119,22 @@ setup_lookup(dig_lookup_t *lookup) {
 			isc_buffer_init(&b, textname, len);
 			isc_buffer_add(&b, len);
 			result = dns_name_fromtext(name, &b, NULL, 0, NULL);
-			if (result == ISC_R_SUCCESS) {
+			if (result == ISC_R_SUCCESS &&
-				if (!dns_name_isabsolute(name)) {
+			    !dns_name_isabsolute(name))
-					result = dns_name_concatenate(name,
+				result = dns_name_concatenate(name,
-							     lookup->oname,
+							      lookup->oname,
-							     lookup->name,
+							      lookup->name,
-							     &lookup->namebuf);
+							      &lookup->namebuf);
-				} else {
+			else if (result == ISC_R_SUCCESS)
-					result = dns_name_copy(name,
+				result = dns_name_copy(name, lookup->name,
-							     lookup->name,
+						       &lookup->namebuf);
 							     &lookup->namebuf);
 				}
 			}
 			if (result != ISC_R_SUCCESS) {
 				dns_message_puttempname(lookup->sendmsg,
 							&lookup->name);
 				dns_message_puttempname(lookup->sendmsg,
 							&lookup->oname);
-				if (result == DNS_R_NAMETOOLONG) {
+				if (result == DNS_R_NAMETOOLONG)
 					return (false);
 				}
 				fatal("'%s' is not in legal name syntax (%s)",
 				      lookup->textname,
 				      isc_result_totext(result));
@@ -2674,6 +2633,10 @@ force_timeout(dig_query_t *query) {
 	event = isc_event_allocate(mctx, query, ISC_TIMEREVENT_IDLE,
 				   connect_timeout, query,
 				   sizeof(isc_event_t));
 	if (event == NULL) {
 		fatal("isc_event_allocate: %s",
 		      isc_result_totext(ISC_R_NOMEMORY));
 	}
 	isc_task_send(global_task, &event);
 	/*
@@ -2725,7 +2688,7 @@ send_tcp_connect(dig_query_t *query) {
 		isc_netaddr_fromsockaddr(&netaddr, &query->sockaddr);
 		isc_netaddr_format(&netaddr, buf, sizeof(buf));
-		dighost_warning("Skipping mapped address '%s'", buf);
+		printf(";; Skipping mapped address '%s'\n", buf);
 		query->waiting_connect = false;
 		if (ISC_LINK_LINKED(query, link))
@@ -2735,7 +2698,7 @@ send_tcp_connect(dig_query_t *query) {
 		l = query->lookup;
 		clear_query(query);
 		if (next == NULL) {
-			dighost_warning("No acceptable nameservers");
+			printf(";; No acceptable nameservers\n");
 			check_next_lookup(l);
 			return;
 		}
@@ -2796,14 +2759,6 @@ send_tcp_connect(dig_query_t *query) {
 	}
 }
 static void
 print_query_size(dig_query_t *query) {
 	if (!yaml) {
 		printf(";; QUERY SIZE: %u\n\n",
 		       isc_buffer_usedlength(&query->lookup->renderbuf));
 	}
 }
 /*%
 * Send a UDP packet to the remote nameserver, possible starting the
 * recv action as well.  Also make sure that the timer is running and
@@ -2842,12 +2797,13 @@ send_udp(dig_query_t *query) {
 			isc_netaddr_fromsockaddr(&netaddr, &query->sockaddr);
 			isc_netaddr_format(&netaddr, buf, sizeof(buf));
-			dighost_warning("Skipping mapped address '%s'", buf);
+			printf(";; Skipping mapped address '%s'\n", buf);
 			next = ISC_LIST_NEXT(query, link);
 			l = query->lookup;
 			clear_query(query);
 			if (next == NULL) {
-				dighost_warning("No acceptable nameservers");
+				printf(";; No acceptable nameservers\n");
 				check_next_lookup(l);
 			} else {
 				send_udp(next);
@@ -2906,7 +2862,8 @@ send_udp(dig_query_t *query) {
 				     &query->lookup->renderbuf,
 				     query->lookup->sendmsg, true);
 		if (query->lookup->stats) {
-			print_query_size(query);
+			printf(";; QUERY SIZE: %u\n\n",
 			     isc_buffer_usedlength(&query->lookup->renderbuf));
 		}
 	}
 }
@@ -3192,7 +3149,9 @@ launch_next_query(dig_query_t *query, bool include_question) {
 					     &query->lookup->renderbuf,
 					     query->lookup->sendmsg, true);
 			if (query->lookup->stats) {
-				print_query_size(query);
+				printf(";; QUERY SIZE: %u\n\n",
 				       isc_buffer_usedlength(
 						    &query->lookup->renderbuf));
 			}
 		}
 	}
@@ -3234,12 +3193,11 @@ connect_done(isc_task_t *task, isc_event_t *event) {
 	if (sevent->result == ISC_R_CANCELED) {
 		debug("in cancel handler");
 		isc_sockaddr_format(&query->sockaddr, sockstr, sizeof(sockstr));
-		if (query->timedout) {
+		if (query->timedout)
-			dighost_warning("Connection to %s(%s) for %s failed: "
+			printf(";; Connection to %s(%s) for %s failed: %s.\n",
-					"%s.", sockstr, query->servname,
+			       sockstr, query->servname,
-					query->lookup->textname,
+			       query->lookup->textname,
-					isc_result_totext(ISC_R_TIMEDOUT));
+			       isc_result_totext(ISC_R_TIMEDOUT));
 		}
 		isc_socket_detach(&query->sock);
 		INSIST(sockcount > 0);
 		sockcount--;
@@ -3257,12 +3215,11 @@ connect_done(isc_task_t *task, isc_event_t *event) {
 		debug("unsuccessful connection: %s",
 		      isc_result_totext(sevent->result));
 		isc_sockaddr_format(&query->sockaddr, sockstr, sizeof(sockstr));
-		if (sevent->result != ISC_R_CANCELED) {
+		if (sevent->result != ISC_R_CANCELED)
-			dighost_warning("Connection to %s(%s) for %s failed: "
+			printf(";; Connection to %s(%s) for %s failed: "
-					"%s.", sockstr, query->servname,
+			       "%s.\n", sockstr,
-					 query->lookup->textname,
+			       query->servname, query->lookup->textname,
-					 isc_result_totext(sevent->result));
+			       isc_result_totext(sevent->result));
 		}
 		isc_socket_detach(&query->sock);
 		INSIST(sockcount > 0);
 		sockcount--;
@@ -3470,12 +3427,12 @@ process_cookie(dig_lookup_t *l, dns_message_t *msg,
 		if (isc_safe_memequal(isc_buffer_current(optbuf), sent, 8)) {
 			msg->cc_ok = 1;
 		} else {
-			dighost_warning("Warning: Client COOKIE mismatch");
+			printf(";; Warning: Client COOKIE mismatch\n");
 			msg->cc_bad = 1;
 			copy = false;
 		}
 	} else {
-		dighost_warning("Warning: COOKIE bad token (too short)");
+		printf(";; Warning: COOKIE bad token (too short)\n");
 		msg->cc_bad = 1;
 		copy = false;
 	}
@@ -3647,11 +3604,9 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 			sizeof(buf1));
 			isc_sockaddr_format(&query->sockaddr, buf2,
 			sizeof(buf2));
-			dighost_warning("reply from unexpected source: %s,"
+			printf(";; reply from unexpected source: %s,"
-					" expected %s\n", buf1, buf2);
+			" expected %s\n", buf1, buf2);
-			if (!l->accept_reply_unexpected_src) {
+			match = false;
 				match = false;
 			}
 		}
 	}
@@ -3661,22 +3616,19 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 		if (l->tcp_mode) {
 			bool fail = true;
 			if (result == ISC_R_SUCCESS) {
-				if ((!query->first_soa_rcvd || query->warn_id))
+				if (!query->first_soa_rcvd ||
-				{
+				     query->warn_id)
-					dighost_warning("%s: ID mismatch: "
+					printf(";; %s: ID mismatch: "
-							"expected ID %u, got "
+					       "expected ID %u, got %u\n",
-							"%u",
+					       query->first_soa_rcvd ?
-							query->first_soa_rcvd ?
+					       "WARNING" : "ERROR",
-							"WARNING" : "ERROR",
+					       l->sendmsg->id, id);
 							l->sendmsg->id, id);
 				}
 				if (query->first_soa_rcvd)
 					fail = false;
 				query->warn_id = false;
-			} else {
+			} else
-				dighost_warning("ERROR: short (< header size) "
+				printf(";; ERROR: short "
-						"message");
+				       "(< header size) message\n");
 			}
 			if (fail) {
 				isc_event_free(&event);
 				clear_query(query);
@@ -3686,18 +3638,16 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 				return;
 			}
 			match = true;
-		} else if (result == ISC_R_SUCCESS) {
+		} else if (result == ISC_R_SUCCESS)
-			dighost_warning("Warning: ID mismatch: expected ID %u,"
+			printf(";; Warning: ID mismatch: "
-					" got %u", l->sendmsg->id, id);
+			       "expected ID %u, got %u\n", l->sendmsg->id, id);
-		} else {
+		else
-			dighost_warning("Warning: short (< header size) "
+			printf(";; Warning: short "
-					"message received");
+			       "(< header size) message received\n");
 		}
 	}
-	if (result == ISC_R_SUCCESS && (msgflags & DNS_MESSAGEFLAG_QR) == 0) {
+	if (result == ISC_R_SUCCESS && (msgflags & DNS_MESSAGEFLAG_QR) == 0)
-		dighost_warning("Warning: query response not set");
+		printf(";; Warning: query response not set\n");
 	}
 	if (!match)
 		goto udp_mismatch;
@@ -3731,16 +3681,13 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 	}
 	result = dns_message_parse(msg, &b, parseflags);
 	if (result == DNS_R_RECOVERABLE) {
-		dighost_warning("Warning: Message parser reports malformed "
+		printf(";; Warning: Message parser reports malformed "
-				"message packet.");
+		       "message packet.\n");
 		result = ISC_R_SUCCESS;
 	}
 	if (result != ISC_R_SUCCESS) {
-		if (!yaml) {
+		printf(";; Got bad packet: %s\n", isc_result_totext(result));
-			printf(";; Got bad packet: %s\n",
+		hex_dump(&b);
 			       isc_result_totext(result));
 			hex_dump(&b);
 		}
 		query->waiting_connect = false;
 		dns_message_destroy(&msg);
 		isc_event_free(&event);
@@ -3777,10 +3724,9 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 					dns_rdataclass_format(rdataset->rdclass,
 							      classbuf,
 							      sizeof(classbuf));
-					dighost_warning(";; Question section "
+					printf(";; Question section mismatch: "
-							"mismatch: got "
+					       "got %s/%s/%s\n",
-							"%s/%s/%s", namestr,
+					       namestr, typebuf, classbuf);
 							typebuf, classbuf);
 					match = false;
 				}
 			}
@@ -3803,8 +3749,9 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 		/*
 		 * Add minimum EDNS version required checks here if needed.
 		 */
-		dighost_comments(l, "BADVERS, retrying with EDNS version %u.",
+		if (l->comments)
-				 (unsigned int)newedns);
+			printf(";; BADVERS, retrying with EDNS version %u.\n",
 			       (unsigned int)newedns);
 		l->edns = newedns;
 		n = requeue_lookup(l, true);
 		if (l->trace && l->trace_root)
@@ -3821,7 +3768,8 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 	    !l->ignore && !l->tcp_mode) {
 		if (l->cookie == NULL && l->sendcookie && msg->opt != NULL)
 			process_opt(l, msg);
-		dighost_comments(l, "Truncated, retrying in TCP mode.");
+		if (l->comments)
 			printf(";; Truncated, retrying in TCP mode.\n");
 		n = requeue_lookup(l, true);
 		n->tcp_mode = true;
 		if (l->trace && l->trace_root)
@@ -3838,9 +3786,9 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 	    l->sendcookie && l->badcookie) {
 		process_opt(l, msg);
 		if (msg->cc_ok) {
-			dighost_comments(l, "BADCOOKIE, retrying%s.",
+			if (l->comments)
-					 l->seenbadcookie ?
+				printf(";; BADCOOKIE, retrying%s.\n",
-					 " in TCP mode" : "");
+				       l->seenbadcookie ? " in TCP mode" : "");
 			n = requeue_lookup(l, true);
 			if (l->seenbadcookie)
 				n->tcp_mode = true;
@@ -3877,12 +3825,13 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 		 */
 		if ((ISC_LIST_HEAD(l->q) != query) ||
 		    (ISC_LIST_NEXT(query, link) != NULL)) {
-			dighost_comments(l, "Got %s from %s, trying next "
+			if (l->comments)
-					 "server",
+				printf(";; Got %s from %s, "
-					 msg->rcode == dns_rcode_servfail ?
+				       "trying next server\n",
-					 "SERVFAIL reply" :
+				       msg->rcode == dns_rcode_servfail ?
-					 "recursion not available",
+				       "SERVFAIL reply" :
-					 query->servname);
+				       "recursion not available",
 				       query->servname);
 			clear_query(query);
 			check_next_lookup(l);
 			dns_message_destroy(&msg);
@@ -3895,8 +3844,8 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 	if (tsigkey != NULL) {
 		result = dns_tsig_verify(&b, msg, NULL, NULL);
 		if (result != ISC_R_SUCCESS) {
-			dighost_warning("Couldn't verify signature: %s",
+			printf(";; Couldn't verify signature: %s\n",
-					isc_result_totext(result));
+			       isc_result_totext(result));
 			validated = false;
 		}
 		l->tsigctx = msg->tsigctx;
@@ -3947,8 +3896,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 	if (!done_process_opt) {
 		if (l->cookie != NULL) {
 			if (msg->opt == NULL) {
-				dighost_warning("expected opt record in "
+				printf(";; expected opt record in response\n");
 						"response");
 			} else {
 				process_opt(l, msg);
 			}
@@ -4252,6 +4200,7 @@ destroy_libs(void) {
 	result = dns_name_settotextfilter(NULL);
 	check_result(result, "dns_name_settotextfilter");
 #endif /* HAVE_LIBIDN2 */
 	dns_name_destroy();
 	if (commctx != NULL) {
 		debug("freeing commctx");
@@ -4425,20 +4374,9 @@ idn_ace_to_locale(const char *src, char **dst) {
 	 */
 	res = idn2_to_unicode_8zlz(utf8_src, &local_src, 0);
 	if (res != IDN2_OK) {
-		static bool warned = false;
+		fatal("Cannot represent '%s' in the current locale (%s), "
-
+		      "use +noidnout or a different locale",
-		res = idn2_to_ascii_8z(utf8_src, &local_src, 0);
+		      src, idn2_strerror(res));
 		if (res != IDN2_OK) {
 			fatal("Cannot represent '%s' "
 			      "in the current locale nor ascii (%s), "
 			      "use +noidnout or a different locale",
 			      src, idn2_strerror(res));
 		} else if (!warned) {
 			fprintf(stderr, ";; Warning: cannot represent '%s' "
 			      "in the current locale",
 			      local_src);
 			warned = true;
 		}
 	}
 	/*
@@ -394,7 +394,7 @@ chase_cnamechain(dns_message_t *msg, dns_name_t *qname) {
 		dns_rdataset_current(rdataset, &rdata);
 		result = dns_rdata_tostruct(&rdata, &cname, NULL);
 		check_result(result, "dns_rdata_tostruct");
-		dns_name_copynf(&cname.cname, qname);
+		dns_name_copy(&cname.cname, qname, NULL);
 		dns_rdata_freestruct(&cname);
 	}
 }
@@ -456,7 +456,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf,
 		/* Add AAAA and MX lookups. */
 		name = dns_fixedname_initname(&fixed);
-		dns_name_copynf(query->lookup->name, name);
+		dns_name_copy(query->lookup->name, name, NULL);
 		chase_cnamechain(msg, name);
 		dns_name_format(name, namestr, sizeof(namestr));
 		lookup = clone_lookup(query->lookup, false);
@@ -857,6 +857,17 @@ parse_args(bool is_batchfile, int argc, char **argv) {
 	ISC_LIST_APPEND(lookup_list, lookup, link);
 }
 static void
 host_error(const char *format, ...) {
 	va_list args;
 	printf(";; ");
 	va_start(args, format);
 	vfprintf(stdout, format, args);
 	va_end(args);
 	printf("\n");
 }
 int
 main(int argc, char **argv) {
 	isc_result_t result;
@@ -874,6 +885,7 @@ main(int argc, char **argv) {
 	dighost_received = received;
 	dighost_trying = trying;
 	dighost_shutdown = host_shutdown;
 	dighost_error = host_error;
 	debug("main()");
 	progname = argv[0];
@@ -48,7 +48,6 @@
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -141,9 +141,7 @@ struct dig_lookup {
 		idnin,
 		idnout,
 		expandaaaa,
-		qr,
+		qr;
 		accept_reply_unexpected_src;  /*%  print replies from unexpected
 						   sources. */
 	char textname[MXNAME]; /*% Name we're going to be looking up */
 	char cmdline[MXNAME];
 	dns_rdatatype_t rdtype;
@@ -252,7 +250,7 @@ extern dig_searchlistlist_t search_list;
 extern unsigned int extrabytes;
 extern bool check_ra, have_ipv4, have_ipv6, specified_source,
-	usesearch, showsearch, yaml;
+	usesearch, showsearch;
 extern in_port_t port;
 extern unsigned int timeout;
 extern isc_mem_t *mctx;
@@ -391,18 +389,6 @@ extern isc_result_t
 extern void
 (*dighost_error)(const char *format, ...);
 /*
 * Print a warning message in the appropriate format.
 */
 extern void
 (*dighost_warning)(const char *format, ...);
 /*
 * Print a comment in the appropriate format.
 */
 extern void
 (*dighost_comments)(dig_lookup_t *lookup, const char *format, ...);
 /*%<
 * Print the final result of the lookup.
 */
@@ -423,7 +423,7 @@ chase_cnamechain(dns_message_t *msg, dns_name_t *qname) {
 		dns_rdataset_current(rdataset, &rdata);
 		result = dns_rdata_tostruct(&rdata, &cname, NULL);
 		check_result(result, "dns_rdata_tostruct");
-		dns_name_copynf(&cname.cname, qname);
+		dns_name_copy(&cname.cname, qname, NULL);
 		dns_rdata_freestruct(&cname);
 	}
 }
@@ -481,7 +481,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf,
 		/* Add AAAA lookup. */
 		name = dns_fixedname_initname(&fixed);
-		dns_name_copynf(query->lookup->name, name);
+		dns_name_copy(query->lookup->name, name, NULL);
 		chase_cnamechain(msg, name);
 		dns_name_format(name, namestr, sizeof(namestr));
 		lookup = clone_lookup(query->lookup, false);
@@ -983,6 +983,17 @@ getinput(isc_task_t *task, isc_event_t *event) {
 	isc_app_shutdown();
 }
 static void
 nsl_error(const char *format, ...) {
 	va_list args;
 	printf(";; ");
 	va_start(args, format);
 	vfprintf(stdout, format, args);
 	va_end(args);
 	printf("\n");
 }
 int
 main(int argc, char **argv) {
 	isc_result_t result;
@@ -1000,6 +1011,7 @@ main(int argc, char **argv) {
 	dighost_received = received;
 	dighost_trying = trying;
 	dighost_shutdown = query_finished;
 	dighost_error = nsl_error;
 	result = isc_app_start();
 	check_result(result, "isc_app_start");
@@ -72,7 +72,6 @@
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <ItemGroup Label="ProjectConfigurations">
    <ProjectConfiguration Include="Debug|@PLATFORM@">
      <Configuration>Debug</Configuration>
@@ -14,21 +14,18 @@
    <ProjectGuid>{F938F9B8-D395-4A40-BEC7-0122D289C692}</ProjectGuid>
    <Keyword>Win32Proj</Keyword>
    <RootNamespace>dig</RootNamespace>
    @WINDOWS_TARGET_PLATFORM_VERSION@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>true</UseDebugLibraries>
    <CharacterSet>MultiByte</CharacterSet>
    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>false</UseDebugLibraries>
    <WholeProgramOptimization>true</WholeProgramOptimization>
    <CharacterSet>MultiByte</CharacterSet>
    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
  <ImportGroup Label="ExtensionSettings">
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <ItemGroup Label="ProjectConfigurations">
    <ProjectConfiguration Include="Debug|@PLATFORM@">
      <Configuration>Debug</Configuration>
@@ -14,21 +14,18 @@
    <ProjectGuid>{140DE800-E552-43CC-B0C7-A33A92E368CA}</ProjectGuid>
    <Keyword>Win32Proj</Keyword>
    <RootNamespace>dighost</RootNamespace>
    @WINDOWS_TARGET_PLATFORM_VERSION@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>StaticLibrary</ConfigurationType>
    <UseDebugLibraries>true</UseDebugLibraries>
    <CharacterSet>MultiByte</CharacterSet>
    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>StaticLibrary</ConfigurationType>
    <UseDebugLibraries>false</UseDebugLibraries>
    <WholeProgramOptimization>true</WholeProgramOptimization>
    <CharacterSet>MultiByte</CharacterSet>
    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
  <ImportGroup Label="ExtensionSettings">
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <ItemGroup Label="ProjectConfigurations">
    <ProjectConfiguration Include="Debug|@PLATFORM@">
      <Configuration>Debug</Configuration>
@@ -14,21 +14,18 @@
    <ProjectGuid>{BA1048A8-6961-4A20-BE12-08BE20611C9D}</ProjectGuid>
    <Keyword>Win32Proj</Keyword>
    <RootNamespace>host</RootNamespace>
    @WINDOWS_TARGET_PLATFORM_VERSION@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>true</UseDebugLibraries>
    <CharacterSet>MultiByte</CharacterSet>
    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>false</UseDebugLibraries>
    <WholeProgramOptimization>true</WholeProgramOptimization>
    <CharacterSet>MultiByte</CharacterSet>
    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
  <ImportGroup Label="ExtensionSettings">
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <ItemGroup Label="ProjectConfigurations">
    <ProjectConfiguration Include="Debug|@PLATFORM@">
      <Configuration>Debug</Configuration>
@@ -14,21 +14,18 @@
    <ProjectGuid>{C15A6E1A-94CE-4686-99F9-6BC5FD623EB5}</ProjectGuid>
    <Keyword>Win32Proj</Keyword>
    <RootNamespace>nslookup</RootNamespace>
    @WINDOWS_TARGET_PLATFORM_VERSION@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>true</UseDebugLibraries>
    <CharacterSet>MultiByte</CharacterSet>
    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>false</UseDebugLibraries>
    <WholeProgramOptimization>true</WholeProgramOptimization>
    <CharacterSet>MultiByte</CharacterSet>
    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
  <ImportGroup Label="ExtensionSettings">
@@ -15,26 +15,24 @@ VERSION=@BIND9_VERSION@
@BIND9_MAKE_INCLUDES@
-CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} ${ISCCFG_INCLUDES} \
+CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} \
 		${OPENSSL_CFLAGS}
-CDEFINES =	-DVERSION=\"${VERSION}\" -DNAMED_CONFFILE=\"${sysconfdir}/named.conf\"
+CDEFINES =	-DVERSION=\"${VERSION}\"
 CWARNINGS =
 DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
 ISCLIBS =	../../lib/isc/libisc.@A@ ${OPENSSL_LIBS} ${JSON_C_LIBS} ${LIBXML2_LIBS}
 ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ ${OPENSSL_LIBS} ${JSON_C_LIBS} ${LIBXML2_LIBS}
 DNSDEPLIBS =	../../lib/dns/libdns.@A@
 ISCDEPLIBS =	../../lib/isc/libisc.@A@
 ISCCFGDEPLIBS =	../../lib/isccfg/libisccfg.@A@
-DEPLIBS =	${DNSDEPLIBS} ${ISCCFGDEPLIBS} ${ISCDEPLIBS}
+DEPLIBS =	${DNSDEPLIBS} ${ISCDEPLIBS}
-LIBS =		${DNSLIBS} ${ISCCFGLIBS} ${ISCLIBS} @LIBS@
+LIBS =		${DNSLIBS} ${ISCLIBS} @LIBS@
-NOSYMLIBS =	${DNSLIBS} ${ISCCFGLIBS} ${ISCNOSYMLIBS} @LIBS@
+NOSYMLIBS =	${DNSLIBS} ${ISCNOSYMLIBS} @LIBS@
 # Alphabetically
 TARGETS =	dnssec-cds@EXEEXT@ dnssec-dsfromkey@EXEEXT@ \
@@ -50,7 +48,7 @@ SRCS =		dnssec-cds.c dnssec-dsfromkey.c dnssec-importkey.c \
 		dnssec-settime.c dnssec-signzone.c dnssec-verify.c \
 		dnssectool.c
-MANPAGES =	dnssec-cds.8 dnssec-dsfromkey.8 dnssec-importkey.8 \
+MANPAGES =	dnssec-cds.8 dnssec-dsfromkey.8  dnssec-importkey.8 \
 		dnssec-keyfromlabel.8 dnssec-keygen.8 dnssec-revoke.8 \
 		dnssec-settime.8 dnssec-signzone.8 dnssec-verify.8
@@ -372,7 +372,7 @@ formatset(dns_rdataset_t *rdataset) {
 	result = isc_buffer_allocate(mctx, &buf, MAX_CDS_RDATA_TEXT_SIZE);
 	check_result(result, "printing DS records");
-	result = dns_master_rdatasettotext(name, rdataset, style, NULL, buf);
+	result = dns_master_rdatasettotext(name, rdataset, style, buf);
 	if ((result == ISC_R_SUCCESS) && isc_buffer_availablelength(buf) < 1) {
 		result = ISC_R_NOSPACE;
@@ -1074,7 +1074,10 @@ main(int argc, char *argv[]) {
 	int ch;
 	char *endp;
-	isc_mem_create(&mctx);
+	result = isc_mem_create(0, 0, &mctx);
 	if (result != ISC_R_SUCCESS) {
 		fatal("out of memory");
 	}
 #if USE_PKCS11
 	pk11_result_register();
@@ -41,7 +41,6 @@
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -200,7 +200,9 @@ loadkey(char *filename, unsigned char *key_buf, unsigned int key_buf_size,
 	rdclass = dst_key_class(key);
 	name = dns_fixedname_initname(&fixed);
-	dns_name_copynf(dst_key_name(key), name);
+	result = dns_name_copy(dst_key_name(key), name, NULL);
 	if (result != ISC_R_SUCCESS)
 		fatal("can't copy name");
 	dst_key_free(&key);
 }
@@ -332,7 +334,7 @@ int
 main(int argc, char **argv) {
 	char		*classname = NULL;
 	char		*filename = NULL, *dir = NULL, *namestr;
-	char		*endp, *arg1;
+	char		*endp;
 	int		ch;
 	bool		cds = false;
 	bool		usekeyset = false;
@@ -348,7 +350,10 @@ main(int argc, char **argv) {
 		usage();
 	}
-	isc_mem_create(&mctx);
+	result = isc_mem_create(0, 0, &mctx);
 	if (result != ISC_R_SUCCESS) {
 		fatal("out of memory");
 	}
 #if USE_PKCS11
 	pk11_result_register();
@@ -444,15 +449,10 @@ main(int argc, char **argv) {
 		dtype[0] = DNS_DSDIGEST_SHA256;
 	}
-	/*
+	if (argc < isc_commandline_index + 1 && filename == NULL) {
 	 * Use local variable arg1 so that clang can correctly analyse
 	 * reachable paths rather than 'argc < isc_commandline_index + 1'.
 	 */
 	arg1 = argv[isc_commandline_index];
 	if (arg1 == NULL && filename == NULL) {
 		fatal("the key file name was not specified");
 	}
-	if (arg1 != NULL && argv[isc_commandline_index + 1] != NULL) {
+	if (argc > isc_commandline_index + 1) {
 		fatal("extraneous arguments");
 	}
@@ -467,11 +467,11 @@ main(int argc, char **argv) {
 	dns_rdataset_init(&rdataset);
 	if (usekeyset || filename != NULL) {
-		if (arg1 == NULL) {
+		if (argc < isc_commandline_index + 1 && filename != NULL) {
-			/* using file name as the zone name */
+			/* using zone name as the zone file name */
 			namestr = filename;
 		} else {
-			namestr = arg1;
+			namestr = argv[isc_commandline_index];
 		}
 		result = initname(namestr);
@@ -482,7 +482,6 @@ main(int argc, char **argv) {
 		if (usekeyset) {
 			result = loadkeyset(dir, &rdataset);
 		} else {
 			INSIST(filename != NULL);
 			result = loadset(filename, &rdataset);
 		}
@@ -507,7 +506,8 @@ main(int argc, char **argv) {
 	} else {
 		unsigned char key_buf[DST_KEY_MAXSIZE];
-		loadkey(arg1, key_buf, DST_KEY_MAXSIZE, &rdata);
+		loadkey(argv[isc_commandline_index], key_buf,
 			DST_KEY_MAXSIZE, &rdata);
 		emits(showall, cds, &rdata);
 	}
@@ -517,6 +517,7 @@ main(int argc, char **argv) {
 	}
 	cleanup_logging(&log);
 	dst_lib_destroy();
 	dns_name_destroy();
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
@@ -42,7 +42,6 @@
      <year>2016</year>
      <year>2018</year>
      <year>2019</year>
      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -174,7 +174,9 @@ loadkey(char *filename, unsigned char *key_buf, unsigned int key_buf_size,
 	rdclass = dst_key_class(key);
 	name = dns_fixedname_initname(&fixed);
-	dns_name_copynf(dst_key_name(key), name);
+	result = dns_name_copy(dst_key_name(key), name, NULL);
 	if (result != ISC_R_SUCCESS)
 		fatal("can't copy name");
 	dst_key_free(&key);
 }
@@ -298,7 +300,9 @@ main(int argc, char **argv) {
 	if (argc == 1)
 		usage();
-	isc_mem_create(&mctx);
+	result = isc_mem_create(0, 0, &mctx);
 	if (result != ISC_R_SUCCESS)
 		fatal("out of memory");
 #if USE_PKCS11
 	pk11_result_register();
@@ -439,6 +443,7 @@ main(int argc, char **argv) {
 		dns_rdataset_disassociate(&rdataset);
 	cleanup_logging(&log);
 	dst_lib_destroy();
 	dns_name_destroy();
 	if (verbose > 10)
 		isc_mem_stats(mctx, stdout);
 	isc_mem_destroy(&mctx);
@@ -39,7 +39,6 @@
      <year>2016</year>
      <year>2018</year>
      <year>2019</year>
      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -163,7 +163,7 @@ main(int argc, char **argv) {
 	if (argc == 1)
 		usage();
-	isc_mem_create(&mctx);
+	RUNTIME_CHECK(isc_mem_create(0, 0, &mctx) == ISC_R_SUCCESS);
 #if USE_PKCS11
 	pk11_result_register();
@@ -694,6 +694,7 @@ main(int argc, char **argv) {
 	cleanup_logging(&log);
 	dst_lib_destroy();
 	dns_name_destroy();
 	if (verbose > 10)
 		isc_mem_stats(mctx, stdout);
 	isc_mem_free(mctx, label);
@@ -44,7 +44,6 @@
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -39,7 +39,7 @@
 dnssec-keygen \- DNSSEC key generation tool
 .SH "SYNOPSIS"
 .HP \w'\fBdnssec\-keygen\fR\ 'u
-\fBdnssec\-keygen\fR [\fB\-3\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-b\ \fR\fB\fIkeysize\fR\fR] [\fB\-C\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-d\ \fR\fB\fIbits\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-f\ \fR\fB\fIflag\fR\fR] [\fB\-G\fR] [\fB\-g\ \fR\fB\fIgenerator\fR\fR] [\fB\-h\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-k\ \fR\fB\fIpolicy\fR\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-l\ \fR\fB\fIfile\fR\fR] [\fB\-n\ \fR\fB\fInametype\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-P\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-p\ \fR\fB\fIprotocol\fR\fR] [\fB\-q\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-S\ \fR\fB\fIkey\fR\fR] [\fB\-s\ \fR\fB\fIstrength\fR\fR] [\fB\-T\ \fR\fB\fIrrtype\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-V\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] {name}
+\fBdnssec\-keygen\fR [\fB\-3\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-b\ \fR\fB\fIkeysize\fR\fR] [\fB\-C\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-f\ \fR\fB\fIflag\fR\fR] [\fB\-G\fR] [\fB\-g\ \fR\fB\fIgenerator\fR\fR] [\fB\-h\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-k\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-n\ \fR\fB\fInametype\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-P\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-p\ \fR\fB\fIprotocol\fR\fR] [\fB\-q\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-S\ \fR\fB\fIkey\fR\fR] [\fB\-s\ \fR\fB\fIstrength\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-V\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] {name}
 .SH "DESCRIPTION"
 .PP
 \fBdnssec\-keygen\fR
@@ -109,11 +109,6 @@ option suppresses them\&.
 Indicates that the DNS record containing the key should have the specified class\&. If not specified, class IN is used\&.
 .RE
 .PP
 \-d \fIbits\fR
 .RS 4
 Key size in bits\&. For the algorithms RSASHA1, NSEC3RSASA1, RSASHA256 and RSASHA512 the key size must be in range 1024\-4096\&. DH size is between 128 and 4096\&. This option is ignored for algorithms ECDSAP256SHA256, ECDSAP384SHA384, ED25519 and ED448\&.
 .RE
 .PP
 \-E \fIengine\fR
 .RS 4
 Specifies the cryptographic hardware to use, when applicable\&.
@@ -147,17 +142,6 @@ Prints a short summary of the options and arguments to
 Sets the directory in which the key files are to be written\&.
 .RE
 .PP
 \-k \fIpolicy\fR
 .RS 4
 Create keys for a specific dnssec\-policy\&. If a policy uses multiple keys,
 \fBdnssec\-keygen\fR
 will generate multiple keys\&. This will also create a "\&.state" file to keep track of the key state\&.
 .sp
 This option creates keys according to the dnssec\-policy configuration, hence it cannot be used together with many of the other options that
 \fBdnssec\-keygen\fR
 provides\&.
 .RE
 .PP
 \-L \fIttl\fR
 .RS 4
 Sets the default TTL to use for this key when it is converted into a DNSKEY RR\&. If the key is imported into a zone, this is the TTL that will be used for it, unless there was already a DNSKEY RRset in place, in which case the existing TTL would take precedence\&. If this value is not set and there is no existing DNSKEY RRset, the TTL will default to the SOA TTL\&. Setting the default TTL to
@@ -167,12 +151,6 @@ none
 is the same as leaving it unset\&.
 .RE
 .PP
 \-l \fIfile\fR
 .RS 4
 Provide a configuration file that contains a dnssec\-policy statement (matching the policy set with
 \fB\-k\fR)\&.
 .RE
 .PP
 \-n \fInametype\fR
 .RS 4
 Specifies the owner type of the key\&. The value of
@@ -51,7 +51,6 @@
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -67,7 +66,6 @@
      <arg choice="opt" rep="norepeat"><option>-c <replaceable class="parameter">class</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-D <replaceable class="parameter">date/offset</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-D sync <replaceable class="parameter">date/offset</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-d <replaceable class="parameter">bits</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-E <replaceable class="parameter">engine</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-f <replaceable class="parameter">flag</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-G</option></arg>
@@ -76,9 +74,8 @@
      <arg choice="opt" rep="norepeat"><option>-I <replaceable class="parameter">date/offset</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-i <replaceable class="parameter">interval</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-K <replaceable class="parameter">directory</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-k <replaceable class="parameter">policy</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-k</option></arg>
      <arg choice="opt" rep="norepeat"><option>-L <replaceable class="parameter">ttl</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-l <replaceable class="parameter">file</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-n <replaceable class="parameter">nametype</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-P <replaceable class="parameter">date/offset</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-P sync <replaceable class="parameter">date/offset</replaceable></option></arg>
@@ -87,7 +84,6 @@
      <arg choice="opt" rep="norepeat"><option>-R <replaceable class="parameter">date/offset</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-S <replaceable class="parameter">key</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-s <replaceable class="parameter">strength</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-T <replaceable class="parameter">rrtype</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-t <replaceable class="parameter">type</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-V</option></arg>
      <arg choice="opt" rep="norepeat"><option>-v <replaceable class="parameter">level</replaceable></option></arg>
@@ -211,18 +207,6 @@
 	</listitem>
      </varlistentry>
      <varlistentry>
 	<term>-d <replaceable class="parameter">bits</replaceable></term>
 	<listitem>
 	  <para>
 	    Key size in bits. For the algorithms RSASHA1, NSEC3RSASA1,
 	    RSASHA256 and RSASHA512 the key size must be in range 1024-4096.
 	    DH size is between 128 and 4096. This option is ignored for
 	    algorithms ECDSAP256SHA256, ECDSAP384SHA384, ED25519 and ED448.
 	  </para>
 	</listitem>
      </varlistentry>
      <varlistentry>
 	<term>-E <replaceable class="parameter">engine</replaceable></term>
 	<listitem>
@@ -291,24 +275,6 @@
 	</listitem>
      </varlistentry>
      <varlistentry>
 	<term>-k <replaceable class="parameter">policy</replaceable></term>
 	<listitem>
 	  <para>
 	    Create keys for a specific dnssec-policy.  If a policy uses
 	    multiple keys, <command>dnssec-keygen</command> will generate
 	    multiple keys.  This will also create a ".state" file to keep
 	    track of the key state.
 	  </para>
 	  <para>
 	    This option creates keys according to the dnssec-policy
 	    configuration, hence it cannot be used together with many of
 	    the other options that <command>dnssec-keygen</command>
 	    provides.
 	  </para>
 	</listitem>
      </varlistentry>
      <varlistentry>
 	<term>-L <replaceable class="parameter">ttl</replaceable></term>
 	<listitem>
@@ -325,16 +291,6 @@
 	</listitem>
      </varlistentry>
      <varlistentry>
 	<term>-l <replaceable class="parameter">file</replaceable></term>
 	<listitem>
 	  <para>
 	    Provide a configuration file that contains a dnssec-policy
 	    statement (matching the policy set with <command>-k</command>).
 	  </para>
 	</listitem>
      </varlistentry>
      <varlistentry>
 	<term>-n <replaceable class="parameter">nametype</replaceable></term>
 	<listitem>
@@ -41,7 +41,6 @@
       [<code class="option">-c <em class="replaceable"><code>class</code></em></code>]
       [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>]
       [<code class="option">-D sync <em class="replaceable"><code>date/offset</code></em></code>]
       [<code class="option">-d <em class="replaceable"><code>bits</code></em></code>]
       [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>]
       [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>]
       [<code class="option">-G</code>]
@@ -50,9 +49,8 @@
       [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>]
       [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>]
       [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>]
-       [<code class="option">-k <em class="replaceable"><code>policy</code></em></code>]
+       [<code class="option">-k</code>]
       [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>]
       [<code class="option">-l <em class="replaceable"><code>file</code></em></code>]
       [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>]
       [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>]
       [<code class="option">-P sync <em class="replaceable"><code>date/offset</code></em></code>]
@@ -61,7 +59,6 @@
       [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>]
       [<code class="option">-S <em class="replaceable"><code>key</code></em></code>]
       [<code class="option">-s <em class="replaceable"><code>strength</code></em></code>]
       [<code class="option">-T <em class="replaceable"><code>rrtype</code></em></code>]
       [<code class="option">-t <em class="replaceable"><code>type</code></em></code>]
       [<code class="option">-V</code>]
       [<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
@@ -171,15 +168,6 @@
 	    the specified class.  If not specified, class IN is used.
 	  </p>
 	</dd>
 <dt><span class="term">-d <em class="replaceable"><code>bits</code></em></span></dt>
 <dd>
 	  <p>
 	    Key size in bits. For the algorithms RSASHA1, NSEC3RSASA1,
 	    RSASHA256 and RSASHA512 the key size must be in range 1024-4096.
 	    DH size is between 128 and 4096. This option is ignored for
 	    algorithms ECDSAP256SHA256, ECDSAP384SHA384, ED25519 and ED448.
 	  </p>
 	</dd>
 <dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt>
 <dd>
 	  <p>
@@ -230,21 +218,6 @@
 	    Sets the directory in which the key files are to be written.
 	  </p>
 	</dd>
 <dt><span class="term">-k <em class="replaceable"><code>policy</code></em></span></dt>
 <dd>
 	  <p>
 	    Create keys for a specific dnssec-policy.  If a policy uses
 	    multiple keys, <span class="command"><strong>dnssec-keygen</strong></span> will generate
 	    multiple keys.  This will also create a ".state" file to keep
 	    track of the key state.
 	  </p>
 	  <p>
 	    This option creates keys according to the dnssec-policy
 	    configuration, hence it cannot be used together with many of
 	    the other options that <span class="command"><strong>dnssec-keygen</strong></span>
 	    provides.
 	  </p>
 	</dd>
 <dt><span class="term">-L <em class="replaceable"><code>ttl</code></em></span></dt>
 <dd>
 	  <p>
@@ -258,13 +231,6 @@
 	    or <code class="literal">none</code> is the same as leaving it unset.
 	  </p>
 	</dd>
 <dt><span class="term">-l <em class="replaceable"><code>file</code></em></span></dt>
 <dd>
 	  <p>
 	    Provide a configuration file that contains a dnssec-policy
 	    statement (matching the policy set with <span class="command"><strong>-k</strong></span>).
 	  </p>
 	</dd>
 <dt><span class="term">-n <em class="replaceable"><code>nametype</code></em></span></dt>
 <dd>
 	  <p>
@@ -88,7 +88,9 @@ main(int argc, char **argv) {
 	if (argc == 1)
 		usage();
-	isc_mem_create(&mctx);
+	result = isc_mem_create(0, 0, &mctx);
 	if (result != ISC_R_SUCCESS)
 		fatal("Out of memory");
 #if HAVE_PKCS11
 	pk11_result_register();
@@ -39,7 +39,6 @@
      <year>2016</year>
      <year>2018</year>
      <year>2019</year>
      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -39,7 +39,7 @@
 dnssec-settime \- set the key timing metadata for a DNSSEC key
 .SH "SYNOPSIS"
 .HP \w'\fBdnssec\-settime\fR\ 'u
-\fBdnssec\-settime\fR [\fB\-f\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-P\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-S\ \fR\fB\fIkey\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-h\fR] [\fB\-V\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-s\fR] [\fB\-g\ \fR\fB\fIstate\fR\fR] [\fB\-d\ \fR\fB\fIstate\fR\fR\fB\ \fR\fB\fIdate/offset\fR\fR] [\fB\-k\ \fR\fB\fIstate\fR\fR\fB\ \fR\fB\fIdate/offset\fR\fR] [\fB\-r\ \fR\fB\fIstate\fR\fR\fB\ \fR\fB\fIdate/offset\fR\fR] [\fB\-z\ \fR\fB\fIstate\fR\fR\fB\ \fR\fB\fIdate/offset\fR\fR] {keyfile}
+\fBdnssec\-settime\fR [\fB\-f\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-P\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-S\ \fR\fB\fIkey\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-h\fR] [\fB\-V\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] {keyfile}
 .SH "DESCRIPTION"
 .PP
 \fBdnssec\-settime\fR
@@ -59,25 +59,7 @@ simply prints the key timing metadata already stored in the key\&.
 .PP
 When key metadata fields are changed, both files of a key pair (Knnnn\&.+aaa+iiiii\&.key
 and
-Knnnn\&.+aaa+iiiii\&.private) are regenerated\&.
+Knnnn\&.+aaa+iiiii\&.private) are regenerated\&. Metadata fields are stored in the private file\&. A human\-readable description of the metadata is also placed in comments in the key file\&. The private file\*(Aqs permissions are always set to be inaccessible to anyone other than the owner (mode 0600)\&.
 .PP
 Metadata fields are stored in the private file\&. A human\-readable description of the metadata is also placed in comments in the key file\&. The private file\*(Aqs permissions are always set to be inaccessible to anyone other than the owner (mode 0600)\&.
 .PP
 When working with state files, it is possible to update the timing metadata in those files as well with
 \fB\-s\fR\&. If this option is used you can also update key states with
 \fB\-d\fR
 (DS),
 \fB\-k\fR
 (DNSKEY),
 \fB\-r\fR
 (RRSIG of KSK), or
 \fB\-z\fR
 (RRSIG of ZSK)\&. Allowed states are HIDDEN, RUMOURED, OMNIPRESENT, and UNRETENTIVE\&.
 .PP
 You can also set the goal state of the key with
 \fB\-g\fR\&. This should be either HIDDEN or OMNIPRESENT (representing whether the key should be removed from the zone, or published)\&.
 .PP
 It is NOT RECOMMENDED to manipulate state files manually except for testing purposes\&.
 .SH "OPTIONS"
 .PP
 \-f
@@ -174,39 +156,6 @@ If the key is being set to be an explicit successor to another key, then the def
 .sp
 As with date offsets, if the argument is followed by one of the suffixes \*(Aqy\*(Aq, \*(Aqmo\*(Aq, \*(Aqw\*(Aq, \*(Aqd\*(Aq, \*(Aqh\*(Aq, or \*(Aqmi\*(Aq, then the interval is measured in years, months, weeks, days, hours, or minutes, respectively\&. Without a suffix, the interval is measured in seconds\&.
 .RE
 .SH "KEY STATE OPTIONS"
 .PP
 Known key states are HIDDEN, RUMOURED, OMNIPRESENT and UNRETENTIVE\&. These should not be set manually except for testing purposes\&.
 .PP
 \-s
 .RS 4
 When setting key timing data, also update the state file\&.
 .RE
 .PP
 \-g
 .RS 4
 Set the goal state for this key\&. Must be HIDDEN or OMNIPRESENT\&.
 .RE
 .PP
 \-d
 .RS 4
 Set the DS state for this key, and when it was last changed\&.
 .RE
 .PP
 \-k
 .RS 4
 Set the DNSKEY state for this key, and when it was last changed\&.
 .RE
 .PP
 \-r
 .RS 4
 Set the RRSIG (KSK) state for this key, and when it was last changed\&.
 .RE
 .PP
 \-z
 .RS 4
 Set the RRSIG (ZSK) state for this key, and when it was last changed\&.
 .RE
 .SH "PRINTING OPTIONS"
 .PP
 \fBdnssec\-settime\fR
@@ -88,15 +88,6 @@ usage(void) {
 	fprintf(stderr, "    -i <interval>: prepublication interval for "
 					   "successor key "
 					   "(default: 30 days)\n");
 	fprintf(stderr, "Key state options:\n");
 	fprintf(stderr, "    -s: update key state file (default no)\n");
 	fprintf(stderr, "    -g state: set the goal state for this key\n");
 	fprintf(stderr, "    -d state date/[+-]offset: set the DS state\n");
 	fprintf(stderr, "    -k state date/[+-]offset: set the DNSKEY state\n");
 	fprintf(stderr, "    -r state date/[+-]offset: set the RRSIG (KSK) "
 						      "state\n");
 	fprintf(stderr, "    -z state date/[+-]offset: set the RRSIG (ZSK) "
 						      "state\n");
 	fprintf(stderr, "Printing options:\n");
 	fprintf(stderr, "    -p C/P/Psync/A/R/I/D/Dsync/all: print a "
 					"particular time value or values\n");
@@ -132,87 +123,29 @@ printtime(dst_key_t *key, int type, const char *tag, bool epoch,
 	}
 }
 static void
 writekey(dst_key_t *key, const char *directory, bool write_state)
 {
 	char newname[1024];
 	char keystr[DST_KEY_FORMATSIZE];
 	isc_buffer_t buf;
 	isc_result_t result;
 	int options = DST_TYPE_PUBLIC|DST_TYPE_PRIVATE;
 	if (write_state) {
 		options |= DST_TYPE_STATE;
 	}
 	isc_buffer_init(&buf, newname, sizeof(newname));
 	result = dst_key_buildfilename(key, DST_TYPE_PUBLIC, directory, &buf);
 	if (result != ISC_R_SUCCESS) {
 		fatal("Failed to build public key filename: %s",
 		      isc_result_totext(result));
 	}
 	result = dst_key_tofile(key, options, directory);
 	if (result != ISC_R_SUCCESS) {
 		dst_key_format(key, keystr, sizeof(keystr));
 		fatal("Failed to write key %s: %s", keystr,
 		      isc_result_totext(result));
 	}
 	printf("%s\n", newname);
 	isc_buffer_clear(&buf);
 	result = dst_key_buildfilename(key, DST_TYPE_PRIVATE, directory, &buf);
 	if (result != ISC_R_SUCCESS) {
 		fatal("Failed to build private key filename: %s",
 		      isc_result_totext(result));
 	}
 	printf("%s\n", newname);
 	if (write_state) {
 		isc_buffer_clear(&buf);
 		result = dst_key_buildfilename(key, DST_TYPE_STATE, directory,
 					       &buf);
 		if (result != ISC_R_SUCCESS) {
 			fatal("Failed to build key state filename: %s",
 			      isc_result_totext(result));
 		}
 		printf("%s\n", newname);
 	}
 }
 int
 main(int argc, char **argv) {
 	isc_result_t	result;
 	const char	*engine = NULL;
 	const char 	*filename = NULL;
 	char		*directory = NULL;
 	char		newname[1024];
 	char		keystr[DST_KEY_FORMATSIZE];
 	char		*endp, *p;
 	int		ch;
 	const char	*predecessor = NULL;
 	dst_key_t	*prevkey = NULL;
 	dst_key_t	*key = NULL;
 	isc_buffer_t	buf;
 	dns_name_t	*name = NULL;
 	dns_secalg_t 	alg = 0;
 	unsigned int 	size = 0;
 	uint16_t	flags = 0;
 	int		prepub = -1;
 	int		options;
 	dns_ttl_t	ttl = 0;
 	isc_stdtime_t	now;
 	isc_stdtime_t	dstime = 0, dnskeytime = 0;
 	isc_stdtime_t	krrsigtime = 0, zrrsigtime = 0;
 	isc_stdtime_t	pub = 0, act = 0, rev = 0, inact = 0, del = 0;
 	isc_stdtime_t	prevact = 0, previnact = 0, prevdel = 0;
 	dst_key_state_t	goal = DST_KEY_STATE_NA;
 	dst_key_state_t	ds = DST_KEY_STATE_NA;
 	dst_key_state_t	dnskey = DST_KEY_STATE_NA;
 	dst_key_state_t	krrsig = DST_KEY_STATE_NA;
 	dst_key_state_t	zrrsig = DST_KEY_STATE_NA;
 	bool	setgoal = false, setds = false, setdnskey = false;
 	bool	setkrrsig = false, setzrrsig = false;
 	bool	setdstime = false, setdnskeytime = false;
 	bool	setkrrsigtime = false, setzrrsigtime = false;
 	bool	setpub = false, setact = false;
 	bool	setrev = false, setinact = false;
 	bool	setdel = false, setttl = false;
@@ -223,21 +156,20 @@ main(int argc, char **argv) {
 	bool	printact = false,  printrev = false;
 	bool	printinact = false, printdel = false;
 	bool	force = false;
-	bool	epoch = false;
+	bool   epoch = false;
-	bool	changed = false;
+	bool   changed = false;
 	bool	write_state = false;
 	isc_log_t       *log = NULL;
 	isc_stdtime_t	syncadd = 0, syncdel = 0;
 	bool	unsetsyncadd = false, setsyncadd = false;
 	bool	unsetsyncdel = false, setsyncdel = false;
 	bool	printsyncadd = false, printsyncdel = false;
 	options = DST_TYPE_PUBLIC|DST_TYPE_PRIVATE|DST_TYPE_STATE;
 	if (argc == 1)
 		usage();
-	isc_mem_create(&mctx);
+	result = isc_mem_create(0, 0, &mctx);
 	if (result != ISC_R_SUCCESS)
 		fatal("Out of memory");
 	setup_logging(mctx, &log);
@@ -250,9 +182,109 @@ main(int argc, char **argv) {
 	isc_stdtime_get(&now);
-#define CMDLINE_FLAGS "A:D:d:E:fg:hI:i:K:k:L:P:p:R:r:S:suv:Vz:"
+#define CMDLINE_FLAGS "A:D:E:fhI:i:K:L:P:p:R:S:uv:V"
 	while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (ch) {
 		case 'E':
 			engine = isc_commandline_argument;
 			break;
 		case 'f':
 			force = true;
 			break;
 		case 'p':
 			p = isc_commandline_argument;
 			if (!strcasecmp(p, "all")) {
 				printcreate = true;
 				printpub = true;
 				printact = true;
 				printrev = true;
 				printinact = true;
 				printdel = true;
 				printsyncadd = true;
 				printsyncdel = true;
 				break;
 			}
 			do {
 				switch (*p++) {
 				case 'C':
 					printcreate = true;
 					break;
 				case 'P':
 					if (!strncmp(p, "sync", 4)) {
 						p += 4;
 						printsyncadd = true;
 						break;
 					}
 					printpub = true;
 					break;
 				case 'A':
 					printact = true;
 					break;
 				case 'R':
 					printrev = true;
 					break;
 				case 'I':
 					printinact = true;
 					break;
 				case 'D':
 					if (!strncmp(p, "sync", 4)) {
 						p += 4;
 						printsyncdel = true;
 						break;
 					}
 					printdel = true;
 					break;
 				case ' ':
 					break;
 				default:
 					usage();
 					break;
 				}
 			} while (*p != '\0');
 			break;
 		case 'u':
 			epoch = true;
 			break;
 		case 'K':
 			/*
 			 * We don't have to copy it here, but do it to
 			 * simplify cleanup later
 			 */
 			directory = isc_mem_strdup(mctx,
 						   isc_commandline_argument);
 			break;
 		case 'L':
 			ttl = strtottl(isc_commandline_argument);
 			setttl = true;
 			break;
 		case 'v':
 			verbose = strtol(isc_commandline_argument, &endp, 0);
 			if (*endp != '\0')
 				fatal("-v must be followed by a number");
 			break;
 		case 'P':
 			/* -Psync ? */
 			if (isoptarg("sync", argv, usage)) {
 				if (unsetsyncadd || setsyncadd)
 					fatal("-P sync specified more than "
 					      "once");
 				changed = true;
 				syncadd = strtotime(isc_commandline_argument,
 						   now, now, &setsyncadd);
 				unsetsyncadd = !setsyncadd;
 				break;
 			}
 			(void)isoptarg("dnskey", argv, usage);
 			if (setpub || unsetpub)
 				fatal("-P specified more than once");
 			changed = true;
 			pub = strtotime(isc_commandline_argument,
 					now, now, &setpub);
 			unsetpub = !setpub;
 			break;
 		case 'A':
 			if (setact || unsetact)
 				fatal("-A specified more than once");
@@ -262,6 +294,24 @@ main(int argc, char **argv) {
 					now, now, &setact);
 			unsetact = !setact;
 			break;
 		case 'R':
 			if (setrev || unsetrev)
 				fatal("-R specified more than once");
 			changed = true;
 			rev = strtotime(isc_commandline_argument,
 					now, now, &setrev);
 			unsetrev = !setrev;
 			break;
 		case 'I':
 			if (setinact || unsetinact)
 				fatal("-I specified more than once");
 			changed = true;
 			inact = strtotime(isc_commandline_argument,
 					now, now, &setinact);
 			unsetinact = !setinact;
 			break;
 		case 'D':
 			/* -Dsync ? */
 			if (isoptarg("sync", argv, usage)) {
@@ -285,37 +335,11 @@ main(int argc, char **argv) {
 					now, now, &setdel);
 			unsetdel = !setdel;
 			break;
-		case 'd':
+		case 'S':
-			if (setds) {
+			predecessor = isc_commandline_argument;
 				fatal("-d specified more than once");
 			}
 			ds = strtokeystate(isc_commandline_argument);
 			setds = true;
 			/* time */
 			(void)isoptarg(isc_commandline_argument, argv, usage);
 			dstime = strtotime(isc_commandline_argument,
 					   now, now, &setdstime);
 			break;
-		case 'E':
+		case 'i':
-			engine = isc_commandline_argument;
+			prepub = strtottl(isc_commandline_argument);
 			break;
 		case 'f':
 			force = true;
 			break;
 		case 'g':
 			if (setgoal) {
 				fatal("-g specified more than once");
 			}
 			goal = strtokeystate(isc_commandline_argument);
 			if (goal != DST_KEY_STATE_NA &&
 			    goal != DST_KEY_STATE_HIDDEN &&
 			    goal != DST_KEY_STATE_OMNIPRESENT) {
 				fatal("-g must be either none, hidden, or "
 				      "omnipresent");
 			}
 			setgoal = true;
 			break;
 		case '?':
 			if (isc_commandline_option != '?')
@@ -325,165 +349,10 @@ main(int argc, char **argv) {
 		case 'h':
 			/* Does not return. */
 			usage();
 		case 'I':
 			if (setinact || unsetinact)
 				fatal("-I specified more than once");
 			changed = true;
 			inact = strtotime(isc_commandline_argument,
 					now, now, &setinact);
 			unsetinact = !setinact;
 			break;
 		case 'i':
 			prepub = strtottl(isc_commandline_argument);
 			break;
 		case 'K':
 			/*
 			 * We don't have to copy it here, but do it to
 			 * simplify cleanup later
 			 */
 			directory = isc_mem_strdup(mctx,
 						   isc_commandline_argument);
 			break;
 		case 'k':
 			if (setdnskey) {
 				fatal("-k specified more than once");
 			}
 			dnskey = strtokeystate(isc_commandline_argument);
 			setdnskey = true;
 			/* time */
 			(void)isoptarg(isc_commandline_argument, argv, usage);
 			dnskeytime = strtotime(isc_commandline_argument,
 					       now, now, &setdnskeytime);
 			break;
 		case 'L':
 			ttl = strtottl(isc_commandline_argument);
 			setttl = true;
 			break;
 		case 'P':
 			/* -Psync ? */
 			if (isoptarg("sync", argv, usage)) {
 				if (unsetsyncadd || setsyncadd)
 					fatal("-P sync specified more than "
 					      "once");
 				changed = true;
 				syncadd = strtotime(isc_commandline_argument,
 						   now, now, &setsyncadd);
 				unsetsyncadd = !setsyncadd;
 				break;
 			}
 			(void)isoptarg("dnskey", argv, usage);
 			if (setpub || unsetpub)
 				fatal("-P specified more than once");
 			changed = true;
 			pub = strtotime(isc_commandline_argument,
 					now, now, &setpub);
 			unsetpub = !setpub;
 			break;
 		case 'p':
 			p = isc_commandline_argument;
 			if (!strcasecmp(p, "all")) {
 				printcreate = true;
 				printpub = true;
 				printact = true;
 				printrev = true;
 				printinact = true;
 				printdel = true;
 				printsyncadd = true;
 				printsyncdel = true;
 				break;
 			}
 			do {
 				switch (*p++) {
 				case 'A':
 					printact = true;
 					break;
 				case 'C':
 					printcreate = true;
 					break;
 				case 'D':
 					if (!strncmp(p, "sync", 4)) {
 						p += 4;
 						printsyncdel = true;
 						break;
 					}
 					printdel = true;
 					break;
 				case 'I':
 					printinact = true;
 					break;
 				case 'P':
 					if (!strncmp(p, "sync", 4)) {
 						p += 4;
 						printsyncadd = true;
 						break;
 					}
 					printpub = true;
 					break;
 				case 'R':
 					printrev = true;
 					break;
 				case ' ':
 					break;
 				default:
 					usage();
 					break;
 				}
 			} while (*p != '\0');
 			break;
 		case 'R':
 			if (setrev || unsetrev)
 				fatal("-R specified more than once");
 			changed = true;
 			rev = strtotime(isc_commandline_argument,
 					now, now, &setrev);
 			unsetrev = !setrev;
 			break;
 		case 'r':
 			if (setkrrsig) {
 				fatal("-r specified more than once");
 			}
 			krrsig = strtokeystate(isc_commandline_argument);
 			setkrrsig = true;
 			/* time */
 			(void)isoptarg(isc_commandline_argument, argv, usage);
 			krrsigtime = strtotime(isc_commandline_argument,
 					       now, now, &setkrrsigtime);
 			break;
 		case 'S':
 			predecessor = isc_commandline_argument;
 			break;
 		case 's':
 			write_state = true;
 			break;
 		case 'u':
 			epoch = true;
 			break;
 		case 'V':
 			/* Does not return. */
 			version(program);
 		case 'v':
 			verbose = strtol(isc_commandline_argument, &endp, 0);
 			if (*endp != '\0')
 				fatal("-v must be followed by a number");
 			break;
 		case 'z':
 			if (setzrrsig) {
 				fatal("-z specified more than once");
 			}
 			zrrsig = strtokeystate(isc_commandline_argument);
 			setzrrsig = true;
 			(void)isoptarg(isc_commandline_argument, argv, usage);
 			zrrsigtime = strtotime(isc_commandline_argument,
 					       now, now, &setzrrsigtime);
 			break;
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n",
@@ -498,12 +367,6 @@ main(int argc, char **argv) {
 	if (argc > isc_commandline_index + 1)
 		fatal("Extraneous arguments");
 	if ((setgoal || setds || setdnskey || setkrrsig || setzrrsig) &&
 	    !write_state)
 	{
 		fatal("Options -g, -d, -k, -r and -z require -s to be set");
 	}
 	result = dst_lib_init(mctx, engine);
 	if (result != ISC_R_SUCCESS)
 		fatal("Could not initialize dst: %s",
@@ -520,7 +383,9 @@ main(int argc, char **argv) {
 		if (setact || unsetact)
 			fatal("-S and -A cannot be used together");
-		result = dst_key_fromnamedfile(predecessor, directory, options,
+		result = dst_key_fromnamedfile(predecessor, directory,
 					       DST_TYPE_PUBLIC |
 					       DST_TYPE_PRIVATE,
 					       mctx, &prevkey);
 		if (result != ISC_R_SUCCESS)
 			fatal("Invalid keyfile %s: %s",
@@ -612,8 +477,9 @@ main(int argc, char **argv) {
 			      isc_result_totext(result));
 	}
-	result = dst_key_fromnamedfile(filename, directory, options, mctx,
+	result = dst_key_fromnamedfile(filename, directory,
-				       &key);
+				       DST_TYPE_PUBLIC | DST_TYPE_PRIVATE,
 				       mctx, &key);
 	if (result != ISC_R_SUCCESS)
 		fatal("Invalid keyfile %s: %s",
 		      filename, isc_result_totext(result));
@@ -714,11 +580,6 @@ main(int argc, char **argv) {
 	if (setttl)
 		dst_key_setttl(key, ttl);
 	if (predecessor != NULL && prevkey != NULL) {
 		dst_key_setnum(prevkey, DST_NUM_SUCCESSOR, dst_key_id(key));
 		dst_key_setnum(key, DST_NUM_PREDECESSOR, dst_key_id(prevkey));
 	}
 	/*
 	 * No metadata changes were made but we're forcing an upgrade
 	 * to the new format anyway: use "-P now -A now" as the default
@@ -729,63 +590,6 @@ main(int argc, char **argv) {
 		changed = true;
 	}
 	/*
 	 * Make sure the key state goals are written.
 	 */
 	if (write_state) {
 		if (setgoal) {
 			if (goal == DST_KEY_STATE_NA) {
 				dst_key_unsetstate(key, DST_KEY_GOAL);
 			} else {
 				dst_key_setstate(key, DST_KEY_GOAL, goal);
 			}
 			changed = true;
 		}
 		if (setds) {
 			if (ds == DST_KEY_STATE_NA) {
 				dst_key_unsetstate(key, DST_KEY_DS);
 				dst_key_unsettime(key, DST_TIME_DS);
 			} else {
 				dst_key_setstate(key, DST_KEY_DS, ds);
 				dst_key_settime(key, DST_TIME_DS, dstime);
 			}
 			changed = true;
 		}
 		if (setdnskey) {
 			if (dnskey == DST_KEY_STATE_NA) {
 				dst_key_unsetstate(key, DST_KEY_DNSKEY);
 				dst_key_unsettime(key, DST_TIME_DNSKEY);
 			} else {
 				dst_key_setstate(key, DST_KEY_DNSKEY, dnskey);
 				dst_key_settime(key, DST_TIME_DNSKEY,
 						dnskeytime);
 			}
 			changed = true;
 		}
 		if (setkrrsig) {
 			if (krrsig == DST_KEY_STATE_NA) {
 				dst_key_unsetstate(key, DST_KEY_KRRSIG);
 				dst_key_unsettime(key, DST_TIME_KRRSIG);
 			} else {
 				dst_key_setstate(key, DST_KEY_KRRSIG, krrsig);
 				dst_key_settime(key, DST_TIME_KRRSIG,
 						krrsigtime);
 			}
 			changed = true;
 		}
 		if (setzrrsig) {
 			if (zrrsig == DST_KEY_STATE_NA) {
 				dst_key_unsetstate(key, DST_KEY_ZRRSIG);
 				dst_key_unsettime(key, DST_TIME_ZRRSIG);
 			} else {
 				dst_key_setstate(key, DST_KEY_ZRRSIG, zrrsig);
 				dst_key_settime(key, DST_TIME_ZRRSIG,
 						zrrsigtime);
 			}
 			changed = true;
 		}
 	}
 	if (!changed && setttl)
 		changed = true;
@@ -819,10 +623,32 @@ main(int argc, char **argv) {
 			  epoch, stdout);
 	if (changed) {
-		writekey(key, directory, write_state);
+		isc_buffer_init(&buf, newname, sizeof(newname));
-		if (predecessor != NULL && prevkey != NULL) {
+		result = dst_key_buildfilename(key, DST_TYPE_PUBLIC, directory,
-			writekey(prevkey, directory, write_state);
+					       &buf);
 		if (result != ISC_R_SUCCESS) {
 			fatal("Failed to build public key filename: %s",
 			      isc_result_totext(result));
 		}
 		result = dst_key_tofile(key, DST_TYPE_PUBLIC|DST_TYPE_PRIVATE,
 					directory);
 		if (result != ISC_R_SUCCESS) {
 			dst_key_format(key, keystr, sizeof(keystr));
 			fatal("Failed to write key %s: %s", keystr,
 			      isc_result_totext(result));
 		}
 		printf("%s\n", newname);
 		isc_buffer_clear(&buf);
 		result = dst_key_buildfilename(key, DST_TYPE_PRIVATE, directory,
 					       &buf);
 		if (result != ISC_R_SUCCESS) {
 			fatal("Failed to build private key filename: %s",
 			      isc_result_totext(result));
 		}
 		printf("%s\n", newname);
 	}
 	if (prevkey != NULL)
@@ -41,7 +41,6 @@
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -65,12 +64,6 @@
      <arg choice="opt" rep="norepeat"><option>-V</option></arg>
      <arg choice="opt" rep="norepeat"><option>-v <replaceable class="parameter">level</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-E <replaceable class="parameter">engine</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-s</option></arg>
      <arg choice="opt" rep="norepeat"><option>-g <replaceable class="parameter">state</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-d <replaceable class="parameter">state</replaceable> <replaceable class="parameter">date/offset</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-k <replaceable class="parameter">state</replaceable> <replaceable class="parameter">date/offset</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-r <replaceable class="parameter">state</replaceable> <replaceable class="parameter">date/offset</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-z <replaceable class="parameter">state</replaceable> <replaceable class="parameter">date/offset</replaceable></option></arg>
      <arg choice="req" rep="norepeat">keyfile</arg>
    </cmdsynopsis>
  </refsynopsisdiv>
@@ -95,30 +88,11 @@
      When key metadata fields are changed, both files of a key
      pair (<filename>Knnnn.+aaa+iiiii.key</filename> and
      <filename>Knnnn.+aaa+iiiii.private</filename>) are regenerated.
    </para>
    <para>
      Metadata fields are stored in the private file.  A human-readable
      description of the metadata is also placed in comments in the key
      file.  The private file's permissions are always set to be
      inaccessible to anyone other than the owner (mode 0600).
    </para>
    <para>
      When working with state files, it is possible to update the timing
      metadata in those files as well with <option>-s</option>.  If this
      option is used you can also update key states with <option>-d</option>
      (DS), <option>-k</option> (DNSKEY), <option>-r</option> (RRSIG of KSK),
      or <option>-z</option> (RRSIG of ZSK). Allowed states are HIDDEN,
      RUMOURED, OMNIPRESENT, and UNRETENTIVE.
    </para>
    <para>
      You can also set the goal state of the key with <option>-g</option>.
      This should be either HIDDEN or OMNIPRESENT (representing whether the
      key should be removed from the zone, or published).
    </para>
    <para>
      It is NOT RECOMMENDED to manipulate state files manually except for
      testing purposes.
    </para>
  </refsection>
  <refsection><info><title>OPTIONS</title></info>
@@ -345,74 +319,6 @@
    </variablelist>
  </refsection>
  <refsection><info><title>KEY STATE OPTIONS</title></info>
    <para>
      Known key states are HIDDEN, RUMOURED, OMNIPRESENT and UNRETENTIVE.
      These should not be set manually except for testing purposes.
    </para>
    <variablelist>
      <varlistentry>
        <term>-s</term>
        <listitem>
          <para>
 	    When setting key timing data, also update the state file.
          </para>
        </listitem>
      </varlistentry>
      <varlistentry>
        <term>-g</term>
        <listitem>
          <para>
 	    Set the goal state for this key. Must be HIDDEN or OMNIPRESENT.
          </para>
        </listitem>
      </varlistentry>
      <varlistentry>
        <term>-d</term>
        <listitem>
          <para>
 	    Set the DS state for this key, and when it was last changed.
          </para>
        </listitem>
      </varlistentry>
      <varlistentry>
        <term>-k</term>
        <listitem>
          <para>
 	    Set the DNSKEY state for this key, and when it was last changed.
          </para>
        </listitem>
      </varlistentry>
      <varlistentry>
        <term>-r</term>
        <listitem>
          <para>
 	    Set the RRSIG (KSK) state for this key, and when it was last
 	    changed.
          </para>
        </listitem>
      </varlistentry>
      <varlistentry>
        <term>-z</term>
        <listitem>
          <para>
 	    Set the RRSIG (ZSK) state for this key, and when it was last
 	    changed.
          </para>
        </listitem>
      </varlistentry>
    </variablelist>
  </refsection>
  <refsection><info><title>PRINTING OPTIONS</title></info>
    <para>
@@ -49,12 +49,6 @@
       [<code class="option">-V</code>]
       [<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
       [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>]
       [<code class="option">-s</code>]
       [<code class="option">-g <em class="replaceable"><code>state</code></em></code>]
       [<code class="option">-d <em class="replaceable"><code>state</code></em> <em class="replaceable"><code>date/offset</code></em></code>]
       [<code class="option">-k <em class="replaceable"><code>state</code></em> <em class="replaceable"><code>date/offset</code></em></code>]
       [<code class="option">-r <em class="replaceable"><code>state</code></em> <em class="replaceable"><code>date/offset</code></em></code>]
       [<code class="option">-z <em class="replaceable"><code>state</code></em> <em class="replaceable"><code>date/offset</code></em></code>]
       {keyfile}
    </p></div>
  </div>
@@ -80,30 +74,11 @@
      When key metadata fields are changed, both files of a key
      pair (<code class="filename">Knnnn.+aaa+iiiii.key</code> and
      <code class="filename">Knnnn.+aaa+iiiii.private</code>) are regenerated.
    </p>
    <p>
      Metadata fields are stored in the private file.  A human-readable
      description of the metadata is also placed in comments in the key
      file.  The private file's permissions are always set to be
      inaccessible to anyone other than the owner (mode 0600).
    </p>
    <p>
      When working with state files, it is possible to update the timing
      metadata in those files as well with <code class="option">-s</code>.  If this
      option is used you can also update key states with <code class="option">-d</code>
      (DS), <code class="option">-k</code> (DNSKEY), <code class="option">-r</code> (RRSIG of KSK),
      or <code class="option">-z</code> (RRSIG of ZSK). Allowed states are HIDDEN,
      RUMOURED, OMNIPRESENT, and UNRETENTIVE.
    </p>
    <p>
      You can also set the goal state of the key with <code class="option">-g</code>.
      This should be either HIDDEN or OMNIPRESENT (representing whether the
      key should be removed from the zone, or published).
    </p>
    <p>
      It is NOT RECOMMENDED to manipulate state files manually except for
      testing purposes.
    </p>
  </div>
  <div class="refsection">
@@ -287,57 +262,7 @@
  </div>
  <div class="refsection">
-<a name="id-1.10"></a><h2>KEY STATE OPTIONS</h2>
+<a name="id-1.10"></a><h2>PRINTING OPTIONS</h2>
    <p>
      Known key states are HIDDEN, RUMOURED, OMNIPRESENT and UNRETENTIVE.
      These should not be set manually except for testing purposes.
    </p>
    <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-s</span></dt>
 <dd>
          <p>
 	    When setting key timing data, also update the state file.
          </p>
        </dd>
 <dt><span class="term">-g</span></dt>
 <dd>
          <p>
 	    Set the goal state for this key. Must be HIDDEN or OMNIPRESENT.
          </p>
        </dd>
 <dt><span class="term">-d</span></dt>
 <dd>
          <p>
 	    Set the DS state for this key, and when it was last changed.
          </p>
        </dd>
 <dt><span class="term">-k</span></dt>
 <dd>
          <p>
 	    Set the DNSKEY state for this key, and when it was last changed.
          </p>
        </dd>
 <dt><span class="term">-r</span></dt>
 <dd>
          <p>
 	    Set the RRSIG (KSK) state for this key, and when it was last
 	    changed.
          </p>
        </dd>
 <dt><span class="term">-z</span></dt>
 <dd>
          <p>
 	    Set the RRSIG (ZSK) state for this key, and when it was last
 	    changed.
          </p>
        </dd>
 </dl></div>
  </div>
  <div class="refsection">
 <a name="id-1.11"></a><h2>PRINTING OPTIONS</h2>
    <p>
      <span class="command"><strong>dnssec-settime</strong></span> can also be used to print the
@@ -373,7 +298,7 @@
  </div>
  <div class="refsection">
-<a name="id-1.12"></a><h2>SEE ALSO</h2>
+<a name="id-1.11"></a><h2>SEE ALSO</h2>
    <p><span class="citerefentry">
        <span class="refentrytitle">dnssec-keygen</span>(8)
@@ -197,7 +197,7 @@ savezonecut(dns_fixedname_t *fzonecut, dns_name_t *name) {
 	dns_name_t *result;
 	result = dns_fixedname_initname(fzonecut);
-	dns_name_copynf(name, result);
+	dns_name_copy(name, result, NULL);
 	return (result);
 }
@@ -246,8 +246,7 @@ dumpnode(dns_name_t *name, dns_dbnode_t *node) {
 		for (;;) {
 			result = dns_master_rdatasettotext(name, &rds,
-							   masterstyle, NULL,
+							   masterstyle, buffer);
 							   buffer);
 			if (result != ISC_R_NOSPACE)
 				break;
@@ -788,10 +787,7 @@ hashlist_comp(const void *a, const void *b) {
 static void
 hashlist_sort(hashlist_t *l) {
-	INSIST(l->hashbuf != NULL || l->length == 0);
+	qsort(l->hashbuf, l->entries, l->length, hashlist_comp);
 	if (l->length > 0) {
 		qsort(l->hashbuf, l->entries, l->length, hashlist_comp);
 	}
 }
 static bool
@@ -1574,6 +1570,8 @@ assignwork(isc_task_t *task, isc_task_t *worker) {
 	sevent = (sevent_t *)
 		 isc_event_allocate(mctx, task, SIGNER_EVENT_WORK,
 				    sign, NULL, sizeof(sevent_t));
 	if (sevent == NULL)
 		fatal("failed to allocate event\n");
 	sevent->node = node;
 	sevent->fname = fname;
@@ -1629,6 +1627,8 @@ sign(isc_task_t *task, isc_event_t *event) {
 	wevent = (sevent_t *)
 		 isc_event_allocate(mctx, task, SIGNER_EVENT_WRITE,
 				    writenode, NULL, sizeof(sevent_t));
 	if (wevent == NULL)
 		fatal("failed to allocate event\n");
 	wevent->node = node;
 	wevent->fname = fname;
 	isc_task_send(master, ISC_EVENT_PTR(&wevent));
@@ -1710,6 +1710,7 @@ remove_records(dns_dbnode_t *node, dns_rdatatype_t which,
 			result = dns_db_deleterdataset(gdb, node, gversion,
 						       type, covers);
 			check_result(result, "dns_db_deleterdataset()");
 			continue;
 		}
 	}
 	dns_rdatasetiter_destroy(&rdsiter);
@@ -2328,7 +2329,7 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 			break;
 		}
 		if (result == ISC_R_NOMORE) {
-			dns_name_copynf(gorigin, nextname);
+			dns_name_copy(gorigin, nextname, NULL);
 			done = true;
 		} else if (result != ISC_R_SUCCESS)
 			fatal("iterating through the database failed: %s",
@@ -2462,7 +2463,7 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 			break;
 		}
 		if (result == ISC_R_NOMORE) {
-			dns_name_copynf(gorigin, nextname);
+			dns_name_copy(gorigin, nextname, NULL);
 			done = true;
 		} else if (result != ISC_R_SUCCESS)
 			fatal("iterating through the database failed: %s",
@@ -2718,7 +2719,7 @@ build_final_keylist(void) {
 	 * Update keylist with information from from the key repository.
 	 */
 	dns_dnssec_updatekeys(&keylist, &matchkeys, NULL, gorigin, keyttl,
-			      &diff, mctx, report);
+			      &diff, ignore_kskflag, mctx, report);
 	/*
 	 * Update keylist with sync records.
@@ -3233,7 +3234,9 @@ main(int argc, char *argv[]) {
 	check_result(isc_app_start(), "isc_app_start");
-	isc_mem_create(&mctx);
+	result = isc_mem_create(0, 0, &mctx);
 	if (result != ISC_R_SUCCESS)
 		fatal("out of memory");
 #if USE_PKCS11
 	pk11_result_register();
@@ -3586,6 +3589,7 @@ main(int argc, char *argv[]) {
 			outputformat = dns_masterformat_raw;
 		} else if (strncasecmp(outputformatstr, "raw=", 4) == 0) {
 			char *end;
 			outputformat = dns_masterformat_raw;
 			outputformat = dns_masterformat_raw;
 			rawversion = strtol(outputformatstr + 4, &end, 10);
@@ -3798,7 +3802,7 @@ main(int argc, char *argv[]) {
 	print_time(outfp);
 	print_version(outfp);
-	result = isc_taskmgr_create(mctx, ntasks, 0, NULL, &taskmgr);
+	result = isc_taskmgr_create(mctx, ntasks, 0, &taskmgr);
 	if (result != ISC_R_SUCCESS)
 		fatal("failed to create task manager: %s",
 		      isc_result_totext(result));
@@ -3922,6 +3926,7 @@ main(int argc, char *argv[]) {
 	cleanup_logging(&log);
 	dst_lib_destroy();
 	dns_name_destroy();
 	if (verbose > 10)
 		isc_mem_stats(mctx, stdout);
 	isc_mem_destroy(&mctx);
@@ -51,7 +51,6 @@
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -209,7 +209,9 @@ main(int argc, char *argv[]) {
 	isc_commandline_reset = true;
 	check_result(isc_app_start(), "isc_app_start");
-	isc_mem_create(&mctx);
+	result = isc_mem_create(0, 0, &mctx);
 	if (result != ISC_R_SUCCESS)
 		fatal("out of memory");
 #if USE_PKCS11
 	pk11_result_register();
@@ -335,6 +337,7 @@ main(int argc, char *argv[]) {
 	cleanup_logging(&log);
 	dst_lib_destroy();
 	dns_name_destroy();
 	if (verbose > 10)
 		isc_mem_stats(mctx, stdout);
 	isc_mem_destroy(&mctx);
@@ -38,7 +38,6 @@
      <year>2016</year>
      <year>2018</year>
      <year>2019</year>
      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -57,11 +57,6 @@
 #include "dnssectool.h"
 #define KEYSTATES_NVALUES 4
 static const char *keystates[KEYSTATES_NVALUES] = {
 	"hidden", "rumoured", "omnipresent", "unretentive",
 };
 int verbose = 0;
 bool quiet = false;
 uint8_t dtype[8];
@@ -249,21 +244,6 @@ strtottl(const char *str) {
 	return (ttl);
 }
 dst_key_state_t
 strtokeystate(const char *str) {
 	if (isnone(str)) {
 		return (DST_KEY_STATE_NA);
 	}
 	for (int i = 0; i < KEYSTATES_NVALUES; i++) {
 		if (keystates[i] != NULL &&
 		    strcasecmp(str, keystates[i]) == 0) {
 			return (dst_key_state_t) i;
 		}
 	}
 	fatal("unknown key state");
 }
 isc_stdtime_t
 strtotime(const char *str, int64_t now, int64_t base,
 	  bool *setp)
@@ -334,30 +314,35 @@ dns_rdataclass_t
 strtoclass(const char *str) {
 	isc_textregion_t r;
 	dns_rdataclass_t rdclass;
-	isc_result_t result;
+	isc_result_t ret;
 	if (str == NULL)
 		return dns_rdataclass_in;
 	DE_CONST(str, r.base);
 	r.length = strlen(str);
-	result = dns_rdataclass_fromtext(&rdclass, &r);
+	ret = dns_rdataclass_fromtext(&rdclass, &r);
-	if (result != ISC_R_SUCCESS)
+	if (ret != ISC_R_SUCCESS)
 		fatal("unknown class %s", str);
 	return (rdclass);
 }
 unsigned int
-strtodsdigest(const char *str) {
+strtodsdigest(const char *algname) {
-	isc_textregion_t r;
+	if (strcasecmp(algname, "SHA1") == 0 ||
-	dns_dsdigest_t alg;
+	    strcasecmp(algname, "SHA-1") == 0)
-	isc_result_t result;
+	{
-
+		return (DNS_DSDIGEST_SHA1);
-	DE_CONST(str, r.base);
+	} else if (strcasecmp(algname, "SHA256") == 0 ||
-	r.length = strlen(str);
+		   strcasecmp(algname, "SHA-256") == 0)
-	result = dns_dsdigest_fromtext(&alg, &r);
+	{
-	if (result != ISC_R_SUCCESS)
+		return (DNS_DSDIGEST_SHA256);
-		fatal("unknown DS algorithm %s", str);
+	} else if (strcasecmp(algname, "SHA384") == 0 ||
-	return (alg);
+		   strcasecmp(algname, "SHA-384") == 0)
 	{
 		return (DNS_DSDIGEST_SHA384);
 	} else {
 		fatal("unknown algorithm %s", algname);
 	}
 }
 static int
@@ -17,11 +17,14 @@
 #include <stdbool.h>
 #include <isc/log.h>
 #include <isc/platform.h>
 #include <isc/stdtime.h>
 #include <dns/rdatastruct.h>
 #include <dst/dst.h>
 #ifndef PATH_MAX
 #define PATH_MAX 1024   /* WIN32, and others don't define this. */
 #endif
 /*! verbosity: set by -v and -q option in each program, defined in dnssectool.c */
 extern int verbose;
 extern bool quiet;
@@ -68,8 +71,6 @@ cleanup_logging(isc_log_t **logp);
 dns_ttl_t strtottl(const char *str);
 dst_key_state_t strtokeystate(const char *str);
 isc_stdtime_t
 strtotime(const char *str, int64_t now, int64_t base,
 	  bool *setp);
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <ItemGroup Label="ProjectConfigurations">
    <ProjectConfiguration Include="Debug|@PLATFORM@">
      <Configuration>Debug</Configuration>
@@ -14,21 +14,18 @@
    <ProjectGuid>{0EB1727E-2BBD-47A6-AD12-418F9DEB0531}</ProjectGuid>
    <Keyword>Win32Proj</Keyword>
    <RootNamespace>cds</RootNamespace>
    @WINDOWS_TARGET_PLATFORM_VERSION@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>true</UseDebugLibraries>
    <CharacterSet>MultiByte</CharacterSet>
    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>false</UseDebugLibraries>
    <WholeProgramOptimization>true</WholeProgramOptimization>
    <CharacterSet>MultiByte</CharacterSet>
    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
  <ImportGroup Label="ExtensionSettings">
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <ItemGroup Label="ProjectConfigurations">
    <ProjectConfiguration Include="Debug|@PLATFORM@">
      <Configuration>Debug</Configuration>
@@ -20,21 +20,18 @@
    <ProjectGuid>{2CB7DC75-023B-4AA3-AF3A-AE5046A4EE70}</ProjectGuid>
    <Keyword>Win32Proj</Keyword>
    <RootNamespace>dnssectool</RootNamespace>
    @WINDOWS_TARGET_PLATFORM_VERSION@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>StaticLibrary</ConfigurationType>
    <UseDebugLibraries>true</UseDebugLibraries>
    <CharacterSet>MultiByte</CharacterSet>
    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>StaticLibrary</ConfigurationType>
    <UseDebugLibraries>false</UseDebugLibraries>
    <WholeProgramOptimization>true</WholeProgramOptimization>
    <CharacterSet>MultiByte</CharacterSet>
    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
  <ImportGroup Label="ExtensionSettings">
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <ItemGroup Label="ProjectConfigurations">
    <ProjectConfiguration Include="Debug|@PLATFORM@">
      <Configuration>Debug</Configuration>
@@ -14,21 +14,18 @@
    <ProjectGuid>{6E6297F4-69D7-4533-85E1-BD17C30017C8}</ProjectGuid>
    <Keyword>Win32Proj</Keyword>
    <RootNamespace>dsfromkey</RootNamespace>
    @WINDOWS_TARGET_PLATFORM_VERSION@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>true</UseDebugLibraries>
    <CharacterSet>MultiByte</CharacterSet>
    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>false</UseDebugLibraries>
    <WholeProgramOptimization>true</WholeProgramOptimization>
    <CharacterSet>MultiByte</CharacterSet>
    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
  <ImportGroup Label="ExtensionSettings">
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <ItemGroup Label="ProjectConfigurations">
    <ProjectConfiguration Include="Debug|@PLATFORM@">
      <Configuration>Debug</Configuration>
@@ -14,21 +14,18 @@
    <ProjectGuid>{AB6690A0-055E-458f-BAC5-BF38BCC5834F}</ProjectGuid>
    <Keyword>Win32Proj</Keyword>
    <RootNamespace>importkey</RootNamespace>
    @WINDOWS_TARGET_PLATFORM_VERSION@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>true</UseDebugLibraries>
    <CharacterSet>MultiByte</CharacterSet>
    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>false</UseDebugLibraries>
    <WholeProgramOptimization>true</WholeProgramOptimization>
    <CharacterSet>MultiByte</CharacterSet>
    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
  <ImportGroup Label="ExtensionSettings">
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <ItemGroup Label="ProjectConfigurations">
    <ProjectConfiguration Include="Debug|@PLATFORM@">
      <Configuration>Debug</Configuration>
@@ -14,21 +14,18 @@
    <ProjectGuid>{17455DC6-5FBB-47C3-8F44-7DB574A188D3}</ProjectGuid>
    <Keyword>Win32Proj</Keyword>
    <RootNamespace>keyfromlabel</RootNamespace>
    @WINDOWS_TARGET_PLATFORM_VERSION@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>true</UseDebugLibraries>
    <CharacterSet>MultiByte</CharacterSet>
    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>false</UseDebugLibraries>
    <WholeProgramOptimization>true</WholeProgramOptimization>
    <CharacterSet>MultiByte</CharacterSet>
    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
  <ImportGroup Label="ExtensionSettings">
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <ItemGroup Label="ProjectConfigurations">
    <ProjectConfiguration Include="Debug|@PLATFORM@">
      <Configuration>Debug</Configuration>
@@ -14,21 +14,18 @@
    <ProjectGuid>{0BF11E21-168C-4CAA-B784-429D126BBAE5}</ProjectGuid>
    <Keyword>Win32Proj</Keyword>
    <RootNamespace>keygen</RootNamespace>
    @WINDOWS_TARGET_PLATFORM_VERSION@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>true</UseDebugLibraries>
    <CharacterSet>MultiByte</CharacterSet>
    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>false</UseDebugLibraries>
    <WholeProgramOptimization>true</WholeProgramOptimization>
    <CharacterSet>MultiByte</CharacterSet>
    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
  <ImportGroup Label="ExtensionSettings">
@@ -66,15 +63,15 @@
      <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
      <BrowseInformation>true</BrowseInformation>
      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
-      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\win32;..\..\..\lib\isccfg\include;..\..\..\lib\dns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
      <CompileAs>CompileAsC</CompileAs>
    </ClCompile>
    <Link>
      <SubSystem>Console</SubSystem>
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libisccfg.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
    </Link>
  </ItemDefinitionGroup>
  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -94,7 +91,7 @@
      <ObjectFileName>.\$(Configuration)\</ObjectFileName>
      <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
-      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\win32;..\..\..\lib\isccfg\include;..\..\..\lib\dns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
      <CompileAs>CompileAsC</CompileAs>
    </ClCompile>
    <Link>
@@ -104,8 +101,8 @@
      <OptimizeReferences>true</OptimizeReferences>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
-      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libisccfg.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
    </Link>
  </ItemDefinitionGroup>
  <ItemGroup>
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <ItemGroup Label="ProjectConfigurations">
    <ProjectConfiguration Include="Debug|@PLATFORM@">
      <Configuration>Debug</Configuration>
@@ -14,21 +14,18 @@
    <ProjectGuid>{D171F185-D3C2-4463-9CF3-ED1D0B1D6832}</ProjectGuid>
    <Keyword>Win32Proj</Keyword>
    <RootNamespace>revoke</RootNamespace>
    @WINDOWS_TARGET_PLATFORM_VERSION@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>true</UseDebugLibraries>
    <CharacterSet>MultiByte</CharacterSet>
    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>false</UseDebugLibraries>
    <WholeProgramOptimization>true</WholeProgramOptimization>
    <CharacterSet>MultiByte</CharacterSet>
    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
  <ImportGroup Label="ExtensionSettings">
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <ItemGroup Label="ProjectConfigurations">
    <ProjectConfiguration Include="Debug|@PLATFORM@">
      <Configuration>Debug</Configuration>
@@ -14,21 +14,18 @@
    <ProjectGuid>{03FB7588-C5A7-4572-968F-14F1206BC69C}</ProjectGuid>
    <Keyword>Win32Proj</Keyword>
    <RootNamespace>settime</RootNamespace>
    @WINDOWS_TARGET_PLATFORM_VERSION@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>true</UseDebugLibraries>
    <CharacterSet>MultiByte</CharacterSet>
    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>false</UseDebugLibraries>
    <WholeProgramOptimization>true</WholeProgramOptimization>
    <CharacterSet>MultiByte</CharacterSet>
    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
  <ImportGroup Label="ExtensionSettings">
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <ItemGroup Label="ProjectConfigurations">
    <ProjectConfiguration Include="Debug|@PLATFORM@">
      <Configuration>Debug</Configuration>
@@ -14,21 +14,18 @@
    <ProjectGuid>{205ED8A9-2E4C-41CC-9385-F3613402AA90}</ProjectGuid>
    <Keyword>Win32Proj</Keyword>
    <RootNamespace>signzone</RootNamespace>
    @WINDOWS_TARGET_PLATFORM_VERSION@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>true</UseDebugLibraries>
    <CharacterSet>MultiByte</CharacterSet>
    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>false</UseDebugLibraries>
    <WholeProgramOptimization>true</WholeProgramOptimization>
    <CharacterSet>MultiByte</CharacterSet>
    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
  <ImportGroup Label="ExtensionSettings">
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <ItemGroup Label="ProjectConfigurations">
    <ProjectConfiguration Include="Debug|@PLATFORM@">
      <Configuration>Debug</Configuration>
@@ -14,21 +14,18 @@
    <ProjectGuid>{FD653434-F1A8-44A9-85B2-A7468491DA6D}</ProjectGuid>
    <Keyword>Win32Proj</Keyword>
    <RootNamespace>verify</RootNamespace>
    @WINDOWS_TARGET_PLATFORM_VERSION@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>true</UseDebugLibraries>
    <CharacterSet>MultiByte</CharacterSet>
    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>false</UseDebugLibraries>
    <WholeProgramOptimization>true</WholeProgramOptimization>
    <CharacterSet>MultiByte</CharacterSet>
    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
  <ImportGroup Label="ExtensionSettings">
@@ -58,7 +58,6 @@ options {\n\
 "\
 #	deallocate-on-exit <obsolete>;\n\
 #	directory <none>\n\
 	dnssec-policy \"none\";\n\
 	dump-file \"named_dump.db\";\n\
 	edns-udp-size 4096;\n\
 #	fake-iquery <obsolete>;\n"
@@ -66,7 +65,7 @@ options {\n\
 "	files unlimited;\n"
 #endif
 #if defined(HAVE_GEOIP2) && !defined(WIN32)
-"	geoip-directory \"" MAXMINDDB_PREFIX "/share/GeoIP\";\n"
+"	geoip-directory \"" MAXMINDDB_PREFIX "/share/GeoIP2\";\n"
 #elif defined(HAVE_GEOIP2)
 "	geoip-directory \".\";\n"
 #endif
@@ -194,7 +193,7 @@ options {\n\
 #	sortlist <none>\n\
 	stale-answer-enable false;\n\
 	stale-answer-ttl 1; /* 1 second */\n\
-	synth-from-dnssec no;\n\
+	synth-from-dnssec yes;\n\
 #	topology <none>\n\
 	transfer-format many-answers;\n\
 	v6-bias 50;\n\
@@ -296,7 +295,7 @@ view \"_bind\" chaos {\n\
 # BEGIN DNSSEC KEYS\n"
 /* Imported from bind.keys.h: */
-TRUST_ANCHORS
+DNSSEC_KEYS
 "# END MANAGED KEYS\n\
 \n\
@@ -800,7 +799,10 @@ named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 					   dns_rootname, 0, NULL);
 		if (result != ISC_R_SUCCESS)
 			goto cleanup;
-		dns_name_dup(dns_fixedname_name(&fname), mctx, keys[i - 1]);
+		result = dns_name_dup(dns_fixedname_name(&fname), mctx,
 				      keys[i - 1]);
 		if (result != ISC_R_SUCCESS)
 			goto cleanup;
 	}
 	if (pushed != 0) {
 		pushed--;
@@ -852,9 +854,7 @@ named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 	if (stack != NULL)
 		isc_mem_put(mctx, stack, stackcount * sizeof(*stack));
 	INSIST(dscpcount == addrcount);
 	INSIST(keycount == addrcount);
 	INSIST(keycount == dscpcount);
 	ipkl->addrs = addrs;
 	ipkl->dscps = dscps;
@@ -142,7 +142,7 @@ fuzz_thread_client(void *arg) {
 		 * Read the reply message from named to unclog it. Don't
 		 * bother if there isn't a reply.
 		 */
-		(void)recvfrom(sockfd, buf, 65536, MSG_DONTWAIT, NULL, NULL);
+		recvfrom(sockfd, buf, 65536, MSG_DONTWAIT, NULL, NULL);
 		while (!ready)
 			pthread_cond_wait(&cond, &mutex);
@@ -412,8 +412,8 @@ fuzz_thread_resolver(void *arg) {
 		 * Flush any pending data on the authoritative server.
 		 */
 		socklen = sizeof(recvaddr);
-		(void)recvfrom(listenfd, rbuf, 65536, MSG_DONTWAIT,
+		sent = recvfrom(listenfd, rbuf, 65536, MSG_DONTWAIT,
-			       (struct sockaddr *) &recvaddr, &socklen);
+			(struct sockaddr *) &recvaddr, &socklen);
 		/*
 		 * Send a fixed client query to named(resolver) of
@@ -511,8 +511,7 @@ fuzz_thread_resolver(void *arg) {
 				 * to the client(query driver), so we're
 				 * done.
 				 */
-				(void)recvfrom(sockfd, buf, 65536, 0, NULL,
+				recvfrom(sockfd, buf, 65536, 0, NULL, NULL);
 					       NULL);
 				break;
 			}
@@ -113,7 +113,8 @@ named_geoip_load(char *dir) {
 #endif
 }
-void named_geoip_unload(void) {
+void
 named_geoip_shutdown(void) {
 #ifdef HAVE_GEOIP2
 	if (named_g_geoip->country != NULL) {
 		MMDB_close(named_g_geoip->country);
@@ -135,12 +136,7 @@ void named_geoip_unload(void) {
 		MMDB_close(named_g_geoip->domain);
 		named_g_geoip->domain = NULL;
 	}
 #endif
 }
 void
 named_geoip_shutdown(void) {
 #ifdef HAVE_GEOIP2
 	named_geoip_unload();
 #endif /* HAVE_GEOIP2 */
 	dns_geoip_shutdown();
 }
@@ -19,8 +19,5 @@ named_geoip_init(void);
 void
 named_geoip_load(char *dir);
 void
 named_geoip_unload(void);
 void
 named_geoip_shutdown(void);
@@ -19,7 +19,6 @@
 #include <isc/rwlock.h>
 #include <isc/log.h>
 #include <isc/net.h>
 #include <isc/netmgr.h>
 #include <isccfg/aclconf.h>
 #include <isccfg/cfg.h>
@@ -63,7 +62,6 @@ EXTERN bool		named_g_run_done	INIT(false);
 */
 EXTERN isc_timermgr_t *		named_g_timermgr	INIT(NULL);
 EXTERN isc_socketmgr_t *	named_g_socketmgr	INIT(NULL);
 EXTERN isc_nm_t *		named_g_nm		INIT(NULL);
 EXTERN cfg_parser_t *		named_g_parser		INIT(NULL);
 EXTERN cfg_parser_t *		named_g_addparser	INIT(NULL);
 EXTERN const char *		named_g_version		INIT(VERSION);
@@ -137,6 +135,14 @@ EXTERN const char *		named_g_defaultpidfile 	INIT(NAMED_LOCALSTATEDIR
 							     "/run/named.pid");
 #endif
 #ifdef HAVE_DNSTAP
 EXTERN const char *		named_g_defaultdnstap
 					INIT(NAMED_LOCALSTATEDIR "/run/named/"
 							      "dnstap.sock");
 #else
 EXTERN const char *		named_g_defaultdnstap	INIT(NULL);
 #endif /* HAVE_DNSTAP */
 EXTERN const char *		named_g_username	INIT(NULL);
 EXTERN const char *		named_g_engine		INIT(NULL);
@@ -64,7 +64,6 @@ struct named_server {
 	dns_loadmgr_t *		loadmgr;
 	dns_zonemgr_t *		zonemgr;
 	dns_viewlist_t		viewlist;
 	dns_kasplist_t		kasplist;
 	ns_interfacemgr_t *	interfacemgr;
 	dns_db_t *		in_roothints;
@@ -27,18 +27,19 @@ ISC_LANG_BEGINDECLS
 isc_result_t
 named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		     const cfg_obj_t *zconfig, cfg_aclconfctx_t *ac,
-		     dns_kasplist_t* kasplist, dns_zone_t *zone,
+		     dns_zone_t *zone, dns_zone_t *raw);
 		     dns_zone_t *raw);
 /*%<
 * Configure or reconfigure a zone according to the named.conf
- * data.
+ * data in 'cctx' and 'czone'.
 *
 * The zone origin is not configured, it is assumed to have been set
 * at zone creation time.
 *
 * Require:
 * \li	'lctx' to be initialized or NULL.
 * \li	'cctx' to be initialized or NULL.
 * \li	'ac' to point to an initialized cfg_aclconfctx_t.
- * \li	'kasplist' to be initialized.
+ * \li	'czone' to be initialized.
 * \li	'zone' to be initialized.
 */
@@ -24,7 +24,6 @@
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/httpd.h>
 #include <isc/netmgr.h>
 #include <isc/os.h>
 #include <isc/platform.h>
 #include <isc/print.h>
@@ -59,10 +58,6 @@
 #include <json_c_version.h>
 #endif /* HAVE_JSON_C */
 #ifdef HAVE_GEOIP2
 #include <maxminddb.h>
 #endif
 /*
 * Defining NAMED_MAIN provides storage declarations (rather than extern)
 * for variables in named/globals.h.
@@ -72,7 +67,6 @@
 #include <ns/interfacemgr.h>
 #include <named/builtin.h>
 #include <named/config.h>
 #include <named/control.h>
 #include <named/fuzz.h>
 #include <named/globals.h>	/* Explicit, though named/log.h includes it. */
@@ -120,7 +114,7 @@ LIBDNS_EXTERNAL_DATA extern unsigned int dns_zone_mkey_month;
 static bool	want_stats = false;
 static char		program_name[NAME_MAX] = "named";
 static char		absolute_conffile[PATH_MAX];
-static char		saved_command_line[4096] = { 0 };
+static char		saved_command_line[8192] =  { 0 };
 static char		ellipsis[5] = { 0 };
 static char		version[512];
 static unsigned int	maxsocks = 0;
@@ -129,6 +123,7 @@ static int		maxudp = 0;
 /*
 * -T options:
 */
 static bool clienttest = false;
 static bool dropedns = false;
 static bool ednsformerr = false;
 static bool ednsnotimp = false;
@@ -357,7 +352,7 @@ save_command_line(int argc, char *argv[]) {
 		*dst++ = ' ';
 		while (*src != '\0' && dst < eob) {
-			if (isalnum(*src) || *src == ',' ||
+			if (isalnum(*src) ||
 			    *src == '-' || *src == '_' ||
 			    *src == '.' || *src == '/')
 			{
@@ -488,12 +483,6 @@ set_flags(const char *arg, struct flag_def *defs, unsigned int *ret) {
 static void
 printversion(bool verbose) {
 	char rndcconf[PATH_MAX], *dot = NULL;
 #if defined(HAVE_GEOIP2)
 	isc_mem_t *mctx = NULL;
 	cfg_parser_t *parser = NULL;
 	cfg_obj_t *config = NULL;
 	const cfg_obj_t *defaults = NULL, *obj = NULL;
 #endif
 	printf("%s %s%s%s <id:%s>\n",
 	       named_g_product, named_g_version,
@@ -552,17 +541,6 @@ OPENSSL_VERSION_NUMBER >= 0x10100000L /* 1.1.0 or higher */
 	       ZLIB_VERSION);
 	printf("linked to zlib version: %s\n",
 	       zlibVersion());
 #endif
 #if defined(HAVE_GEOIP2)
 	/* Unfortunately, no version define on link time */
 	printf("linked to maxminddb version: %s\n",
 	       MMDB_lib_version());
 #endif
 #if defined(HAVE_DNSTAP)
 	printf("compiled with protobuf-c version: %s\n",
 	       PROTOBUF_C_VERSION);
 	printf("linked to protobuf-c version: %s\n",
 	       protobuf_c_version());
 #endif
 	printf("threads support is enabled\n\n");
@@ -591,20 +569,7 @@ OPENSSL_VERSION_NUMBER >= 0x10100000L /* 1.1.0 or higher */
 	printf("  nsupdate session key: %s\n", named_g_defaultsessionkeyfile);
 	printf("  named PID file:       %s\n", named_g_defaultpidfile);
 	printf("  named lock file:      %s\n", named_g_defaultlockfile);
-#if defined(HAVE_GEOIP2)
+
 #define RTC(x) RUNTIME_CHECK((x) == ISC_R_SUCCESS)
 	isc_mem_create(&mctx);
 	RTC(cfg_parser_create(mctx, named_g_lctx, &parser));
 	RTC(named_config_parsedefaults(parser, &config));
 	RTC(cfg_map_get(config, "options", &defaults));
 	RTC(cfg_map_get(defaults, "geoip-directory", &obj));
 	if (cfg_obj_isstring(obj)) {
 		printf("  geoip-directory:      %s\n", cfg_obj_asstring(obj));
 	}
 	cfg_obj_destroy(parser, &config);
 	cfg_parser_destroy(&parser);
 	isc_mem_detach(&mctx);
 #endif /* HAVE_GEOIP2 */
 }
 static void
@@ -637,12 +602,17 @@ parse_T_opt(char *option) {
 	/*
 	 * force the server to behave (or misbehave) in
 	 * specified ways for testing purposes.
 	 *
 	 * clienttest: make clients single shot with their
 	 * 	       own memory context.
 	 * delay=xxxx: delay client responses by xxxx ms to
 	 *	       simulate remote servers.
 	 * dscp=x:     check that dscp values are as
 	 * 	       expected and assert otherwise.
 	 */
-	if (!strncmp(option, "delay=", 6)) {
+	if (!strcmp(option, "clienttest")) {
 		clienttest = true;
 	} else if (!strncmp(option, "delay=", 6)) {
 		delay = atoi(option + 6);
 	} else if (!strcmp(option, "dropedns")) {
 		dropedns = true;
@@ -676,9 +646,6 @@ parse_T_opt(char *option) {
 		maxudp = 1460;
 	} else if (!strncmp(option, "maxudp=", 7)) {
 		maxudp = atoi(option + 7);
 		if (maxudp <= 0) {
 			named_main_earlyfatal("bad maxudp");
 		}
 	} else if (!strncmp(option, "mkeytimers=", 11)) {
 		p = strtok_r(option + 11, "/", &last);
 		if (p == NULL) {
@@ -907,15 +874,8 @@ create_managers(void) {
 		      "using %u UDP listener%s per interface",
 		      named_g_udpdisp, named_g_udpdisp == 1 ? "" : "s");
 	named_g_nm = isc_nm_start(named_g_mctx, named_g_cpus);
 	if (named_g_nm == NULL) {
 		UNEXPECTED_ERROR(__FILE__, __LINE__,
 				"isc_nm_start() failed");
 		return (ISC_R_UNEXPECTED);
 	}
 	result = isc_taskmgr_create(named_g_mctx, named_g_cpus, 0,
-				    named_g_nm, &named_g_taskmgr);
+				    &named_g_taskmgr);
 	if (result != ISC_R_SUCCESS) {
 		UNEXPECTED_ERROR(__FILE__, __LINE__,
 				 "isc_taskmgr_create() failed: %s",
@@ -940,7 +900,6 @@ create_managers(void) {
 		return (ISC_R_UNEXPECTED);
 	}
 	isc_socketmgr_maxudp(named_g_socketmgr, maxudp);
 	isc_nm_maxudp(named_g_nm, maxudp);
 	result = isc_socketmgr_getmaxsockets(named_g_socketmgr, &socks);
 	if (result == ISC_R_SUCCESS) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
@@ -954,24 +913,11 @@ create_managers(void) {
 static void
 destroy_managers(void) {
 	/*
-	 * isc_nm_closedown() closes all active connections, freeing
+	 * isc_taskmgr_destroy() will block until all tasks have exited,
 	 * attached clients and other resources and preventing new
 	 * connections from being established, but it not does not
 	 * stop all processing or destroy the netmgr yet.
 	 */
 	isc_nm_closedown(named_g_nm);
 	/*
 	 * isc_taskmgr_destroy() will block until all tasks have exited.
 	 */
 	isc_taskmgr_destroy(&named_g_taskmgr);
 	isc_timermgr_destroy(&named_g_timermgr);
 	isc_socketmgr_destroy(&named_g_socketmgr);
 	/*
 	 * At this point is safe to destroy the netmgr.
 	 */
 	isc_nm_destroy(&named_g_nm);
 }
 static void
@@ -1285,6 +1231,8 @@ setup(void) {
 	/*
 	 * Modify server context according to command line options
 	 */
 	if (clienttest)
 		ns_server_setoption(sctx, NS_SERVER_CLIENTTEST, true);
 	if (disable4)
 		ns_server_setoption(sctx, NS_SERVER_DISABLE4, true);
 	if (disable6)
@@ -1344,6 +1292,8 @@ cleanup(void) {
 	dlz_dlopen_clear();
 #endif
 	dns_name_destroy();
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_MAIN,
 		      ISC_LOG_NOTICE, "exiting");
@@ -1445,21 +1395,6 @@ main(int argc, char *argv[]) {
 	(void) ProfilerStart(NULL);
 #endif
 #ifdef WIN32
 	/*
 	 * Prevent unbuffered I/O from crippling named performance on Windows
 	 * when it is logging to stderr (e.g. in system tests).  Use full
 	 * buffering (_IOFBF) as line buffering (_IOLBF) is unavailable on
 	 * Windows and fflush() is called anyway after each log message gets
 	 * written to the default stderr logging channels created by libisc.
 	*/
 	setvbuf(stderr, NULL, _IOFBF, BUFSIZ);
 #endif
 #ifdef HAVE_LIBXML2
 	xmlInitThreads();
 #endif /* HAVE_LIBXML2 */
 	/*
 	 * Record version in core image.
 	 * strings named.core | grep "named version:"
@@ -1524,7 +1459,10 @@ main(int argc, char *argv[]) {
 						named_g_chrootdir);
 	}
-	isc_mem_create(&named_g_mctx);
+	result = isc_mem_create(0, 0, &named_g_mctx);
 	if (result != ISC_R_SUCCESS)
 		named_main_earlyfatal("isc_mem_create() failed: %s",
 				   isc_result_totext(result));
 	isc_mem_setname(named_g_mctx, "main", NULL);
 	setup();
@@ -1592,10 +1530,6 @@ main(int argc, char *argv[]) {
 	named_os_shutdown();
 #ifdef HAVE_LIBXML2
 	xmlCleanupThreads();
 #endif /* HAVE_LIBXML2 */
 #ifdef HAVE_GPERFTOOLS_PROFILER
 	ProfilerStop();
 #endif
@@ -10,12 +10,12 @@
 .\"     Title: named.conf
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
-.\"      Date: 2019-08-12
+.\"      Date: 2019-08-07
 .\"    Manual: BIND9
 .\"    Source: ISC
 .\"  Language: English
 .\"
-.TH "NAMED\&.CONF" "5" "2019\-08\-12" "ISC" "BIND9"
+.TH "NAMED\&.CONF" "5" "2019\-08\-07" "ISC" "BIND9"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -97,6 +97,19 @@ dlz \fIstring\fR {
 .if n \{\
 .RE
 .\}
 .SH "DNSSEC-KEYS"
 .sp
 .if n \{\
 .RS 4
 .\}
 .nf
 dnssec\-keys { \fIstring\fR ( static\-key |
    initial\-key ) \fIinteger\fR \fIinteger\fR \fIinteger\fR
    \fIquoted_string\fR; \&.\&.\&. };
 .fi
 .if n \{\
 .RE
 .\}
 .SH "DYNDB"
 .sp
 .if n \{\
@@ -150,16 +163,16 @@ logging {
 .\}
 .SH "MANAGED-KEYS"
 .PP
-Deprecated \- see TRUST\-ANCHORS\&.
+Deprecated \- see DNSSEC\-KEYS\&.
 .sp
 .if n \{\
 .RS 4
 .\}
 .nf
 managed\-keys { \fIstring\fR ( static\-key
-    | initial\-key | static\-ds |
+    | initial\-key ) \fIinteger\fR
-    initial\-ds ) \fIinteger\fR \fIinteger\fR
+    \fIinteger\fR \fIinteger\fR
-    \fIinteger\fR \fIquoted_string\fR; \&.\&.\&. }; deprecated
+    \fIquoted_string\fR; \&.\&.\&. }; deprecated
 .fi
 .if n \{\
 .RE
@@ -217,7 +230,7 @@ options {
 	    [ dscp \fIinteger\fR ] { ( \fImasters\fR | \fIipv4_address\fR [ port
 	    \fIinteger\fR ] | \fIipv6_address\fR [ port \fIinteger\fR ] ) [ key
 	    \fIstring\fR ]; \&.\&.\&. } ] [ zone\-directory \fIquoted_string\fR ] [
-	    in\-memory \fIboolean\fR ] [ min\-update\-interval \fIduration\fR ]; \&.\&.\&. };
+	    in\-memory \fIboolean\fR ] [ min\-update\-interval \fIttlval\fR ]; \&.\&.\&. };
 	check\-dup\-records ( fail | warn | ignore );
 	check\-integrity \fIboolean\fR;
 	check\-mx ( fail | warn | ignore );
@@ -299,18 +312,18 @@ options {
 	fstrm\-set\-output\-notify\-threshold \fIinteger\fR;
 	fstrm\-set\-output\-queue\-model ( mpsc | spsc );
 	fstrm\-set\-output\-queue\-size \fIinteger\fR;
-	fstrm\-set\-reopen\-interval \fIduration\fR;
+	fstrm\-set\-reopen\-interval \fIttlval\fR;
 	geoip\-directory ( \fIquoted_string\fR | none );
 	glue\-cache \fIboolean\fR;
 	heartbeat\-interval \fIinteger\fR;
 	hostname ( \fIquoted_string\fR | none );
 	inline\-signing \fIboolean\fR;
-	interface\-interval \fIduration\fR;
+	interface\-interval \fIttlval\fR;
 	ixfr\-from\-differences ( primary | master | secondary | slave |
 	    \fIboolean\fR );
 	keep\-response\-order { \fIaddress_match_element\fR; \&.\&.\&. };
 	key\-directory \fIquoted_string\fR;
-	lame\-ttl \fIduration\fR;
+	lame\-ttl \fIttlval\fR;
 	listen\-on [ port \fIinteger\fR ] [ dscp
 	    \fIinteger\fR ] {
 	    \fIaddress_match_element\fR; \&.\&.\&. };
@@ -324,28 +337,28 @@ options {
 	masterfile\-style ( full | relative );
 	match\-mapped\-addresses \fIboolean\fR;
 	max\-cache\-size ( default | unlimited | \fIsizeval\fR | \fIpercentage\fR );
-	max\-cache\-ttl \fIduration\fR;
+	max\-cache\-ttl \fIttlval\fR;
 	max\-clients\-per\-query \fIinteger\fR;
 	max\-journal\-size ( default | unlimited | \fIsizeval\fR );
-	max\-ncache\-ttl \fIduration\fR;
+	max\-ncache\-ttl \fIttlval\fR;
 	max\-records \fIinteger\fR;
 	max\-recursion\-depth \fIinteger\fR;
 	max\-recursion\-queries \fIinteger\fR;
 	max\-refresh\-time \fIinteger\fR;
 	max\-retry\-time \fIinteger\fR;
 	max\-rsa\-exponent\-size \fIinteger\fR;
-	max\-stale\-ttl \fIduration\fR;
+	max\-stale\-ttl \fIttlval\fR;
 	max\-transfer\-idle\-in \fIinteger\fR;
 	max\-transfer\-idle\-out \fIinteger\fR;
 	max\-transfer\-time\-in \fIinteger\fR;
 	max\-transfer\-time\-out \fIinteger\fR;
 	max\-udp\-size \fIinteger\fR;
-	max\-zone\-ttl ( unlimited | \fIduration\fR );
+	max\-zone\-ttl ( unlimited | \fIttlval\fR );
 	memstatistics \fIboolean\fR;
 	memstatistics\-file \fIquoted_string\fR;
 	message\-compression \fIboolean\fR;
-	min\-cache\-ttl \fIduration\fR;
+	min\-cache\-ttl \fIttlval\fR;
-	min\-ncache\-ttl \fIduration\fR;
+	min\-ncache\-ttl \fIttlval\fR;
 	min\-refresh\-time \fIinteger\fR;
 	min\-retry\-time \fIinteger\fR;
 	minimal\-any \fIboolean\fR;
@@ -362,8 +375,8 @@ options {
 	notify\-source\-v6 ( \fIipv6_address\fR | * ) [ port ( \fIinteger\fR | * ) ]
 	    [ dscp \fIinteger\fR ];
 	notify\-to\-soa \fIboolean\fR;
-	nta\-lifetime \fIduration\fR;
+	nta\-lifetime \fIttlval\fR;
-	nta\-recheck \fIduration\fR;
+	nta\-recheck \fIttlval\fR;
 	nxdomain\-redirect \fIstring\fR;
 	pid\-file ( \fIquoted_string\fR | none );
 	port \fIinteger\fR;
@@ -410,13 +423,13 @@ options {
 	response\-padding { \fIaddress_match_element\fR; \&.\&.\&. } block\-size
 	    \fIinteger\fR;
 	response\-policy { zone \fIstring\fR [ add\-soa \fIboolean\fR ] [ log
-	    \fIboolean\fR ] [ max\-policy\-ttl \fIduration\fR ] [ min\-update\-interval
+	    \fIboolean\fR ] [ max\-policy\-ttl \fIttlval\fR ] [ min\-update\-interval
-	    \fIduration\fR ] [ policy ( cname | disabled | drop | given | no\-op |
+	    \fIttlval\fR ] [ policy ( cname | disabled | drop | given | no\-op |
 	    nodata | nxdomain | passthru | tcp\-only \fIquoted_string\fR ) ] [
 	    recursive\-only \fIboolean\fR ] [ nsip\-enable \fIboolean\fR ] [
 	    nsdname\-enable \fIboolean\fR ]; \&.\&.\&. } [ add\-soa \fIboolean\fR ] [
-	    break\-dnssec \fIboolean\fR ] [ max\-policy\-ttl \fIduration\fR ] [
+	    break\-dnssec \fIboolean\fR ] [ max\-policy\-ttl \fIttlval\fR ] [
-	    min\-update\-interval \fIduration\fR ] [ min\-ns\-dots \fIinteger\fR ] [
+	    min\-update\-interval \fIttlval\fR ] [ min\-ns\-dots \fIinteger\fR ] [
 	    nsip\-wait\-recurse \fIboolean\fR ] [ qname\-wait\-recurse \fIboolean\fR ]
 	    [ recursive\-only \fIboolean\fR ] [ nsip\-enable \fIboolean\fR ] [
 	    nsdname\-enable \fIboolean\fR ] [ dnsrps\-enable \fIboolean\fR ] [
@@ -430,7 +443,7 @@ options {
 	serial\-query\-rate \fIinteger\fR;
 	serial\-update\-method ( date | increment | unixtime );
 	server\-id ( \fIquoted_string\fR | none | hostname );
-	servfail\-ttl \fIduration\fR;
+	servfail\-ttl \fIttlval\fR;
 	session\-keyalg \fIstring\fR;
 	session\-keyfile ( \fIquoted_string\fR | none );
 	session\-keyname \fIstring\fR;
@@ -441,7 +454,7 @@ options {
 	sortlist { \fIaddress_match_element\fR; \&.\&.\&. };
 	stacksize ( default | unlimited | \fIsizeval\fR );
 	stale\-answer\-enable \fIboolean\fR;
-	stale\-answer\-ttl \fIduration\fR;
+	stale\-answer\-ttl \fIttlval\fR;
 	startup\-notify\-rate \fIinteger\fR;
 	statistics\-file \fIquoted_string\fR;
 	synth\-from\-dnssec \fIboolean\fR;
@@ -551,23 +564,9 @@ statistics\-channels {
 .if n \{\
 .RE
 .\}
 .SH "TRUST-ANCHORS"
 .sp
 .if n \{\
 .RS 4
 .\}
 .nf
 trust\-anchors { \fIstring\fR ( static\-key |
    initial\-key | static\-ds | initial\-ds )
    \fIinteger\fR \fIinteger\fR \fIinteger\fR
    \fIquoted_string\fR; \&.\&.\&. };
 .fi
 .if n \{\
 .RE
 .\}
 .SH "TRUSTED-KEYS"
 .PP
-Deprecated \- see TRUST\-ANCHORS\&.
+Deprecated \- see DNSSEC\-KEYS\&.
 .sp
 .if n \{\
 .RS 4
@@ -613,7 +612,7 @@ view \fIstring\fR [ \fIclass\fR ] {
 	    [ dscp \fIinteger\fR ] { ( \fImasters\fR | \fIipv4_address\fR [ port
 	    \fIinteger\fR ] | \fIipv6_address\fR [ port \fIinteger\fR ] ) [ key
 	    \fIstring\fR ]; \&.\&.\&. } ] [ zone\-directory \fIquoted_string\fR ] [
-	    in\-memory \fIboolean\fR ] [ min\-update\-interval \fIduration\fR ]; \&.\&.\&. };
+	    in\-memory \fIboolean\fR ] [ min\-update\-interval \fIttlval\fR ]; \&.\&.\&. };
 	check\-dup\-records ( fail | warn | ignore );
 	check\-integrity \fIboolean\fR;
 	check\-mx ( fail | warn | ignore );
@@ -655,6 +654,9 @@ view \fIstring\fR [ \fIclass\fR ] {
 	dnsrps\-options { \fIunspecified\-text\fR };
 	dnssec\-accept\-expired \fIboolean\fR;
 	dnssec\-dnskey\-kskonly \fIboolean\fR;
 	dnssec\-keys { \fIstring\fR ( static\-key |
 	    initial\-key ) \fIinteger\fR \fIinteger\fR
 	    \fIinteger\fR \fIquoted_string\fR; \&.\&.\&. };
 	dnssec\-loadkeys\-interval \fIinteger\fR;
 	dnssec\-must\-be\-secure \fIstring\fR \fIboolean\fR;
 	dnssec\-secure\-to\-insecure \fIboolean\fR;
@@ -688,11 +690,10 @@ view \fIstring\fR [ \fIclass\fR ] {
 		secret \fIstring\fR;
 	};
 	key\-directory \fIquoted_string\fR;
-	lame\-ttl \fIduration\fR;
+	lame\-ttl \fIttlval\fR;
 	lmdb\-mapsize \fIsizeval\fR;
 	managed\-keys { \fIstring\fR (
 	    static\-key | initial\-key
 	    | static\-ds | initial\-ds
 	    ) \fIinteger\fR \fIinteger\fR
 	    \fIinteger\fR
 	    \fIquoted_string\fR; \&.\&.\&. }; deprecated
@@ -702,25 +703,25 @@ view \fIstring\fR [ \fIclass\fR ] {
 	match\-destinations { \fIaddress_match_element\fR; \&.\&.\&. };
 	match\-recursive\-only \fIboolean\fR;
 	max\-cache\-size ( default | unlimited | \fIsizeval\fR | \fIpercentage\fR );
-	max\-cache\-ttl \fIduration\fR;
+	max\-cache\-ttl \fIttlval\fR;
 	max\-clients\-per\-query \fIinteger\fR;
 	max\-journal\-size ( default | unlimited | \fIsizeval\fR );
-	max\-ncache\-ttl \fIduration\fR;
+	max\-ncache\-ttl \fIttlval\fR;
 	max\-records \fIinteger\fR;
 	max\-recursion\-depth \fIinteger\fR;
 	max\-recursion\-queries \fIinteger\fR;
 	max\-refresh\-time \fIinteger\fR;
 	max\-retry\-time \fIinteger\fR;
-	max\-stale\-ttl \fIduration\fR;
+	max\-stale\-ttl \fIttlval\fR;
 	max\-transfer\-idle\-in \fIinteger\fR;
 	max\-transfer\-idle\-out \fIinteger\fR;
 	max\-transfer\-time\-in \fIinteger\fR;
 	max\-transfer\-time\-out \fIinteger\fR;
 	max\-udp\-size \fIinteger\fR;
-	max\-zone\-ttl ( unlimited | \fIduration\fR );
+	max\-zone\-ttl ( unlimited | \fIttlval\fR );
 	message\-compression \fIboolean\fR;
-	min\-cache\-ttl \fIduration\fR;
+	min\-cache\-ttl \fIttlval\fR;
-	min\-ncache\-ttl \fIduration\fR;
+	min\-ncache\-ttl \fIttlval\fR;
 	min\-refresh\-time \fIinteger\fR;
 	min\-retry\-time \fIinteger\fR;
 	minimal\-any \fIboolean\fR;
@@ -736,8 +737,8 @@ view \fIstring\fR [ \fIclass\fR ] {
 	notify\-source\-v6 ( \fIipv6_address\fR | * ) [ port ( \fIinteger\fR | * ) ]
 	    [ dscp \fIinteger\fR ];
 	notify\-to\-soa \fIboolean\fR;
-	nta\-lifetime \fIduration\fR;
+	nta\-lifetime \fIttlval\fR;
-	nta\-recheck \fIduration\fR;
+	nta\-recheck \fIttlval\fR;
 	nxdomain\-redirect \fIstring\fR;
 	plugin ( query ) \fIstring\fR [ {
 	    \fIunspecified\-text\fR } ];
@@ -779,13 +780,13 @@ view \fIstring\fR [ \fIclass\fR ] {
 	response\-padding { \fIaddress_match_element\fR; \&.\&.\&. } block\-size
 	    \fIinteger\fR;
 	response\-policy { zone \fIstring\fR [ add\-soa \fIboolean\fR ] [ log
-	    \fIboolean\fR ] [ max\-policy\-ttl \fIduration\fR ] [ min\-update\-interval
+	    \fIboolean\fR ] [ max\-policy\-ttl \fIttlval\fR ] [ min\-update\-interval
-	    \fIduration\fR ] [ policy ( cname | disabled | drop | given | no\-op |
+	    \fIttlval\fR ] [ policy ( cname | disabled | drop | given | no\-op |
 	    nodata | nxdomain | passthru | tcp\-only \fIquoted_string\fR ) ] [
 	    recursive\-only \fIboolean\fR ] [ nsip\-enable \fIboolean\fR ] [
 	    nsdname\-enable \fIboolean\fR ]; \&.\&.\&. } [ add\-soa \fIboolean\fR ] [
-	    break\-dnssec \fIboolean\fR ] [ max\-policy\-ttl \fIduration\fR ] [
+	    break\-dnssec \fIboolean\fR ] [ max\-policy\-ttl \fIttlval\fR ] [
-	    min\-update\-interval \fIduration\fR ] [ min\-ns\-dots \fIinteger\fR ] [
+	    min\-update\-interval \fIttlval\fR ] [ min\-ns\-dots \fIinteger\fR ] [
 	    nsip\-wait\-recurse \fIboolean\fR ] [ qname\-wait\-recurse \fIboolean\fR ]
 	    [ recursive\-only \fIboolean\fR ] [ nsip\-enable \fIboolean\fR ] [
 	    nsdname\-enable \fIboolean\fR ] [ dnsrps\-enable \fIboolean\fR ] [
@@ -830,14 +831,14 @@ view \fIstring\fR [ \fIclass\fR ] {
 		    \fIinteger\fR | * ) ] [ dscp \fIinteger\fR ];
 		transfers \fIinteger\fR;
 	};
-	servfail\-ttl \fIduration\fR;
+	servfail\-ttl \fIttlval\fR;
 	sig\-signing\-nodes \fIinteger\fR;
 	sig\-signing\-signatures \fIinteger\fR;
 	sig\-signing\-type \fIinteger\fR;
 	sig\-validity\-interval \fIinteger\fR [ \fIinteger\fR ];
 	sortlist { \fIaddress_match_element\fR; \&.\&.\&. };
 	stale\-answer\-enable \fIboolean\fR;
-	stale\-answer\-ttl \fIduration\fR;
+	stale\-answer\-ttl \fIttlval\fR;
 	synth\-from\-dnssec \fIboolean\fR;
 	transfer\-format ( many\-answers | one\-answer );
 	transfer\-source ( \fIipv4_address\fR | * ) [ port ( \fIinteger\fR | * ) ] [
@@ -845,10 +846,6 @@ view \fIstring\fR [ \fIclass\fR ] {
 	transfer\-source\-v6 ( \fIipv6_address\fR | * ) [ port ( \fIinteger\fR | * )
 	    ] [ dscp \fIinteger\fR ];
 	trust\-anchor\-telemetry \fIboolean\fR; // experimental
 	trust\-anchors { \fIstring\fR ( static\-key |
 	    initial\-key | static\-ds | initial\-ds
 	    ) \fIinteger\fR \fIinteger\fR \fIinteger\fR
 	    \fIquoted_string\fR; \&.\&.\&. };
 	trusted\-keys { \fIstring\fR
 	    \fIinteger\fR \fIinteger\fR
 	    \fIinteger\fR
@@ -893,7 +890,6 @@ view \fIstring\fR [ \fIclass\fR ] {
 		dnskey\-sig\-validity \fIinteger\fR;
 		dnssec\-dnskey\-kskonly \fIboolean\fR;
 		dnssec\-loadkeys\-interval \fIinteger\fR;
 		dnssec\-policy \fIstring\fR;
 		dnssec\-secure\-to\-insecure \fIboolean\fR;
 		dnssec\-update\-mode ( maintain | no\-resign );
 		file \fIquoted_string\fR;
@@ -919,7 +915,7 @@ view \fIstring\fR [ \fIclass\fR ] {
 		max\-transfer\-idle\-out \fIinteger\fR;
 		max\-transfer\-time\-in \fIinteger\fR;
 		max\-transfer\-time\-out \fIinteger\fR;
-		max\-zone\-ttl ( unlimited | \fIduration\fR );
+		max\-zone\-ttl ( unlimited | \fIttlval\fR );
 		min\-refresh\-time \fIinteger\fR;
 		min\-retry\-time \fIinteger\fR;
 		multi\-master \fIboolean\fR;
@@ -1000,7 +996,6 @@ zone \fIstring\fR [ \fIclass\fR ] {
 	dnskey\-sig\-validity \fIinteger\fR;
 	dnssec\-dnskey\-kskonly \fIboolean\fR;
 	dnssec\-loadkeys\-interval \fIinteger\fR;
 	dnssec\-policy \fIstring\fR;
 	dnssec\-secure\-to\-insecure \fIboolean\fR;
 	dnssec\-update\-mode ( maintain | no\-resign );
 	file \fIquoted_string\fR;
@@ -1025,7 +1020,7 @@ zone \fIstring\fR [ \fIclass\fR ] {
 	max\-transfer\-idle\-out \fIinteger\fR;
 	max\-transfer\-time\-in \fIinteger\fR;
 	max\-transfer\-time\-out \fIinteger\fR;
-	max\-zone\-ttl ( unlimited | \fIduration\fR );
+	max\-zone\-ttl ( unlimited | \fIttlval\fR );
 	min\-refresh\-time \fIinteger\fR;
 	min\-retry\-time \fIinteger\fR;
 	multi\-master \fIboolean\fR;
@@ -1067,30 +1062,6 @@ zone \fIstring\fR [ \fIclass\fR ] {
 .if n \{\
 .RE
 .\}
 .SH "DNSSEC-POLICY"
 .sp
 .if n \{\
 .RS 4
 .\}
 .nf
 dnssec\-policy \fIstring\fR {
 	dnskey\-ttl \fIduration\fR;
 	keys { ( csk | ksk | zsk ) key\-directory lifetime \fIduration\fR algorithm \fIinteger\fR [ \fIinteger\fR ] ; \&.\&.\&. };
 	parent\-ds\-ttl \fIduration\fR;
 	parent\-propagation\-delay \fIduration\fR;
 	parent\-registration\-delay \fIduration\fR;
 	publish\-safety \fIduration\fR;
 	retire\-safety \fIduration\fR;
 	signatures\-refresh \fIduration\fR;
 	signatures\-validity \fIduration\fR;
 	signatures\-validity\-dnskey \fIduration\fR;
 	zone\-max\-ttl \fIduration\fR;
 	zone\-propagation\-delay \fIduration\fR;
 };
 .fi
 .if n \{\
 .RE
 .\}
 .SH "FILES"
 .PP
 /etc/named\&.conf
@@ -13,7 +13,7 @@
 <refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.named.conf">
  <info>
-    <date>2019-08-12</date>
+    <date>2019-08-07</date>
  </info>
  <refentryinfo>
    <corpname>ISC</corpname>
@@ -49,7 +49,6 @@
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -111,6 +110,14 @@ dlz <replaceable>string</replaceable> {
 </literallayout>
  </refsection>
  <refsection><info><title>DNSSEC-KEYS</title></info>
    <literallayout class="normal">
 dnssec-keys { <replaceable>string</replaceable> ( static-key |
    initial-key ) <replaceable>integer</replaceable> <replaceable>integer</replaceable> <replaceable>integer</replaceable>
    <replaceable>quoted_string</replaceable>; ... };
 </literallayout>
  </refsection>
  <refsection><info><title>DYNDB</title></info>
    <literallayout class="normal">
 dyndb <replaceable>string</replaceable> <replaceable>quoted_string</replaceable> {
@@ -148,12 +155,12 @@ logging {
  </refsection>
  <refsection><info><title>MANAGED-KEYS</title></info>
-  <para>Deprecated - see TRUST-ANCHORS.</para>
+  <para>Deprecated - see DNSSEC-KEYS.</para>
    <literallayout class="normal">
 managed-keys { <replaceable>string</replaceable> ( static-key
-    | initial-key | static-ds |
+    | initial-key ) <replaceable>integer</replaceable>
-    initial-ds ) <replaceable>integer</replaceable> <replaceable>integer</replaceable>
+    <replaceable>integer</replaceable> <replaceable>integer</replaceable>
-    <replaceable>integer</replaceable> <replaceable>quoted_string</replaceable>; ... }; deprecated
+    <replaceable>quoted_string</replaceable>; ... }; deprecated
 </literallayout>
  </refsection>
@@ -201,7 +208,7 @@ options {
 	    [ dscp <replaceable>integer</replaceable> ] { ( <replaceable>masters</replaceable> | <replaceable>ipv4_address</replaceable> [ port
 	    <replaceable>integer</replaceable> ] | <replaceable>ipv6_address</replaceable> [ port <replaceable>integer</replaceable> ] ) [ key
 	    <replaceable>string</replaceable> ]; ... } ] [ zone-directory <replaceable>quoted_string</replaceable> ] [
-	    in-memory <replaceable>boolean</replaceable> ] [ min-update-interval <replaceable>duration</replaceable> ]; ... };
+	    in-memory <replaceable>boolean</replaceable> ] [ min-update-interval <replaceable>ttlval</replaceable> ]; ... };
 	check-dup-records ( fail | warn | ignore );
 	check-integrity <replaceable>boolean</replaceable>;
 	check-mx ( fail | warn | ignore );
@@ -283,18 +290,18 @@ options {
 	fstrm-set-output-notify-threshold <replaceable>integer</replaceable>;
 	fstrm-set-output-queue-model ( mpsc | spsc );
 	fstrm-set-output-queue-size <replaceable>integer</replaceable>;
-	fstrm-set-reopen-interval <replaceable>duration</replaceable>;
+	fstrm-set-reopen-interval <replaceable>ttlval</replaceable>;
 	geoip-directory ( <replaceable>quoted_string</replaceable> | none );
 	glue-cache <replaceable>boolean</replaceable>;
 	heartbeat-interval <replaceable>integer</replaceable>;
 	hostname ( <replaceable>quoted_string</replaceable> | none );
 	inline-signing <replaceable>boolean</replaceable>;
-	interface-interval <replaceable>duration</replaceable>;
+	interface-interval <replaceable>ttlval</replaceable>;
 	ixfr-from-differences ( primary | master | secondary | slave |
 	    <replaceable>boolean</replaceable> );
 	keep-response-order { <replaceable>address_match_element</replaceable>; ... };
 	key-directory <replaceable>quoted_string</replaceable>;
-	lame-ttl <replaceable>duration</replaceable>;
+	lame-ttl <replaceable>ttlval</replaceable>;
 	listen-on [ port <replaceable>integer</replaceable> ] [ dscp
 	    <replaceable>integer</replaceable> ] {
 	    <replaceable>address_match_element</replaceable>; ... };
@@ -308,28 +315,28 @@ options {
 	masterfile-style ( full | relative );
 	match-mapped-addresses <replaceable>boolean</replaceable>;
 	max-cache-size ( default | unlimited | <replaceable>sizeval</replaceable> | <replaceable>percentage</replaceable> );
-	max-cache-ttl <replaceable>duration</replaceable>;
+	max-cache-ttl <replaceable>ttlval</replaceable>;
 	max-clients-per-query <replaceable>integer</replaceable>;
 	max-journal-size ( default | unlimited | <replaceable>sizeval</replaceable> );
-	max-ncache-ttl <replaceable>duration</replaceable>;
+	max-ncache-ttl <replaceable>ttlval</replaceable>;
 	max-records <replaceable>integer</replaceable>;
 	max-recursion-depth <replaceable>integer</replaceable>;
 	max-recursion-queries <replaceable>integer</replaceable>;
 	max-refresh-time <replaceable>integer</replaceable>;
 	max-retry-time <replaceable>integer</replaceable>;
 	max-rsa-exponent-size <replaceable>integer</replaceable>;
-	max-stale-ttl <replaceable>duration</replaceable>;
+	max-stale-ttl <replaceable>ttlval</replaceable>;
 	max-transfer-idle-in <replaceable>integer</replaceable>;
 	max-transfer-idle-out <replaceable>integer</replaceable>;
 	max-transfer-time-in <replaceable>integer</replaceable>;
 	max-transfer-time-out <replaceable>integer</replaceable>;
 	max-udp-size <replaceable>integer</replaceable>;
-	max-zone-ttl ( unlimited | <replaceable>duration</replaceable> );
+	max-zone-ttl ( unlimited | <replaceable>ttlval</replaceable> );
 	memstatistics <replaceable>boolean</replaceable>;
 	memstatistics-file <replaceable>quoted_string</replaceable>;
 	message-compression <replaceable>boolean</replaceable>;
-	min-cache-ttl <replaceable>duration</replaceable>;
+	min-cache-ttl <replaceable>ttlval</replaceable>;
-	min-ncache-ttl <replaceable>duration</replaceable>;
+	min-ncache-ttl <replaceable>ttlval</replaceable>;
 	min-refresh-time <replaceable>integer</replaceable>;
 	min-retry-time <replaceable>integer</replaceable>;
 	minimal-any <replaceable>boolean</replaceable>;
@@ -346,8 +353,8 @@ options {
 	notify-source-v6 ( <replaceable>ipv6_address</replaceable> | * ) [ port ( <replaceable>integer</replaceable> | * ) ]
 	    [ dscp <replaceable>integer</replaceable> ];
 	notify-to-soa <replaceable>boolean</replaceable>;
-	nta-lifetime <replaceable>duration</replaceable>;
+	nta-lifetime <replaceable>ttlval</replaceable>;
-	nta-recheck <replaceable>duration</replaceable>;
+	nta-recheck <replaceable>ttlval</replaceable>;
 	nxdomain-redirect <replaceable>string</replaceable>;
 	pid-file ( <replaceable>quoted_string</replaceable> | none );
 	port <replaceable>integer</replaceable>;
@@ -394,13 +401,13 @@ options {
 	response-padding { <replaceable>address_match_element</replaceable>; ... } block-size
 	    <replaceable>integer</replaceable>;
 	response-policy { zone <replaceable>string</replaceable> [ add-soa <replaceable>boolean</replaceable> ] [ log
-	    <replaceable>boolean</replaceable> ] [ max-policy-ttl <replaceable>duration</replaceable> ] [ min-update-interval
+	    <replaceable>boolean</replaceable> ] [ max-policy-ttl <replaceable>ttlval</replaceable> ] [ min-update-interval
-	    <replaceable>duration</replaceable> ] [ policy ( cname | disabled | drop | given | no-op |
+	    <replaceable>ttlval</replaceable> ] [ policy ( cname | disabled | drop | given | no-op |
 	    nodata | nxdomain | passthru | tcp-only <replaceable>quoted_string</replaceable> ) ] [
 	    recursive-only <replaceable>boolean</replaceable> ] [ nsip-enable <replaceable>boolean</replaceable> ] [
 	    nsdname-enable <replaceable>boolean</replaceable> ]; ... } [ add-soa <replaceable>boolean</replaceable> ] [
-	    break-dnssec <replaceable>boolean</replaceable> ] [ max-policy-ttl <replaceable>duration</replaceable> ] [
+	    break-dnssec <replaceable>boolean</replaceable> ] [ max-policy-ttl <replaceable>ttlval</replaceable> ] [
-	    min-update-interval <replaceable>duration</replaceable> ] [ min-ns-dots <replaceable>integer</replaceable> ] [
+	    min-update-interval <replaceable>ttlval</replaceable> ] [ min-ns-dots <replaceable>integer</replaceable> ] [
 	    nsip-wait-recurse <replaceable>boolean</replaceable> ] [ qname-wait-recurse <replaceable>boolean</replaceable> ]
 	    [ recursive-only <replaceable>boolean</replaceable> ] [ nsip-enable <replaceable>boolean</replaceable> ] [
 	    nsdname-enable <replaceable>boolean</replaceable> ] [ dnsrps-enable <replaceable>boolean</replaceable> ] [
@@ -414,7 +421,7 @@ options {
 	serial-query-rate <replaceable>integer</replaceable>;
 	serial-update-method ( date | increment | unixtime );
 	server-id ( <replaceable>quoted_string</replaceable> | none | hostname );
-	servfail-ttl <replaceable>duration</replaceable>;
+	servfail-ttl <replaceable>ttlval</replaceable>;
 	session-keyalg <replaceable>string</replaceable>;
 	session-keyfile ( <replaceable>quoted_string</replaceable> | none );
 	session-keyname <replaceable>string</replaceable>;
@@ -425,7 +432,7 @@ options {
 	sortlist { <replaceable>address_match_element</replaceable>; ... };
 	stacksize ( default | unlimited | <replaceable>sizeval</replaceable> );
 	stale-answer-enable <replaceable>boolean</replaceable>;
-	stale-answer-ttl <replaceable>duration</replaceable>;
+	stale-answer-ttl <replaceable>ttlval</replaceable>;
 	startup-notify-rate <replaceable>integer</replaceable>;
 	statistics-file <replaceable>quoted_string</replaceable>;
 	synth-from-dnssec <replaceable>boolean</replaceable>;
@@ -519,17 +526,8 @@ statistics-channels {
 </literallayout>
  </refsection>
  <refsection><info><title>TRUST-ANCHORS</title></info>
    <literallayout class="normal">
 trust-anchors { <replaceable>string</replaceable> ( static-key |
    initial-key | static-ds | initial-ds )
    <replaceable>integer</replaceable> <replaceable>integer</replaceable> <replaceable>integer</replaceable>
    <replaceable>quoted_string</replaceable>; ... };
 </literallayout>
  </refsection>
  <refsection><info><title>TRUSTED-KEYS</title></info>
-  <para>Deprecated - see TRUST-ANCHORS.</para>
+  <para>Deprecated - see DNSSEC-KEYS.</para>
    <literallayout class="normal">
 trusted-keys { <replaceable>string</replaceable> <replaceable>integer</replaceable>
    <replaceable>integer</replaceable> <replaceable>integer</replaceable>
@@ -566,7 +564,7 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	    [ dscp <replaceable>integer</replaceable> ] { ( <replaceable>masters</replaceable> | <replaceable>ipv4_address</replaceable> [ port
 	    <replaceable>integer</replaceable> ] | <replaceable>ipv6_address</replaceable> [ port <replaceable>integer</replaceable> ] ) [ key
 	    <replaceable>string</replaceable> ]; ... } ] [ zone-directory <replaceable>quoted_string</replaceable> ] [
-	    in-memory <replaceable>boolean</replaceable> ] [ min-update-interval <replaceable>duration</replaceable> ]; ... };
+	    in-memory <replaceable>boolean</replaceable> ] [ min-update-interval <replaceable>ttlval</replaceable> ]; ... };
 	check-dup-records ( fail | warn | ignore );
 	check-integrity <replaceable>boolean</replaceable>;
 	check-mx ( fail | warn | ignore );
@@ -608,6 +606,9 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	dnsrps-options { <replaceable>unspecified-text</replaceable> };
 	dnssec-accept-expired <replaceable>boolean</replaceable>;
 	dnssec-dnskey-kskonly <replaceable>boolean</replaceable>;
 	dnssec-keys { <replaceable>string</replaceable> ( static-key |
 	    initial-key ) <replaceable>integer</replaceable> <replaceable>integer</replaceable>
 	    <replaceable>integer</replaceable> <replaceable>quoted_string</replaceable>; ... };
 	dnssec-loadkeys-interval <replaceable>integer</replaceable>;
 	dnssec-must-be-secure <replaceable>string</replaceable> <replaceable>boolean</replaceable>;
 	dnssec-secure-to-insecure <replaceable>boolean</replaceable>;
@@ -641,11 +642,10 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 		secret <replaceable>string</replaceable>;
 	};
 	key-directory <replaceable>quoted_string</replaceable>;
-	lame-ttl <replaceable>duration</replaceable>;
+	lame-ttl <replaceable>ttlval</replaceable>;
 	lmdb-mapsize <replaceable>sizeval</replaceable>;
 	managed-keys { <replaceable>string</replaceable> (
 	    static-key | initial-key
 	    | static-ds | initial-ds
 	    ) <replaceable>integer</replaceable> <replaceable>integer</replaceable>
 	    <replaceable>integer</replaceable>
 	    <replaceable>quoted_string</replaceable>; ... }; deprecated
@@ -655,25 +655,25 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	match-destinations { <replaceable>address_match_element</replaceable>; ... };
 	match-recursive-only <replaceable>boolean</replaceable>;
 	max-cache-size ( default | unlimited | <replaceable>sizeval</replaceable> | <replaceable>percentage</replaceable> );
-	max-cache-ttl <replaceable>duration</replaceable>;
+	max-cache-ttl <replaceable>ttlval</replaceable>;
 	max-clients-per-query <replaceable>integer</replaceable>;
 	max-journal-size ( default | unlimited | <replaceable>sizeval</replaceable> );
-	max-ncache-ttl <replaceable>duration</replaceable>;
+	max-ncache-ttl <replaceable>ttlval</replaceable>;
 	max-records <replaceable>integer</replaceable>;
 	max-recursion-depth <replaceable>integer</replaceable>;
 	max-recursion-queries <replaceable>integer</replaceable>;
 	max-refresh-time <replaceable>integer</replaceable>;
 	max-retry-time <replaceable>integer</replaceable>;
-	max-stale-ttl <replaceable>duration</replaceable>;
+	max-stale-ttl <replaceable>ttlval</replaceable>;
 	max-transfer-idle-in <replaceable>integer</replaceable>;
 	max-transfer-idle-out <replaceable>integer</replaceable>;
 	max-transfer-time-in <replaceable>integer</replaceable>;
 	max-transfer-time-out <replaceable>integer</replaceable>;
 	max-udp-size <replaceable>integer</replaceable>;
-	max-zone-ttl ( unlimited | <replaceable>duration</replaceable> );
+	max-zone-ttl ( unlimited | <replaceable>ttlval</replaceable> );
 	message-compression <replaceable>boolean</replaceable>;
-	min-cache-ttl <replaceable>duration</replaceable>;
+	min-cache-ttl <replaceable>ttlval</replaceable>;
-	min-ncache-ttl <replaceable>duration</replaceable>;
+	min-ncache-ttl <replaceable>ttlval</replaceable>;
 	min-refresh-time <replaceable>integer</replaceable>;
 	min-retry-time <replaceable>integer</replaceable>;
 	minimal-any <replaceable>boolean</replaceable>;
@@ -689,8 +689,8 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	notify-source-v6 ( <replaceable>ipv6_address</replaceable> | * ) [ port ( <replaceable>integer</replaceable> | * ) ]
 	    [ dscp <replaceable>integer</replaceable> ];
 	notify-to-soa <replaceable>boolean</replaceable>;
-	nta-lifetime <replaceable>duration</replaceable>;
+	nta-lifetime <replaceable>ttlval</replaceable>;
-	nta-recheck <replaceable>duration</replaceable>;
+	nta-recheck <replaceable>ttlval</replaceable>;
 	nxdomain-redirect <replaceable>string</replaceable>;
 	plugin ( query ) <replaceable>string</replaceable> [ {
 	    <replaceable>unspecified-text</replaceable> } ];
@@ -732,13 +732,13 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	response-padding { <replaceable>address_match_element</replaceable>; ... } block-size
 	    <replaceable>integer</replaceable>;
 	response-policy { zone <replaceable>string</replaceable> [ add-soa <replaceable>boolean</replaceable> ] [ log
-	    <replaceable>boolean</replaceable> ] [ max-policy-ttl <replaceable>duration</replaceable> ] [ min-update-interval
+	    <replaceable>boolean</replaceable> ] [ max-policy-ttl <replaceable>ttlval</replaceable> ] [ min-update-interval
-	    <replaceable>duration</replaceable> ] [ policy ( cname | disabled | drop | given | no-op |
+	    <replaceable>ttlval</replaceable> ] [ policy ( cname | disabled | drop | given | no-op |
 	    nodata | nxdomain | passthru | tcp-only <replaceable>quoted_string</replaceable> ) ] [
 	    recursive-only <replaceable>boolean</replaceable> ] [ nsip-enable <replaceable>boolean</replaceable> ] [
 	    nsdname-enable <replaceable>boolean</replaceable> ]; ... } [ add-soa <replaceable>boolean</replaceable> ] [
-	    break-dnssec <replaceable>boolean</replaceable> ] [ max-policy-ttl <replaceable>duration</replaceable> ] [
+	    break-dnssec <replaceable>boolean</replaceable> ] [ max-policy-ttl <replaceable>ttlval</replaceable> ] [
-	    min-update-interval <replaceable>duration</replaceable> ] [ min-ns-dots <replaceable>integer</replaceable> ] [
+	    min-update-interval <replaceable>ttlval</replaceable> ] [ min-ns-dots <replaceable>integer</replaceable> ] [
 	    nsip-wait-recurse <replaceable>boolean</replaceable> ] [ qname-wait-recurse <replaceable>boolean</replaceable> ]
 	    [ recursive-only <replaceable>boolean</replaceable> ] [ nsip-enable <replaceable>boolean</replaceable> ] [
 	    nsdname-enable <replaceable>boolean</replaceable> ] [ dnsrps-enable <replaceable>boolean</replaceable> ] [
@@ -783,14 +783,14 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 		    <replaceable>integer</replaceable> | * ) ] [ dscp <replaceable>integer</replaceable> ];
 		transfers <replaceable>integer</replaceable>;
 	};
-	servfail-ttl <replaceable>duration</replaceable>;
+	servfail-ttl <replaceable>ttlval</replaceable>;
 	sig-signing-nodes <replaceable>integer</replaceable>;
 	sig-signing-signatures <replaceable>integer</replaceable>;
 	sig-signing-type <replaceable>integer</replaceable>;
 	sig-validity-interval <replaceable>integer</replaceable> [ <replaceable>integer</replaceable> ];
 	sortlist { <replaceable>address_match_element</replaceable>; ... };
 	stale-answer-enable <replaceable>boolean</replaceable>;
-	stale-answer-ttl <replaceable>duration</replaceable>;
+	stale-answer-ttl <replaceable>ttlval</replaceable>;
 	synth-from-dnssec <replaceable>boolean</replaceable>;
 	transfer-format ( many-answers | one-answer );
 	transfer-source ( <replaceable>ipv4_address</replaceable> | * ) [ port ( <replaceable>integer</replaceable> | * ) ] [
@@ -798,10 +798,6 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	transfer-source-v6 ( <replaceable>ipv6_address</replaceable> | * ) [ port ( <replaceable>integer</replaceable> | * )
 	    ] [ dscp <replaceable>integer</replaceable> ];
 	trust-anchor-telemetry <replaceable>boolean</replaceable>; // experimental
 	trust-anchors { <replaceable>string</replaceable> ( static-key |
 	    initial-key | static-ds | initial-ds
 	    ) <replaceable>integer</replaceable> <replaceable>integer</replaceable> <replaceable>integer</replaceable>
 	    <replaceable>quoted_string</replaceable>; ... };
 	trusted-keys { <replaceable>string</replaceable>
 	    <replaceable>integer</replaceable> <replaceable>integer</replaceable>
 	    <replaceable>integer</replaceable>
@@ -846,7 +842,6 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 		dnskey-sig-validity <replaceable>integer</replaceable>;
 		dnssec-dnskey-kskonly <replaceable>boolean</replaceable>;
 		dnssec-loadkeys-interval <replaceable>integer</replaceable>;
 		dnssec-policy <replaceable>string</replaceable>;
 		dnssec-secure-to-insecure <replaceable>boolean</replaceable>;
 		dnssec-update-mode ( maintain | no-resign );
 		file <replaceable>quoted_string</replaceable>;
@@ -872,7 +867,7 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 		max-transfer-idle-out <replaceable>integer</replaceable>;
 		max-transfer-time-in <replaceable>integer</replaceable>;
 		max-transfer-time-out <replaceable>integer</replaceable>;
-		max-zone-ttl ( unlimited | <replaceable>duration</replaceable> );
+		max-zone-ttl ( unlimited | <replaceable>ttlval</replaceable> );
 		min-refresh-time <replaceable>integer</replaceable>;
 		min-retry-time <replaceable>integer</replaceable>;
 		multi-master <replaceable>boolean</replaceable>;
@@ -948,7 +943,6 @@ zone <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	dnskey-sig-validity <replaceable>integer</replaceable>;
 	dnssec-dnskey-kskonly <replaceable>boolean</replaceable>;
 	dnssec-loadkeys-interval <replaceable>integer</replaceable>;
 	dnssec-policy <replaceable>string</replaceable>;
 	dnssec-secure-to-insecure <replaceable>boolean</replaceable>;
 	dnssec-update-mode ( maintain | no-resign );
 	file <replaceable>quoted_string</replaceable>;
@@ -973,7 +967,7 @@ zone <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	max-transfer-idle-out <replaceable>integer</replaceable>;
 	max-transfer-time-in <replaceable>integer</replaceable>;
 	max-transfer-time-out <replaceable>integer</replaceable>;
-	max-zone-ttl ( unlimited | <replaceable>duration</replaceable> );
+	max-zone-ttl ( unlimited | <replaceable>ttlval</replaceable> );
 	min-refresh-time <replaceable>integer</replaceable>;
 	min-retry-time <replaceable>integer</replaceable>;
 	multi-master <replaceable>boolean</replaceable>;
@@ -1014,26 +1008,6 @@ zone <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 </literallayout>
  </refsection>
  <refsection><info><title>DNSSEC-POLICY</title></info>
    <literallayout class="normal">
 dnssec-policy <replaceable>string</replaceable> {
 	dnskey-ttl <replaceable>duration</replaceable>;
 	keys { ( csk | ksk | zsk ) key-directory lifetime <replaceable>duration</replaceable> algorithm <replaceable>integer</replaceable> [ <replaceable>integer</replaceable> ] ; ... };
 	parent-ds-ttl <replaceable>duration</replaceable>;
 	parent-propagation-delay <replaceable>duration</replaceable>;
 	parent-registration-delay <replaceable>duration</replaceable>;
 	publish-safety <replaceable>duration</replaceable>;
 	retire-safety <replaceable>duration</replaceable>;
 	signatures-refresh <replaceable>duration</replaceable>;
 	signatures-validity <replaceable>duration</replaceable>;
 	signatures-validity-dnskey <replaceable>duration</replaceable>;
 	zone-max-ttl <replaceable>duration</replaceable>;
 	zone-propagation-delay <replaceable>duration</replaceable>;
 };
 </literallayout>
  </refsection>
  <refsection><info><title>FILES</title></info>
    <para><filename>/etc/named.conf</filename>
@@ -92,7 +92,16 @@ dlz
  </div>
  <div class="refsection">
-<a name="id-1.11"></a><h2>DYNDB</h2>
+<a name="id-1.11"></a><h2>DNSSEC-KEYS</h2>
    <div class="literallayout"><p><br>
 dnssec-keys { <em class="replaceable"><code>string</code></em> ( static-key |<br>
     initial-key ) <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em><br>
     <em class="replaceable"><code>quoted_string</code></em>; ... };<br>
 </p></div>
  </div>
  <div class="refsection">
 <a name="id-1.12"></a><h2>DYNDB</h2>
    <div class="literallayout"><p><br>
 dyndb <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>quoted_string</code></em> {<br>
     <em class="replaceable"><code>unspecified-text</code></em> };<br>
@@ -100,7 +109,7 @@ dyndb
  </div>
  <div class="refsection">
-<a name="id-1.12"></a><h2>KEY</h2>
+<a name="id-1.13"></a><h2>KEY</h2>
    <div class="literallayout"><p><br>
 key <em class="replaceable"><code>string</code></em> {<br>
 	algorithm <em class="replaceable"><code>string</code></em>;<br>
@@ -110,7 +119,7 @@ key
  </div>
  <div class="refsection">
-<a name="id-1.13"></a><h2>LOGGING</h2>
+<a name="id-1.14"></a><h2>LOGGING</h2>
    <div class="literallayout"><p><br>
 logging {<br>
 	category <em class="replaceable"><code>string</code></em> { <em class="replaceable"><code>string</code></em>; ... };<br>
@@ -131,18 +140,18 @@ logging
  </div>
  <div class="refsection">
-<a name="id-1.14"></a><h2>MANAGED-KEYS</h2>
+<a name="id-1.15"></a><h2>MANAGED-KEYS</h2>
-  <p>Deprecated - see TRUST-ANCHORS.</p>
+  <p>Deprecated - see DNSSEC-KEYS.</p>
    <div class="literallayout"><p><br>
 managed-keys { <em class="replaceable"><code>string</code></em> ( static-key<br>
-    | initial-key | static-ds |<br>
+    | initial-key ) <em class="replaceable"><code>integer</code></em><br>
-    initial-ds ) <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em><br>
+    <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em><br>
-    <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>quoted_string</code></em>; ... }; deprecated<br>
+    <em class="replaceable"><code>quoted_string</code></em>; ... }; deprecated<br>
 </p></div>
  </div>
  <div class="refsection">
-<a name="id-1.15"></a><h2>MASTERS</h2>
+<a name="id-1.16"></a><h2>MASTERS</h2>
    <div class="literallayout"><p><br>
 masters <em class="replaceable"><code>string</code></em> [ port <em class="replaceable"><code>integer</code></em> ] [ dscp<br>
     <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [<br>
@@ -152,7 +161,7 @@ masters
  </div>
  <div class="refsection">
-<a name="id-1.16"></a><h2>OPTIONS</h2>
+<a name="id-1.17"></a><h2>OPTIONS</h2>
    <div class="literallayout"><p><br>
 options {<br>
 	allow-new-zones <em class="replaceable"><code>boolean</code></em>;<br>
@@ -187,7 +196,7 @@ options
 	    [ dscp <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [ port<br>
 	    <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv6_address</code></em> [ port <em class="replaceable"><code>integer</code></em> ] ) [ key<br>
 	    <em class="replaceable"><code>string</code></em> ]; ... } ] [ zone-directory <em class="replaceable"><code>quoted_string</code></em> ] [<br>
-	    in-memory <em class="replaceable"><code>boolean</code></em> ] [ min-update-interval <em class="replaceable"><code>duration</code></em> ]; ... };<br>
+	    in-memory <em class="replaceable"><code>boolean</code></em> ] [ min-update-interval <em class="replaceable"><code>ttlval</code></em> ]; ... };<br>
 	check-dup-records ( fail | warn | ignore );<br>
 	check-integrity <em class="replaceable"><code>boolean</code></em>;<br>
 	check-mx ( fail | warn | ignore );<br>
@@ -269,18 +278,18 @@ options
 	fstrm-set-output-notify-threshold <em class="replaceable"><code>integer</code></em>;<br>
 	fstrm-set-output-queue-model ( mpsc | spsc );<br>
 	fstrm-set-output-queue-size <em class="replaceable"><code>integer</code></em>;<br>
-	fstrm-set-reopen-interval <em class="replaceable"><code>duration</code></em>;<br>
+	fstrm-set-reopen-interval <em class="replaceable"><code>ttlval</code></em>;<br>
 	geoip-directory ( <em class="replaceable"><code>quoted_string</code></em> | none );<br>
 	glue-cache <em class="replaceable"><code>boolean</code></em>;<br>
 	heartbeat-interval <em class="replaceable"><code>integer</code></em>;<br>
 	hostname ( <em class="replaceable"><code>quoted_string</code></em> | none );<br>
 	inline-signing <em class="replaceable"><code>boolean</code></em>;<br>
-	interface-interval <em class="replaceable"><code>duration</code></em>;<br>
+	interface-interval <em class="replaceable"><code>ttlval</code></em>;<br>
 	ixfr-from-differences ( primary | master | secondary | slave |<br>
 	    <em class="replaceable"><code>boolean</code></em> );<br>
 	keep-response-order { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
 	key-directory <em class="replaceable"><code>quoted_string</code></em>;<br>
-	lame-ttl <em class="replaceable"><code>duration</code></em>;<br>
+	lame-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
 	listen-on [ port <em class="replaceable"><code>integer</code></em> ] [ dscp<br>
 	    <em class="replaceable"><code>integer</code></em> ] {<br>
 	    <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
@@ -294,28 +303,28 @@ options
 	masterfile-style ( full | relative );<br>
 	match-mapped-addresses <em class="replaceable"><code>boolean</code></em>;<br>
 	max-cache-size ( default | unlimited | <em class="replaceable"><code>sizeval</code></em> | <em class="replaceable"><code>percentage</code></em> );<br>
-	max-cache-ttl <em class="replaceable"><code>duration</code></em>;<br>
+	max-cache-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
 	max-clients-per-query <em class="replaceable"><code>integer</code></em>;<br>
 	max-journal-size ( default | unlimited | <em class="replaceable"><code>sizeval</code></em> );<br>
-	max-ncache-ttl <em class="replaceable"><code>duration</code></em>;<br>
+	max-ncache-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
 	max-records <em class="replaceable"><code>integer</code></em>;<br>
 	max-recursion-depth <em class="replaceable"><code>integer</code></em>;<br>
 	max-recursion-queries <em class="replaceable"><code>integer</code></em>;<br>
 	max-refresh-time <em class="replaceable"><code>integer</code></em>;<br>
 	max-retry-time <em class="replaceable"><code>integer</code></em>;<br>
 	max-rsa-exponent-size <em class="replaceable"><code>integer</code></em>;<br>
-	max-stale-ttl <em class="replaceable"><code>duration</code></em>;<br>
+	max-stale-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
 	max-transfer-idle-in <em class="replaceable"><code>integer</code></em>;<br>
 	max-transfer-idle-out <em class="replaceable"><code>integer</code></em>;<br>
 	max-transfer-time-in <em class="replaceable"><code>integer</code></em>;<br>
 	max-transfer-time-out <em class="replaceable"><code>integer</code></em>;<br>
 	max-udp-size <em class="replaceable"><code>integer</code></em>;<br>
-	max-zone-ttl ( unlimited | <em class="replaceable"><code>duration</code></em> );<br>
+	max-zone-ttl ( unlimited | <em class="replaceable"><code>ttlval</code></em> );<br>
 	memstatistics <em class="replaceable"><code>boolean</code></em>;<br>
 	memstatistics-file <em class="replaceable"><code>quoted_string</code></em>;<br>
 	message-compression <em class="replaceable"><code>boolean</code></em>;<br>
-	min-cache-ttl <em class="replaceable"><code>duration</code></em>;<br>
+	min-cache-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
-	min-ncache-ttl <em class="replaceable"><code>duration</code></em>;<br>
+	min-ncache-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
 	min-refresh-time <em class="replaceable"><code>integer</code></em>;<br>
 	min-retry-time <em class="replaceable"><code>integer</code></em>;<br>
 	minimal-any <em class="replaceable"><code>boolean</code></em>;<br>
@@ -332,8 +341,8 @@ options
 	notify-source-v6 ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [ port ( <em class="replaceable"><code>integer</code></em> | * ) ]<br>
 	    [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
 	notify-to-soa <em class="replaceable"><code>boolean</code></em>;<br>
-	nta-lifetime <em class="replaceable"><code>duration</code></em>;<br>
+	nta-lifetime <em class="replaceable"><code>ttlval</code></em>;<br>
-	nta-recheck <em class="replaceable"><code>duration</code></em>;<br>
+	nta-recheck <em class="replaceable"><code>ttlval</code></em>;<br>
 	nxdomain-redirect <em class="replaceable"><code>string</code></em>;<br>
 	pid-file ( <em class="replaceable"><code>quoted_string</code></em> | none );<br>
 	port <em class="replaceable"><code>integer</code></em>;<br>
@@ -380,13 +389,13 @@ options
 	response-padding { <em class="replaceable"><code>address_match_element</code></em>; ... } block-size<br>
 	    <em class="replaceable"><code>integer</code></em>;<br>
 	response-policy { zone <em class="replaceable"><code>string</code></em> [ add-soa <em class="replaceable"><code>boolean</code></em> ] [ log<br>
-	    <em class="replaceable"><code>boolean</code></em> ] [ max-policy-ttl <em class="replaceable"><code>duration</code></em> ] [ min-update-interval<br>
+	    <em class="replaceable"><code>boolean</code></em> ] [ max-policy-ttl <em class="replaceable"><code>ttlval</code></em> ] [ min-update-interval<br>
-	    <em class="replaceable"><code>duration</code></em> ] [ policy ( cname | disabled | drop | given | no-op |<br>
+	    <em class="replaceable"><code>ttlval</code></em> ] [ policy ( cname | disabled | drop | given | no-op |<br>
 	    nodata | nxdomain | passthru | tcp-only <em class="replaceable"><code>quoted_string</code></em> ) ] [<br>
 	    recursive-only <em class="replaceable"><code>boolean</code></em> ] [ nsip-enable <em class="replaceable"><code>boolean</code></em> ] [<br>
 	    nsdname-enable <em class="replaceable"><code>boolean</code></em> ]; ... } [ add-soa <em class="replaceable"><code>boolean</code></em> ] [<br>
-	    break-dnssec <em class="replaceable"><code>boolean</code></em> ] [ max-policy-ttl <em class="replaceable"><code>duration</code></em> ] [<br>
+	    break-dnssec <em class="replaceable"><code>boolean</code></em> ] [ max-policy-ttl <em class="replaceable"><code>ttlval</code></em> ] [<br>
-	    min-update-interval <em class="replaceable"><code>duration</code></em> ] [ min-ns-dots <em class="replaceable"><code>integer</code></em> ] [<br>
+	    min-update-interval <em class="replaceable"><code>ttlval</code></em> ] [ min-ns-dots <em class="replaceable"><code>integer</code></em> ] [<br>
 	    nsip-wait-recurse <em class="replaceable"><code>boolean</code></em> ] [ qname-wait-recurse <em class="replaceable"><code>boolean</code></em> ]<br>
 	    [ recursive-only <em class="replaceable"><code>boolean</code></em> ] [ nsip-enable <em class="replaceable"><code>boolean</code></em> ] [<br>
 	    nsdname-enable <em class="replaceable"><code>boolean</code></em> ] [ dnsrps-enable <em class="replaceable"><code>boolean</code></em> ] [<br>
@@ -400,7 +409,7 @@ options
 	serial-query-rate <em class="replaceable"><code>integer</code></em>;<br>
 	serial-update-method ( date | increment | unixtime );<br>
 	server-id ( <em class="replaceable"><code>quoted_string</code></em> | none | hostname );<br>
-	servfail-ttl <em class="replaceable"><code>duration</code></em>;<br>
+	servfail-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
 	session-keyalg <em class="replaceable"><code>string</code></em>;<br>
 	session-keyfile ( <em class="replaceable"><code>quoted_string</code></em> | none );<br>
 	session-keyname <em class="replaceable"><code>string</code></em>;<br>
@@ -411,7 +420,7 @@ options
 	sortlist { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
 	stacksize ( default | unlimited | <em class="replaceable"><code>sizeval</code></em> );<br>
 	stale-answer-enable <em class="replaceable"><code>boolean</code></em>;<br>
-	stale-answer-ttl <em class="replaceable"><code>duration</code></em>;<br>
+	stale-answer-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
 	startup-notify-rate <em class="replaceable"><code>integer</code></em>;<br>
 	statistics-file <em class="replaceable"><code>quoted_string</code></em>;<br>
 	synth-from-dnssec <em class="replaceable"><code>boolean</code></em>;<br>
@@ -451,7 +460,7 @@ options
  </div>
  <div class="refsection">
-<a name="id-1.17"></a><h2>PLUGIN</h2>
+<a name="id-1.18"></a><h2>PLUGIN</h2>
    <div class="literallayout"><p><br>
 plugin ( query ) <em class="replaceable"><code>string</code></em> [ { <em class="replaceable"><code>unspecified-text</code></em><br>
     } ];<br>
@@ -459,7 +468,7 @@ plugin
  </div>
  <div class="refsection">
-<a name="id-1.18"></a><h2>SERVER</h2>
+<a name="id-1.19"></a><h2>SERVER</h2>
    <div class="literallayout"><p><br>
 server <em class="replaceable"><code>netprefix</code></em> {<br>
 	bogus <em class="replaceable"><code>boolean</code></em>;<br>
@@ -497,7 +506,7 @@ server
  </div>
  <div class="refsection">
-<a name="id-1.19"></a><h2>STATISTICS-CHANNELS</h2>
+<a name="id-1.20"></a><h2>STATISTICS-CHANNELS</h2>
    <div class="literallayout"><p><br>
 statistics-channels {<br>
 	inet ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> |<br>
@@ -508,19 +517,9 @@ statistics-channels
 </p></div>
  </div>
  <div class="refsection">
 <a name="id-1.20"></a><h2>TRUST-ANCHORS</h2>
    <div class="literallayout"><p><br>
 trust-anchors { <em class="replaceable"><code>string</code></em> ( static-key |<br>
     initial-key | static-ds | initial-ds )<br>
     <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em><br>
     <em class="replaceable"><code>quoted_string</code></em>; ... };<br>
 </p></div>
  </div>
  <div class="refsection">
 <a name="id-1.21"></a><h2>TRUSTED-KEYS</h2>
-  <p>Deprecated - see TRUST-ANCHORS.</p>
+  <p>Deprecated - see DNSSEC-KEYS.</p>
    <div class="literallayout"><p><br>
 trusted-keys { <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>integer</code></em><br>
     <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em><br>
@@ -558,7 +557,7 @@ view
 	    [ dscp <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [ port<br>
 	    <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv6_address</code></em> [ port <em class="replaceable"><code>integer</code></em> ] ) [ key<br>
 	    <em class="replaceable"><code>string</code></em> ]; ... } ] [ zone-directory <em class="replaceable"><code>quoted_string</code></em> ] [<br>
-	    in-memory <em class="replaceable"><code>boolean</code></em> ] [ min-update-interval <em class="replaceable"><code>duration</code></em> ]; ... };<br>
+	    in-memory <em class="replaceable"><code>boolean</code></em> ] [ min-update-interval <em class="replaceable"><code>ttlval</code></em> ]; ... };<br>
 	check-dup-records ( fail | warn | ignore );<br>
 	check-integrity <em class="replaceable"><code>boolean</code></em>;<br>
 	check-mx ( fail | warn | ignore );<br>
@@ -600,6 +599,9 @@ view
 	dnsrps-options { <em class="replaceable"><code>unspecified-text</code></em> };<br>
 	dnssec-accept-expired <em class="replaceable"><code>boolean</code></em>;<br>
 	dnssec-dnskey-kskonly <em class="replaceable"><code>boolean</code></em>;<br>
 	dnssec-keys { <em class="replaceable"><code>string</code></em> ( static-key |<br>
 	    initial-key ) <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em><br>
 	    <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>quoted_string</code></em>; ... };<br>
 	dnssec-loadkeys-interval <em class="replaceable"><code>integer</code></em>;<br>
 	dnssec-must-be-secure <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>boolean</code></em>;<br>
 	dnssec-secure-to-insecure <em class="replaceable"><code>boolean</code></em>;<br>
@@ -633,11 +635,10 @@ view
 		secret <em class="replaceable"><code>string</code></em>;<br>
 	};<br>
 	key-directory <em class="replaceable"><code>quoted_string</code></em>;<br>
-	lame-ttl <em class="replaceable"><code>duration</code></em>;<br>
+	lame-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
 	lmdb-mapsize <em class="replaceable"><code>sizeval</code></em>;<br>
 	managed-keys { <em class="replaceable"><code>string</code></em> (<br>
 	    static-key | initial-key<br>
 	    | static-ds | initial-ds<br>
 	    ) <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em><br>
 	    <em class="replaceable"><code>integer</code></em><br>
 	    <em class="replaceable"><code>quoted_string</code></em>; ... }; deprecated<br>
@@ -647,25 +648,25 @@ view
 	match-destinations { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
 	match-recursive-only <em class="replaceable"><code>boolean</code></em>;<br>
 	max-cache-size ( default | unlimited | <em class="replaceable"><code>sizeval</code></em> | <em class="replaceable"><code>percentage</code></em> );<br>
-	max-cache-ttl <em class="replaceable"><code>duration</code></em>;<br>
+	max-cache-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
 	max-clients-per-query <em class="replaceable"><code>integer</code></em>;<br>
 	max-journal-size ( default | unlimited | <em class="replaceable"><code>sizeval</code></em> );<br>
-	max-ncache-ttl <em class="replaceable"><code>duration</code></em>;<br>
+	max-ncache-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
 	max-records <em class="replaceable"><code>integer</code></em>;<br>
 	max-recursion-depth <em class="replaceable"><code>integer</code></em>;<br>
 	max-recursion-queries <em class="replaceable"><code>integer</code></em>;<br>
 	max-refresh-time <em class="replaceable"><code>integer</code></em>;<br>
 	max-retry-time <em class="replaceable"><code>integer</code></em>;<br>
-	max-stale-ttl <em class="replaceable"><code>duration</code></em>;<br>
+	max-stale-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
 	max-transfer-idle-in <em class="replaceable"><code>integer</code></em>;<br>
 	max-transfer-idle-out <em class="replaceable"><code>integer</code></em>;<br>
 	max-transfer-time-in <em class="replaceable"><code>integer</code></em>;<br>
 	max-transfer-time-out <em class="replaceable"><code>integer</code></em>;<br>
 	max-udp-size <em class="replaceable"><code>integer</code></em>;<br>
-	max-zone-ttl ( unlimited | <em class="replaceable"><code>duration</code></em> );<br>
+	max-zone-ttl ( unlimited | <em class="replaceable"><code>ttlval</code></em> );<br>
 	message-compression <em class="replaceable"><code>boolean</code></em>;<br>
-	min-cache-ttl <em class="replaceable"><code>duration</code></em>;<br>
+	min-cache-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
-	min-ncache-ttl <em class="replaceable"><code>duration</code></em>;<br>
+	min-ncache-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
 	min-refresh-time <em class="replaceable"><code>integer</code></em>;<br>
 	min-retry-time <em class="replaceable"><code>integer</code></em>;<br>
 	minimal-any <em class="replaceable"><code>boolean</code></em>;<br>
@@ -681,8 +682,8 @@ view
 	notify-source-v6 ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [ port ( <em class="replaceable"><code>integer</code></em> | * ) ]<br>
 	    [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
 	notify-to-soa <em class="replaceable"><code>boolean</code></em>;<br>
-	nta-lifetime <em class="replaceable"><code>duration</code></em>;<br>
+	nta-lifetime <em class="replaceable"><code>ttlval</code></em>;<br>
-	nta-recheck <em class="replaceable"><code>duration</code></em>;<br>
+	nta-recheck <em class="replaceable"><code>ttlval</code></em>;<br>
 	nxdomain-redirect <em class="replaceable"><code>string</code></em>;<br>
 	plugin ( query ) <em class="replaceable"><code>string</code></em> [ {<br>
 	    <em class="replaceable"><code>unspecified-text</code></em> } ];<br>
@@ -724,13 +725,13 @@ view
 	response-padding { <em class="replaceable"><code>address_match_element</code></em>; ... } block-size<br>
 	    <em class="replaceable"><code>integer</code></em>;<br>
 	response-policy { zone <em class="replaceable"><code>string</code></em> [ add-soa <em class="replaceable"><code>boolean</code></em> ] [ log<br>
-	    <em class="replaceable"><code>boolean</code></em> ] [ max-policy-ttl <em class="replaceable"><code>duration</code></em> ] [ min-update-interval<br>
+	    <em class="replaceable"><code>boolean</code></em> ] [ max-policy-ttl <em class="replaceable"><code>ttlval</code></em> ] [ min-update-interval<br>
-	    <em class="replaceable"><code>duration</code></em> ] [ policy ( cname | disabled | drop | given | no-op |<br>
+	    <em class="replaceable"><code>ttlval</code></em> ] [ policy ( cname | disabled | drop | given | no-op |<br>
 	    nodata | nxdomain | passthru | tcp-only <em class="replaceable"><code>quoted_string</code></em> ) ] [<br>
 	    recursive-only <em class="replaceable"><code>boolean</code></em> ] [ nsip-enable <em class="replaceable"><code>boolean</code></em> ] [<br>
 	    nsdname-enable <em class="replaceable"><code>boolean</code></em> ]; ... } [ add-soa <em class="replaceable"><code>boolean</code></em> ] [<br>
-	    break-dnssec <em class="replaceable"><code>boolean</code></em> ] [ max-policy-ttl <em class="replaceable"><code>duration</code></em> ] [<br>
+	    break-dnssec <em class="replaceable"><code>boolean</code></em> ] [ max-policy-ttl <em class="replaceable"><code>ttlval</code></em> ] [<br>
-	    min-update-interval <em class="replaceable"><code>duration</code></em> ] [ min-ns-dots <em class="replaceable"><code>integer</code></em> ] [<br>
+	    min-update-interval <em class="replaceable"><code>ttlval</code></em> ] [ min-ns-dots <em class="replaceable"><code>integer</code></em> ] [<br>
 	    nsip-wait-recurse <em class="replaceable"><code>boolean</code></em> ] [ qname-wait-recurse <em class="replaceable"><code>boolean</code></em> ]<br>
 	    [ recursive-only <em class="replaceable"><code>boolean</code></em> ] [ nsip-enable <em class="replaceable"><code>boolean</code></em> ] [<br>
 	    nsdname-enable <em class="replaceable"><code>boolean</code></em> ] [ dnsrps-enable <em class="replaceable"><code>boolean</code></em> ] [<br>
@@ -775,14 +776,14 @@ view
 		    <em class="replaceable"><code>integer</code></em> | * ) ] [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
 		transfers <em class="replaceable"><code>integer</code></em>;<br>
 	};<br>
-	servfail-ttl <em class="replaceable"><code>duration</code></em>;<br>
+	servfail-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
 	sig-signing-nodes <em class="replaceable"><code>integer</code></em>;<br>
 	sig-signing-signatures <em class="replaceable"><code>integer</code></em>;<br>
 	sig-signing-type <em class="replaceable"><code>integer</code></em>;<br>
 	sig-validity-interval <em class="replaceable"><code>integer</code></em> [ <em class="replaceable"><code>integer</code></em> ];<br>
 	sortlist { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
 	stale-answer-enable <em class="replaceable"><code>boolean</code></em>;<br>
-	stale-answer-ttl <em class="replaceable"><code>duration</code></em>;<br>
+	stale-answer-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
 	synth-from-dnssec <em class="replaceable"><code>boolean</code></em>;<br>
 	transfer-format ( many-answers | one-answer );<br>
 	transfer-source ( <em class="replaceable"><code>ipv4_address</code></em> | * ) [ port ( <em class="replaceable"><code>integer</code></em> | * ) ] [<br>
@@ -790,10 +791,6 @@ view
 	transfer-source-v6 ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [ port ( <em class="replaceable"><code>integer</code></em> | * )<br>
 	    ] [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
 	trust-anchor-telemetry <em class="replaceable"><code>boolean</code></em>; // experimental<br>
 	trust-anchors { <em class="replaceable"><code>string</code></em> ( static-key |<br>
 	    initial-key | static-ds | initial-ds<br>
 	    ) <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em><br>
 	    <em class="replaceable"><code>quoted_string</code></em>; ... };<br>
 	trusted-keys { <em class="replaceable"><code>string</code></em><br>
 	    <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em><br>
 	    <em class="replaceable"><code>integer</code></em><br>
@@ -838,7 +835,6 @@ view
 		dnskey-sig-validity <em class="replaceable"><code>integer</code></em>;<br>
 		dnssec-dnskey-kskonly <em class="replaceable"><code>boolean</code></em>;<br>
 		dnssec-loadkeys-interval <em class="replaceable"><code>integer</code></em>;<br>
 		dnssec-policy <em class="replaceable"><code>string</code></em>;<br>
 		dnssec-secure-to-insecure <em class="replaceable"><code>boolean</code></em>;<br>
 		dnssec-update-mode ( maintain | no-resign );<br>
 		file <em class="replaceable"><code>quoted_string</code></em>;<br>
@@ -864,7 +860,7 @@ view
 		max-transfer-idle-out <em class="replaceable"><code>integer</code></em>;<br>
 		max-transfer-time-in <em class="replaceable"><code>integer</code></em>;<br>
 		max-transfer-time-out <em class="replaceable"><code>integer</code></em>;<br>
-		max-zone-ttl ( unlimited | <em class="replaceable"><code>duration</code></em> );<br>
+		max-zone-ttl ( unlimited | <em class="replaceable"><code>ttlval</code></em> );<br>
 		min-refresh-time <em class="replaceable"><code>integer</code></em>;<br>
 		min-retry-time <em class="replaceable"><code>integer</code></em>;<br>
 		multi-master <em class="replaceable"><code>boolean</code></em>;<br>
@@ -941,7 +937,6 @@ zone
 	dnskey-sig-validity <em class="replaceable"><code>integer</code></em>;<br>
 	dnssec-dnskey-kskonly <em class="replaceable"><code>boolean</code></em>;<br>
 	dnssec-loadkeys-interval <em class="replaceable"><code>integer</code></em>;<br>
 	dnssec-policy <em class="replaceable"><code>string</code></em>;<br>
 	dnssec-secure-to-insecure <em class="replaceable"><code>boolean</code></em>;<br>
 	dnssec-update-mode ( maintain | no-resign );<br>
 	file <em class="replaceable"><code>quoted_string</code></em>;<br>
@@ -966,7 +961,7 @@ zone
 	max-transfer-idle-out <em class="replaceable"><code>integer</code></em>;<br>
 	max-transfer-time-in <em class="replaceable"><code>integer</code></em>;<br>
 	max-transfer-time-out <em class="replaceable"><code>integer</code></em>;<br>
-	max-zone-ttl ( unlimited | <em class="replaceable"><code>duration</code></em> );<br>
+	max-zone-ttl ( unlimited | <em class="replaceable"><code>ttlval</code></em> );<br>
 	min-refresh-time <em class="replaceable"><code>integer</code></em>;<br>
 	min-retry-time <em class="replaceable"><code>integer</code></em>;<br>
 	multi-master <em class="replaceable"><code>boolean</code></em>;<br>
@@ -1008,35 +1003,14 @@ zone
  </div>
  <div class="refsection">
-<a name="id-1.24"></a><h2>DNSSEC-POLICY</h2>
+<a name="id-1.24"></a><h2>FILES</h2>
    <div class="literallayout"><p><br>
 dnssec-policy <em class="replaceable"><code>string</code></em> {<br>
 	dnskey-ttl <em class="replaceable"><code>duration</code></em>;<br>
 	keys { ( csk | ksk | zsk ) key-directory lifetime <em class="replaceable"><code>duration</code></em> algorithm <em class="replaceable"><code>integer</code></em> [ <em class="replaceable"><code>integer</code></em> ] ; ... };<br>
 	parent-ds-ttl <em class="replaceable"><code>duration</code></em>;<br>
 	parent-propagation-delay <em class="replaceable"><code>duration</code></em>;<br>
 	parent-registration-delay <em class="replaceable"><code>duration</code></em>;<br>
 	publish-safety <em class="replaceable"><code>duration</code></em>;<br>
 	retire-safety <em class="replaceable"><code>duration</code></em>;<br>
 	signatures-refresh <em class="replaceable"><code>duration</code></em>;<br>
 	signatures-validity <em class="replaceable"><code>duration</code></em>;<br>
 	signatures-validity-dnskey <em class="replaceable"><code>duration</code></em>;<br>
 	zone-max-ttl <em class="replaceable"><code>duration</code></em>;<br>
 	zone-propagation-delay <em class="replaceable"><code>duration</code></em>;<br>
 };<br>
 </p></div>
  </div>
  <div class="refsection">
 <a name="id-1.25"></a><h2>FILES</h2>
    <p><code class="filename">/etc/named.conf</code>
    </p>
  </div>
  <div class="refsection">
-<a name="id-1.26"></a><h2>SEE ALSO</h2>
+<a name="id-1.25"></a><h2>SEE ALSO</h2>
    <p><span class="citerefentry">
 	<span class="refentrytitle">ddns-confgen</span>(8)
@@ -49,7 +49,6 @@
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -241,8 +241,6 @@ init_desc(void) {
 	SET_NSSTATDESC(invalidsig, "requests with invalid signature",
 		       "ReqBadSIG");
 	SET_NSSTATDESC(requesttcp, "TCP requests received", "ReqTCP");
 	SET_NSSTATDESC(tcphighwater, "TCP connection high-water",
 		       "TCPConnHighWater");
 	SET_NSSTATDESC(authrej, "auth queries rejected", "AuthQryRej");
 	SET_NSSTATDESC(recurserej, "recursive queries rejected", "RecQryRej");
 	SET_NSSTATDESC(xfrrej, "transfer requests rejected", "XfrRej");
@@ -324,10 +322,6 @@ init_desc(void) {
 		       "QryUsedStale");
 	SET_NSSTATDESC(prefetch, "queries triggered prefetch", "Prefetch");
 	SET_NSSTATDESC(keytagopt, "Keytag option received", "KeyTagOpt");
 	SET_NSSTATDESC(reclimitdropped,
 		       "queries dropped due to recursive client limit",
 		       "RecLimitDropped");
 	INSIST(i == ns_statscounter_max);
 	/* Initialize resolver statistics */
@@ -85,7 +85,7 @@ named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 		RETERR(dns_name_fromtext(name, &b, dns_rootname, 0, NULL));
 		tctx->domain = isc_mem_get(mctx, sizeof(dns_name_t));
 		dns_name_init(tctx->domain, NULL);
-		dns_name_dup(name, mctx, tctx->domain);
+		RETERR(dns_name_dup(name, mctx, tctx->domain));
 	}
 	obj = NULL;
@@ -114,3 +114,4 @@ named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 	dns_tkeyctx_destroy(&tctx);
 	return (result);
 }
@@ -225,7 +225,9 @@ dlopen_dlz_create(const char *dlzname, unsigned int argc, char *argv[],
 		return (ISC_R_FAILURE);
 	}
-	isc_mem_create(&mctx);
+	result = isc_mem_create(0, 0, &mctx);
 	if (result != ISC_R_SUCCESS)
 		return (result);
 	cd = isc_mem_get(mctx, sizeof(*cd));
 	memset(cd, 0, sizeof(*cd));
@@ -224,7 +224,7 @@ dlopen_dlz_create(const char *dlzname, unsigned int argc, char *argv[],
 		return (ISC_R_FAILURE);
 	}
-	isc_mem_create(&mctx);
+	isc_mem_create(0, 0, &mctx);
 	cd = isc_mem_get(mctx, sizeof(*cd));
 	memset(cd, 0, sizeof(*cd));
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <ItemGroup Label="ProjectConfigurations">
    <ProjectConfiguration Include="Debug|@PLATFORM@">
      <Configuration>Debug</Configuration>
@@ -14,21 +14,18 @@
    <ProjectGuid>{723C65DA-A96C-4BA3-A34E-44F11CA346F9}</ProjectGuid>
    <Keyword>Win32Proj</Keyword>
    <RootNamespace>named</RootNamespace>
    @WINDOWS_TARGET_PLATFORM_VERSION@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>true</UseDebugLibraries>
    <CharacterSet>MultiByte</CharacterSet>
    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>false</UseDebugLibraries>
    <WholeProgramOptimization>true</WholeProgramOptimization>
    <CharacterSet>MultiByte</CharacterSet>
    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
  <ImportGroup Label="ExtensionSettings">
--- a/Show More
+++ b/Show More