3306.   [bug]           Improve DNS64 reverse zone performance. [RT #28563]

3305.   [func]          Add wire format lookup method to sdb. [RT #28563]

3265.   [bug]           Address lock order reversal with inline-signing
                        support. [27557]

3265.   [bug]           Address lock order reversal with inline-signing
                        support. [27557]

3264.   [bug]           Automatic regeneration of signatures in an
                        inline-signing zone could stall when the server
                        was restarted. [RT #27344]

3263.   [bug]           "rndc sync" did not affect the unsigned side of an
                        inline-signing zone. [RT #27337]

3262.   [bug]           Signed responses were handled incorrectly by RPZ.
                        [RT #27316]

3252.   [bug]           When master zones using inline-signing were
                        updated while the server was offline, the source
                        zone could fall out of sync with the signed
                        copy. They can now resynchronize. [RT #26676]

3246.   [bug]           Named failed to start with a empty also-notify list.
                        [RT #27087]

3243.   [port]          freebsd,netbsd,bsdi: the thread defaults were not
                        being properly set.

3236.   [bug]           Backed out changes #3182 and #3202, related to
                        EDNS(0) fallback behavior. [RT #26416]

3233.   [bug]           'rndc freeze/thaw' didn't work for inline zones.
                        [RT #26632]

3105.   [bug]           GOST support can be suppressed by "configure
                        --without-gost" [RT #24367]

3103.   [bug]           Configuring 'dnssec-validation auto' in a view
                        instead of in the options statement could trigger
                        an assertion failure in named-checkconf. [RT #24382]

3100.   [security]      Certain response policy zone configurations could
                        trigger an INSIST when receiving a query of type
                        RRSIG. [RT #24280]

2988.	[experimental]	Added a "dlopen" DLZ driver, allowing the creation
			of external DLZ drivers that can be loaded as
			shared objects at runtime rather than linked with
			named.  Currently this is switched on via a
			compile-time option, "configure --with-dlz-dlopen".
			Note: the syntax for configuring DLZ zones
			is likely to be refined in future releases.
			(Contributed by Andrew Tridgell of the Samba
			project.) [RT #22629]

3000.	[bug]		More TKEY/GSS fixes:
			 - nsupdate can now get the default realm from
			   the user's Kerberos principal
			 - corrected gsstest compilation flags
			 - improved documentation
			 - fixed some NULL dereferences
			[RT #22795]

3003.	[experimental]	Added update-policy match type "external",
			enabling named to defer the decision of whether to
			allow a dynamic update to an external daemon.
			(Contributed by Andrew Tridgell.) [RT #22758]


2991.	[contrib]	contrib/zone-edit.sh: A simple zone editing tool for
			dynamic zones. [RT #22365]

2992.	[contrib]	contrib/check-secure-delegation.pl:  A simple tool
			for looking at a secure delegation. [RT #22059]

3005.	[port]		Solaris: Work around the lack of
			gsskrb5_register_acceptor_identity() by setting
			the KRB5_KTNAME environment variable to the
			contents of tkey-gssapi-keytab.  Also fixed
			test errors on MacOSX.  [RT #22853]

2948.	[port]		MacOS: provide a mechanism to configure the test
			interfaces at reboot. See bin/tests/system/README
			for details.

3013.	[bug]		The DNS64 ttl was not always being set as expected.
			[RT #23034]

3022.	[bug]		Fixed rpz SERVFAILs after failed zone transfers
                        [RT #23246]

3038.	[bug]		Install <dns/rpz.h>.  [RT #23342]

3045.	[removed]	Replaced by change #3050.

3054.	[bug]		Added elliptic curve support check in
			GOST OpenSSL engine detection. [RT #23485]

3072.	[bug]		dns_dns64_aaaaok() potential NULL pointer dereference.
			[RT #20256]

3082.	[port]		strtok_r is threads only. [RT #23747]

3087.	[bug]		DDNS updates using SIG(0) with update-policy match
			type "external" could cause a crash. [RT #23735]

3093.	[bug]		Fix gssapi/kerberos dependencies [RT #23836]

3094.	[doc]		Expand dns64 documentation.

3096.	[bug]		Set KRB5_KTNAME before calling log_cred() in
			dst_gssapi_acceptctx(). [RT #24004]