diff --git a/.github/workflows/analysis_ports.yml b/.github/workflows/analysis_ports.yml
index d71875076..f843eeb5e 100644
--- a/.github/workflows/analysis_ports.yml
+++ b/.github/workflows/analysis_ports.yml
@@ -31,12 +31,12 @@ jobs:
             clang_analysis: "yes"
           - name: OS X
             os: macos-latest
-            install_expat: "no"
+            install_expat: "yes"
             config: "--enable-debug --disable-flto --with-ssl=/opt/homebrew/opt/openssl --with-libexpat=/opt/homebrew/opt/expat"
             make_test: "yes"
           - name: Clang on OS X
             os: macos-latest
-            install_expat: "no"
+            install_expat: "yes"
             config: "CC=clang --enable-debug --disable-flto --with-ssl=/opt/homebrew/opt/openssl --with-libexpat=/opt/homebrew/opt/expat --disable-static"
             make_test: "yes"
             clang_analysis: "yes"
diff --git a/Makefile.in b/Makefile.in
index 6a95a3094..1fd4126cf 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -139,7 +139,7 @@ validator/val_sigcrypt.c validator/val_utils.c dns64/dns64.c \
 edns-subnet/edns-subnet.c edns-subnet/subnetmod.c \
 edns-subnet/addrtree.c edns-subnet/subnet-whitelist.c \
 $(CACHEDB_SRC) respip/respip.c $(CHECKLOCK_SRC) \
-$(DNSTAP_SRC) $(DNSCRYPT_SRC) $(IPSECMOD_SRC) $(IPSET_SRC) util/tsig.c
+$(DNSTAP_SRC) $(DNSCRYPT_SRC) $(IPSECMOD_SRC) $(IPSET_SRC)
 COMMON_OBJ_WITHOUT_NETCALL=dns.lo infra.lo rrset.lo dname.lo msgencode.lo \
 as112.lo msgparse.lo msgreply.lo packed_rrset.lo iterator.lo iter_delegpt.lo \
 iter_donotq.lo iter_fwd.lo iter_hints.lo iter_priv.lo iter_resptype.lo \
@@ -736,11 +736,11 @@ infra.lo infra.o: $(srcdir)/services/cache/infra.c config.h $(srcdir)/sldns/rrde
  $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/wire2str.h $(srcdir)/services/cache/infra.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/storage/dnstree.h \
  $(srcdir)/util/rbtree.h $(srcdir)/util/rtt.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-  $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/util/storage/slabhash.h $(srcdir)/util/storage/lookup3.h $(srcdir)/util/data/dname.h \
- $(srcdir)/util/net_help.h $(srcdir)/util/random.h $(srcdir)/util/config_file.h $(srcdir)/iterator/iterator.h \
- $(srcdir)/services/outbound_list.h $(srcdir)/util/module.h $(srcdir)/util/data/msgparse.h \
- $(srcdir)/sldns/pkthdr.h
+  $(srcdir)/dnscrypt/cert.h \
+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/slabhash.h \
+ $(srcdir)/util/storage/lookup3.h $(srcdir)/util/data/dname.h $(srcdir)/util/net_help.h $(srcdir)/util/random.h \
+ $(srcdir)/util/config_file.h $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h \
+ $(srcdir)/util/module.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h
 rrset.lo rrset.o: $(srcdir)/services/cache/rrset.c config.h $(srcdir)/services/cache/rrset.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/storage/slabhash.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/config_file.h \
@@ -761,21 +761,21 @@ msgparse.lo msgparse.o: $(srcdir)/util/data/msgparse.c config.h $(srcdir)/util/c
  $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgparse.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
  $(srcdir)/util/log.h $(srcdir)/sldns/pkthdr.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
  $(srcdir)/util/data/dname.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-  $(srcdir)/util/storage/lookup3.h $(srcdir)/util/regional.h \
- $(srcdir)/util/rfc_1982.h $(srcdir)/util/edns.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h \
- $(srcdir)/util/net_help.h $(srcdir)/util/random.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/parseutil.h \
- $(srcdir)/sldns/wire2str.h
+  $(srcdir)/dnscrypt/cert.h \
+ $(srcdir)/util/storage/lookup3.h $(srcdir)/util/regional.h $(srcdir)/util/rfc_1982.h $(srcdir)/util/edns.h \
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/util/net_help.h $(srcdir)/util/random.h \
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/wire2str.h
 msgreply.lo msgreply.o: $(srcdir)/util/data/msgreply.c config.h $(srcdir)/util/data/msgreply.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/packed_rrset.h \
  $(srcdir)/sldns/rrdef.h $(srcdir)/util/storage/lookup3.h $(srcdir)/util/alloc.h $(srcdir)/util/netevent.h \
- $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/util/net_help.h \
- $(srcdir)/util/random.h $(srcdir)/util/data/dname.h $(srcdir)/util/regional.h $(srcdir)/util/data/msgparse.h \
- $(srcdir)/sldns/pkthdr.h $(srcdir)/util/data/msgencode.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/wire2str.h \
- $(srcdir)/util/module.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h \
- $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
- $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/util/config_file.h \
- $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h \
- $(srcdir)/respip/respip.h
+ $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/dnscrypt/cert.h \
+ $(srcdir)/util/net_help.h $(srcdir)/util/random.h $(srcdir)/util/data/dname.h $(srcdir)/util/regional.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/util/data/msgencode.h \
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/wire2str.h $(srcdir)/util/module.h $(srcdir)/util/fptr_wlist.h \
+ $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h \
+ $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h \
+ $(srcdir)/services/view.h $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h \
+ $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h
 packed_rrset.lo packed_rrset.o: $(srcdir)/util/data/packed_rrset.c config.h $(srcdir)/util/data/msgparse.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/sldns/pkthdr.h \
  $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/dname.h \
@@ -791,6 +791,7 @@ iterator.lo iterator.o: $(srcdir)/iterator/iterator.c config.h $(srcdir)/iterato
  $(srcdir)/validator/val_neg.h $(srcdir)/services/cache/dns.h $(srcdir)/services/cache/rrset.h \
  $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
  $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
+ $(srcdir)/dnscrypt/cert.h \
  $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h \
  $(srcdir)/services/localzone.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h \
  $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h \
@@ -840,19 +841,20 @@ iter_utils.lo iter_utils.o: $(srcdir)/iterator/iter_utils.c config.h $(srcdir)/i
  $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/iterator/iter_fwd.h \
  $(srcdir)/iterator/iter_donotq.h $(srcdir)/iterator/iter_delegpt.h $(srcdir)/iterator/iter_priv.h \
  $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-  $(srcdir)/services/cache/dns.h $(srcdir)/services/cache/rrset.h \
- $(srcdir)/util/storage/slabhash.h $(srcdir)/services/outside_network.h $(srcdir)/util/alloc.h \
- $(srcdir)/util/regional.h  $(srcdir)/util/net_help.h $(srcdir)/util/random.h \
- $(srcdir)/util/config_file.h $(srcdir)/util/data/dname.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h \
- $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
- $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h \
- $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h \
- $(srcdir)/validator/val_anchor.h $(srcdir)/validator/val_kcache.h $(srcdir)/validator/val_kentry.h \
- $(srcdir)/validator/val_utils.h $(srcdir)/validator/val_sigcrypt.h $(srcdir)/sldns/str2wire.h
+  $(srcdir)/dnscrypt/cert.h \
+ $(srcdir)/services/cache/dns.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
+ $(srcdir)/services/outside_network.h $(srcdir)/util/alloc.h $(srcdir)/util/regional.h \
+  $(srcdir)/util/net_help.h $(srcdir)/util/random.h $(srcdir)/util/config_file.h \
+ $(srcdir)/util/data/dname.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h \
+ $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/services/view.h \
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
+ $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/validator/val_anchor.h \
+ $(srcdir)/validator/val_kcache.h $(srcdir)/validator/val_kentry.h $(srcdir)/validator/val_utils.h \
+ $(srcdir)/validator/val_sigcrypt.h $(srcdir)/sldns/str2wire.h
 listen_dnsport.lo listen_dnsport.o: $(srcdir)/services/listen_dnsport.c config.h \
  $(srcdir)/services/listen_dnsport.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-  $(srcdir)/util/rbtree.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
- $(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h \
+  $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
+ $(srcdir)/util/rbtree.h $(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h \
  $(srcdir)/services/outside_network.h $(srcdir)/util/alloc.h $(srcdir)/util/regional.h \
   $(srcdir)/util/config_file.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/net_help.h \
  $(srcdir)/util/random.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/wire2str.h \
@@ -861,7 +863,8 @@ listen_dnsport.lo listen_dnsport.o: $(srcdir)/services/listen_dnsport.c config.h
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h \
  $(srcdir)/services/localzone.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
  $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h \
- $(srcdir)/util/timeval_func.h
+ $(srcdir)/util/timeval_func.h \
+ 
 localzone.lo localzone.o: $(srcdir)/services/localzone.c config.h $(srcdir)/services/localzone.h \
  $(srcdir)/util/rbtree.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/storage/dnstree.h \
  $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/data/msgreply.h \
@@ -869,33 +872,39 @@ localzone.lo localzone.o: $(srcdir)/services/localzone.c config.h $(srcdir)/serv
  $(srcdir)/sldns/pkthdr.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/str2wire.h \
  $(srcdir)/util/regional.h $(srcdir)/util/config_file.h $(srcdir)/util/data/dname.h \
  $(srcdir)/util/data/msgencode.h $(srcdir)/util/net_help.h $(srcdir)/util/random.h $(srcdir)/util/netevent.h \
- $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/util/as112.h
+ $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/dnscrypt/cert.h \
+ $(srcdir)/util/as112.h
 mesh.lo mesh.o: $(srcdir)/services/mesh.c config.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
  $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
- $(srcdir)/util/data/msgparse.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
- $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
- $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h \
- $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h \
- $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h \
- $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h \
- $(srcdir)/services/outbound_list.h $(srcdir)/services/outside_network.h $(srcdir)/util/alloc.h \
- $(srcdir)/util/regional.h  $(srcdir)/services/cache/dns.h \
- $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h \
- $(srcdir)/util/rtt.h $(srcdir)/util/net_help.h $(srcdir)/util/random.h $(srcdir)/util/data/msgencode.h \
- $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/util/edns.h $(srcdir)/sldns/wire2str.h \
- $(srcdir)/util/data/dname.h $(srcdir)/services/listen_dnsport.h $(srcdir)/daemon/acl_list.h \
- $(srcdir)/util/timeval_func.h
+ $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/util/storage/lruhash.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
+ $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
+ $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
+ $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/services/outbound_list.h \
+ $(srcdir)/services/cache/dns.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
+ $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h $(srcdir)/util/net_help.h $(srcdir)/util/random.h \
+ $(srcdir)/util/regional.h $(srcdir)/util/data/msgencode.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h \
+ $(srcdir)/util/alloc.h $(srcdir)/util/edns.h $(srcdir)/sldns/wire2str.h $(srcdir)/util/data/dname.h \
+ $(srcdir)/services/listen_dnsport.h $(srcdir)/daemon/acl_list.h \
+ $(srcdir)/util/timeval_func.h $(srcdir)/edns-subnet/subnetmod.h $(srcdir)/edns-subnet/addrtree.h \
+ $(srcdir)/edns-subnet/edns-subnet.h
 modstack.lo modstack.o: $(srcdir)/services/modstack.c config.h $(srcdir)/services/modstack.h \
  $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/sldns/rrdef.h \
  $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h \
- $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/util/tube.h \
- $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
- $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h \
- $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
- $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/dns64/dns64.h $(srcdir)/iterator/iterator.h \
- $(srcdir)/services/outbound_list.h $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h \
- $(srcdir)/validator/val_nsec3.h
+ $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/dnscrypt/cert.h \
+ $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/rpz.h \
+ $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h \
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h \
+ $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/dns64/dns64.h \
+ $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/validator/validator.h \
+ $(srcdir)/validator/val_utils.h $(srcdir)/validator/val_nsec3.h $(PYTHONMOD_HEADER) \
+ $(DYNLIBMOD_HEADER) $(srcdir)/cachedb/cachedb.h $(srcdir)/ipsecmod/ipsecmod.h \
+ $(srcdir)/edns-subnet/subnetmod.h $(srcdir)/util/alloc.h $(srcdir)/util/net_help.h $(srcdir)/util/random.h \
+ $(srcdir)/util/storage/slabhash.h $(srcdir)/util/data/dname.h $(srcdir)/edns-subnet/addrtree.h \
+ $(srcdir)/edns-subnet/edns-subnet.h $(srcdir)/ipset/ipset.h
 view.lo view.o: $(srcdir)/services/view.c config.h $(srcdir)/services/view.h $(srcdir)/util/rbtree.h \
  $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h \
  $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/data/msgreply.h \
@@ -907,24 +916,26 @@ rpz.lo rpz.o: $(srcdir)/services/rpz.c config.h $(srcdir)/services/rpz.h $(srcdi
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgparse.h \
  $(srcdir)/sldns/pkthdr.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h \
  $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-  $(srcdir)/services/modstack.h $(srcdir)/libunbound/unbound.h \
- $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/respip/respip.h $(srcdir)/sldns/wire2str.h \
- $(srcdir)/sldns/str2wire.h $(srcdir)/util/data/dname.h $(srcdir)/util/net_help.h $(srcdir)/util/random.h \
- $(srcdir)/util/regional.h $(srcdir)/util/data/msgencode.h $(srcdir)/services/cache/dns.h \
- $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/iterator/iter_delegpt.h \
- $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/util/alloc.h $(srcdir)/dnstap/dnstap.h \
- 
+  $(srcdir)/dnscrypt/cert.h \
+ $(srcdir)/services/modstack.h $(srcdir)/libunbound/unbound.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
+ $(srcdir)/respip/respip.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h $(srcdir)/util/data/dname.h \
+ $(srcdir)/util/net_help.h $(srcdir)/util/random.h $(srcdir)/util/regional.h $(srcdir)/util/data/msgencode.h \
+ $(srcdir)/services/cache/dns.h $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h \
+ $(srcdir)/iterator/iter_delegpt.h $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/util/alloc.h \
+ $(srcdir)/dnstap/dnstap.h 
 rfc_1982.lo rfc_1982.o: $(srcdir)/util/rfc_1982.c config.h $(srcdir)/util/rfc_1982.h
 outbound_list.lo outbound_list.o: $(srcdir)/services/outbound_list.c config.h \
  $(srcdir)/services/outbound_list.h $(srcdir)/services/outside_network.h $(srcdir)/util/alloc.h \
  $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/rbtree.h $(srcdir)/util/regional.h $(srcdir)/util/netevent.h \
- $(srcdir)/dnscrypt/dnscrypt.h  
+ $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/dnscrypt/cert.h \
+ 
 outside_network.lo outside_network.o: $(srcdir)/services/outside_network.c config.h \
  $(srcdir)/services/outside_network.h $(srcdir)/util/alloc.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/rbtree.h $(srcdir)/util/regional.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-   \
- $(srcdir)/services/listen_dnsport.h $(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h \
- $(srcdir)/services/view.h $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/rtt.h \
+  $(srcdir)/dnscrypt/cert.h \
+  $(srcdir)/services/listen_dnsport.h $(srcdir)/daemon/acl_list.h \
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h \
+ $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/rtt.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/sldns/rrdef.h \
  $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/util/module.h \
  $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/util/data/msgencode.h \
@@ -932,29 +943,32 @@ outside_network.lo outside_network.o: $(srcdir)/services/outside_network.c confi
  $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h \
  $(srcdir)/services/localzone.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h \
  $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h \
- $(srcdir)/respip/respip.h $(srcdir)/util/edns.h $(srcdir)/dnstap/dnstap.h
+ $(srcdir)/respip/respip.h $(srcdir)/util/edns.h $(srcdir)/dnstap/dnstap.h \
+ 
 alloc.lo alloc.o: $(srcdir)/util/alloc.c config.h $(srcdir)/util/alloc.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/regional.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-  $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
- $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/util/tube.h \
- $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h \
- $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h \
- $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h \
- $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h
+  $(srcdir)/dnscrypt/cert.h \
+ $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgparse.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
+ $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
+ $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h
 config_file.lo config_file.o: $(srcdir)/util/config_file.c config.h $(srcdir)/util/log.h \
  $(srcdir)/util/configyyrename.h $(srcdir)/util/config_file.h $(srcdir)/sldns/rrdef.h \
  util/configparser.h $(srcdir)/util/net_help.h $(srcdir)/util/random.h $(srcdir)/util/data/msgparse.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/sldns/pkthdr.h $(srcdir)/util/module.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/regional.h \
  $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-  $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
- $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
- $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h \
- $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h \
- $(srcdir)/respip/respip.h $(srcdir)/util/data/dname.h $(srcdir)/util/rtt.h $(srcdir)/services/cache/infra.h \
- $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/parseutil.h $(srcdir)/iterator/iterator.h \
- $(srcdir)/services/outbound_list.h $(srcdir)/util/iana_ports.inc
+  $(srcdir)/dnscrypt/cert.h \
+ $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h \
+ $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h \
+ $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h \
+ $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/util/data/dname.h \
+ $(srcdir)/util/rtt.h $(srcdir)/services/cache/infra.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/parseutil.h \
+ $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/edns-subnet/edns-subnet.h \
+ $(srcdir)/util/iana_ports.inc
 configlexer.lo configlexer.o: util/configlexer.c config.h $(srcdir)/util/configyyrename.h \
  $(srcdir)/util/config_file.h $(srcdir)/sldns/rrdef.h util/configparser.h
 configparser.lo configparser.o: util/configparser.c config.h $(srcdir)/util/configyyrename.h \
@@ -966,37 +980,40 @@ shm_main.lo shm_main.o: $(srcdir)/util/shm_side/shm_main.c config.h $(srcdir)/ut
  $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h  \
   $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h \
  $(srcdir)/sldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
- $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h $(srcdir)/util/data/msgreply.h $(srcdir)/sldns/rrdef.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
- $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
- $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h \
- $(srcdir)/services/view.h $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/respip/respip.h \
- $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h \
- $(srcdir)/util/rtt.h $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h \
- $(srcdir)/validator/val_nsec3.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h
+ $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h $(srcdir)/dnscrypt/cert.h \
+ $(srcdir)/util/data/msgreply.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h \
+ $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/util/config_file.h \
+ $(srcdir)/services/authzone.h $(srcdir)/respip/respip.h $(srcdir)/services/cache/rrset.h \
+ $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
+ $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h $(srcdir)/validator/val_nsec3.h \
+ $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h
 authzone.lo authzone.o: $(srcdir)/services/authzone.c config.h $(srcdir)/services/authzone.h \
  $(srcdir)/util/rbtree.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/services/mesh.h $(srcdir)/util/netevent.h \
- $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/util/data/msgparse.h \
- $(srcdir)/util/storage/lruhash.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h \
- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/modstack.h \
- $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h \
- $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h $(srcdir)/daemon/stats.h \
- $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/util/data/dname.h \
- $(srcdir)/util/data/msgencode.h $(srcdir)/util/regional.h $(srcdir)/util/net_help.h $(srcdir)/util/random.h \
- $(srcdir)/services/cache/dns.h $(srcdir)/services/outside_network.h $(srcdir)/util/alloc.h \
-  $(srcdir)/services/listen_dnsport.h $(srcdir)/daemon/acl_list.h \
+ $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/dnscrypt/cert.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/util/storage/lruhash.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
+ $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
+ $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/util/config_file.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h \
+ $(srcdir)/respip/respip.h $(srcdir)/util/data/dname.h $(srcdir)/util/data/msgencode.h $(srcdir)/util/regional.h \
+ $(srcdir)/util/net_help.h $(srcdir)/util/random.h $(srcdir)/util/tsig.h $(srcdir)/services/cache/dns.h \
+ $(srcdir)/services/outside_network.h $(srcdir)/util/alloc.h  \
+ $(srcdir)/services/listen_dnsport.h $(srcdir)/daemon/acl_list.h \
  $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/keyraw.h \
  $(srcdir)/validator/val_nsec3.h $(srcdir)/validator/val_nsec.h $(srcdir)/validator/val_secalgo.h \
  $(srcdir)/validator/val_sigcrypt.h $(srcdir)/validator/val_anchor.h $(srcdir)/validator/val_utils.h
 fptr_wlist.lo fptr_wlist.o: $(srcdir)/util/fptr_wlist.c config.h $(srcdir)/util/fptr_wlist.h \
  $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/module.h \
- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/sldns/rrdef.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h \
- $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
+ $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgparse.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
+ $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
  $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h \
  $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
- $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/util/mini_event.h $(srcdir)/util/rbtree.h \
+ $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/util/mini_event.h \
  $(srcdir)/services/outside_network.h $(srcdir)/util/alloc.h $(srcdir)/util/regional.h \
   $(srcdir)/services/listen_dnsport.h $(srcdir)/daemon/acl_list.h \
  $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h $(srcdir)/services/cache/rrset.h \
@@ -1006,47 +1023,46 @@ fptr_wlist.lo fptr_wlist.o: $(srcdir)/util/fptr_wlist.c config.h $(srcdir)/util/
  $(srcdir)/validator/val_sigcrypt.h $(srcdir)/validator/val_kentry.h $(srcdir)/validator/val_neg.h \
  $(srcdir)/validator/autotrust.h $(srcdir)/libunbound/libworker.h $(srcdir)/libunbound/context.h \
  $(srcdir)/libunbound/unbound-event.h $(srcdir)/libunbound/worker.h $(srcdir)/util/tsig.h \
- $(srcdir)/daemon/remote.h
+ $(srcdir)/daemon/remote.h \
+ $(PYTHONMOD_HEADER) $(DYNLIBMOD_HEADER) $(srcdir)/cachedb/cachedb.h \
+ $(srcdir)/ipsecmod/ipsecmod.h $(srcdir)/edns-subnet/subnetmod.h $(srcdir)/util/net_help.h \
+ $(srcdir)/util/random.h $(srcdir)/util/data/dname.h $(srcdir)/edns-subnet/addrtree.h \
+ $(srcdir)/edns-subnet/edns-subnet.h $(srcdir)/ipset/ipset.h $(srcdir)/dnstap/dtstream.h
 locks.lo locks.o: $(srcdir)/util/locks.c config.h $(srcdir)/util/locks.h $(srcdir)/util/log.h
 log.lo log.o: $(srcdir)/util/log.c config.h $(srcdir)/util/log.h $(srcdir)/util/locks.h $(srcdir)/sldns/sbuffer.h
-mini_event.lo mini_event.o: $(srcdir)/util/mini_event.c config.h $(srcdir)/util/mini_event.h $(srcdir)/util/rbtree.h \
- $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
- $(srcdir)/util/log.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/util/tube.h \
- $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h \
- $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h \
- $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h \
- $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h
+mini_event.lo mini_event.o: $(srcdir)/util/mini_event.c config.h $(srcdir)/util/mini_event.h
 module.lo module.o: $(srcdir)/util/module.c config.h $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
  $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/wire2str.h \
  $(srcdir)/util/config_file.h $(srcdir)/util/regional.h $(srcdir)/util/data/dname.h $(srcdir)/util/net_help.h \
  $(srcdir)/util/random.h
 netevent.lo netevent.o: $(srcdir)/util/netevent.c config.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-  $(srcdir)/util/ub_event.h $(srcdir)/util/log.h $(srcdir)/util/net_help.h \
- $(srcdir)/util/random.h $(srcdir)/util/tcp_conn_limit.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h \
- $(srcdir)/util/locks.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/module.h \
- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/sldns/rrdef.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h \
- $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/services/view.h \
- $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h \
- $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h \
- $(srcdir)/util/proxy_protocol.h $(srcdir)/util/timeval_func.h $(srcdir)/sldns/str2wire.h \
- $(srcdir)/dnstap/dnstap.h  $(srcdir)/services/listen_dnsport.h \
- $(srcdir)/daemon/acl_list.h
+  $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
+ $(srcdir)/util/ub_event.h $(srcdir)/util/net_help.h $(srcdir)/util/random.h $(srcdir)/util/tcp_conn_limit.h \
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/util/fptr_wlist.h \
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgparse.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h \
+ $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
+ $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/util/proxy_protocol.h \
+ $(srcdir)/util/timeval_func.h $(srcdir)/sldns/str2wire.h $(srcdir)/dnstap/dnstap.h \
+  $(srcdir)/services/listen_dnsport.h $(srcdir)/daemon/acl_list.h \
+ 
 net_help.lo net_help.o: $(srcdir)/util/net_help.c config.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h \
  $(srcdir)/util/random.h $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
  $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
  $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/util/regional.h \
- $(srcdir)/util/config_file.h $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h
+ $(srcdir)/util/config_file.h $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h \
+ 
 random.lo random.o: $(srcdir)/util/random.c config.h $(srcdir)/util/random.h $(srcdir)/util/log.h
 rbtree.lo rbtree.o: $(srcdir)/util/rbtree.c config.h $(srcdir)/util/log.h $(srcdir)/util/fptr_wlist.h \
  $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/module.h \
- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/sldns/rrdef.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h \
- $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
+ $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgparse.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
+ $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
  $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h \
  $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
  $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h
@@ -1059,6 +1075,7 @@ siphash.lo siphash.o: $(srcdir)/util/siphash.c config.h $(srcdir)/util/siphash.h
 edns.lo edns.o: $(srcdir)/util/edns.c config.h $(srcdir)/util/edns.h $(srcdir)/util/storage/dnstree.h \
  $(srcdir)/util/rbtree.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/config_file.h $(srcdir)/sldns/rrdef.h \
  $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
+ $(srcdir)/dnscrypt/cert.h \
  $(srcdir)/util/net_help.h $(srcdir)/util/random.h $(srcdir)/util/regional.h $(srcdir)/util/rfc_1982.h \
  $(srcdir)/util/siphash.h $(srcdir)/util/data/msgparse.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/sldns/pkthdr.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
@@ -1069,13 +1086,13 @@ dnstree.lo dnstree.o: $(srcdir)/util/storage/dnstree.c config.h $(srcdir)/util/s
 lookup3.lo lookup3.o: $(srcdir)/util/storage/lookup3.c config.h $(srcdir)/util/storage/lookup3.h
 lruhash.lo lruhash.o: $(srcdir)/util/storage/lruhash.c config.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h \
- $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/util/module.h \
- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/sldns/rrdef.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h \
- $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
- $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h \
- $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
- $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h
+ $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/dnscrypt/cert.h \
+ $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/util/tube.h \
+ $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h \
+ $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h \
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h \
+ $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h
 slabhash.lo slabhash.o: $(srcdir)/util/storage/slabhash.c config.h $(srcdir)/util/storage/slabhash.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h
 tcp_conn_limit.lo tcp_conn_limit.o: $(srcdir)/util/tcp_conn_limit.c config.h $(srcdir)/util/regional.h \
@@ -1090,13 +1107,15 @@ tsig.lo tsig.o: $(srcdir)/util/tsig.c config.h $(srcdir)/util/tsig.h $(srcdir)/u
  $(srcdir)/util/rbtree.h $(srcdir)/util/config_file.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/net_help.h \
  $(srcdir)/util/random.h $(srcdir)/util/regional.h $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/pkthdr.h \
  $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/str2wire.h $(srcdir)/util/data/msgparse.h \
- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/data/dname.h
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/data/dname.h \
+ 
 tube.lo tube.o: $(srcdir)/util/tube.c config.h $(srcdir)/util/tube.h $(srcdir)/util/log.h $(srcdir)/util/net_help.h \
  $(srcdir)/util/random.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-  $(srcdir)/util/fptr_wlist.h $(srcdir)/util/storage/lruhash.h \
- $(srcdir)/util/locks.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/services/mesh.h \
- $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
+  $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h \
+ $(srcdir)/util/fptr_wlist.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/module.h \
+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/sldns/rrdef.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
+ $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
  $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h \
  $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
  $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/util/ub_event.h
@@ -1104,17 +1123,19 @@ proxy_protocol.lo proxy_protocol.o: $(srcdir)/util/proxy_protocol.c $(srcdir)/ut
 timeval_func.lo timeval_func.o: $(srcdir)/util/timeval_func.c config.h $(srcdir)/util/timeval_func.h
 ub_event.lo ub_event.o: $(srcdir)/util/ub_event.c config.h $(srcdir)/util/ub_event.h $(srcdir)/util/log.h \
  $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
- $(srcdir)/util/tube.h $(srcdir)/daemon/remote.h $(srcdir)/util/locks.h $(srcdir)/util/mini_event.h $(srcdir)/util/rbtree.h
+ $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h \
+ $(srcdir)/util/tube.h $(srcdir)/daemon/remote.h \
+ $(srcdir)/dnstap/dtstream.h
 ub_event_pluggable.lo ub_event_pluggable.o: $(srcdir)/util/ub_event_pluggable.c config.h $(srcdir)/util/ub_event.h \
  $(srcdir)/libunbound/unbound-event.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-  $(srcdir)/util/log.h $(srcdir)/util/fptr_wlist.h \
- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
- $(srcdir)/util/data/packed_rrset.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgparse.h \
- $(srcdir)/sldns/pkthdr.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
- $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
+  $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
+ $(srcdir)/util/fptr_wlist.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/module.h \
+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/sldns/rrdef.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h \
+ $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
  $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h \
  $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
- $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/util/mini_event.h $(srcdir)/util/rbtree.h
+ $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h
 winsock_event.lo winsock_event.o: $(srcdir)/util/winsock_event.c config.h
 autotrust.lo autotrust.o: $(srcdir)/validator/autotrust.c config.h $(srcdir)/validator/autotrust.h \
  $(srcdir)/util/rbtree.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
@@ -1123,11 +1144,13 @@ autotrust.lo autotrust.o: $(srcdir)/validator/autotrust.c config.h $(srcdir)/val
  $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/util/net_help.h \
  $(srcdir)/util/random.h $(srcdir)/util/config_file.h $(srcdir)/util/regional.h $(srcdir)/services/mesh.h \
  $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
+ $(srcdir)/dnscrypt/cert.h \
  $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
  $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h \
  $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h \
  $(srcdir)/respip/respip.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
- $(srcdir)/validator/val_kcache.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/keyraw.h
+ $(srcdir)/validator/val_kcache.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/keyraw.h \
+ 
 val_anchor.lo val_anchor.o: $(srcdir)/validator/val_anchor.c config.h $(srcdir)/validator/val_anchor.h \
  $(srcdir)/util/rbtree.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/validator/val_sigcrypt.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/sldns/pkthdr.h \
@@ -1144,11 +1167,11 @@ validator.lo validator.o: $(srcdir)/validator/validator.c config.h $(srcdir)/val
  $(srcdir)/validator/autotrust.h $(srcdir)/services/cache/dns.h $(srcdir)/services/cache/rrset.h \
  $(srcdir)/util/data/dname.h $(srcdir)/util/net_help.h $(srcdir)/util/random.h $(srcdir)/util/regional.h \
  $(srcdir)/util/config_file.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-  $(srcdir)/util/tube.h $(srcdir)/services/mesh.h \
- $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
- $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h \
- $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h \
- $(srcdir)/respip/respip.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h
+  $(srcdir)/dnscrypt/cert.h \
+ $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h \
+ $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h \
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
+ $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h
 val_kcache.lo val_kcache.o: $(srcdir)/validator/val_kcache.c config.h $(srcdir)/validator/val_kcache.h \
  $(srcdir)/util/storage/slabhash.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/validator/val_kentry.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/config_file.h \
@@ -1157,14 +1180,15 @@ val_kcache.lo val_kcache.o: $(srcdir)/validator/val_kcache.c config.h $(srcdir)/
 val_kentry.lo val_kentry.o: $(srcdir)/validator/val_kentry.c config.h $(srcdir)/validator/val_kentry.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/sldns/rrdef.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lookup3.h \
- $(srcdir)/util/regional.h $(srcdir)/util/net_help.h $(srcdir)/util/random.h $(srcdir)/sldns/keyraw.h
-val_neg.lo val_neg.o: $(srcdir)/validator/val_neg.c config.h $(srcdir)/validator/val_neg.h $(srcdir)/util/locks.h \
- $(srcdir)/util/log.h $(srcdir)/util/rbtree.h $(srcdir)/validator/val_nsec.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/util/storage/lruhash.h $(srcdir)/sldns/rrdef.h $(srcdir)/validator/val_nsec3.h \
- $(srcdir)/validator/val_utils.h $(srcdir)/sldns/pkthdr.h $(srcdir)/util/data/dname.h \
- $(srcdir)/util/data/msgreply.h $(srcdir)/util/net_help.h $(srcdir)/util/random.h $(srcdir)/util/config_file.h \
- $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/dns.h \
- $(srcdir)/sldns/sbuffer.h
+ $(srcdir)/util/regional.h $(srcdir)/util/net_help.h $(srcdir)/util/random.h $(srcdir)/sldns/keyraw.h \
+ 
+val_neg.lo val_neg.o: $(srcdir)/validator/val_neg.c config.h \
+ $(srcdir)/validator/val_neg.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/rbtree.h \
+ $(srcdir)/validator/val_nsec.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/validator/val_nsec3.h $(srcdir)/validator/val_utils.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/util/data/dname.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/net_help.h $(srcdir)/util/random.h \
+ $(srcdir)/util/config_file.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
+ $(srcdir)/services/cache/dns.h $(srcdir)/sldns/sbuffer.h
 val_nsec3.lo val_nsec3.o: $(srcdir)/validator/val_nsec3.c config.h $(srcdir)/validator/val_nsec3.h \
  $(srcdir)/util/rbtree.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/sldns/rrdef.h $(srcdir)/validator/val_secalgo.h \
@@ -1181,7 +1205,8 @@ val_nsec.lo val_nsec.o: $(srcdir)/validator/val_nsec.c config.h $(srcdir)/valida
 val_secalgo.lo val_secalgo.o: $(srcdir)/validator/val_secalgo.c config.h $(srcdir)/util/data/packed_rrset.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/validator/val_secalgo.h \
  $(srcdir)/validator/val_nsec3.h $(srcdir)/util/rbtree.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/keyraw.h \
- $(srcdir)/sldns/sbuffer.h
+ $(srcdir)/sldns/sbuffer.h \
+ 
 val_sigcrypt.lo val_sigcrypt.o: $(srcdir)/validator/val_sigcrypt.c config.h \
  $(srcdir)/validator/val_sigcrypt.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
@@ -1189,12 +1214,14 @@ val_sigcrypt.lo val_sigcrypt.o: $(srcdir)/validator/val_sigcrypt.c config.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/validator/val_utils.h \
  $(srcdir)/validator/val_nsec3.h $(srcdir)/util/rbtree.h $(srcdir)/util/data/dname.h $(srcdir)/util/rfc_1982.h \
  $(srcdir)/util/net_help.h $(srcdir)/util/random.h $(srcdir)/util/regional.h $(srcdir)/util/config_file.h \
- $(srcdir)/sldns/keyraw.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/wire2str.h \
- $(srcdir)/services/mesh.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-  $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h \
- $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h \
- $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h \
- $(srcdir)/respip/respip.h
+ $(srcdir)/sldns/keyraw.h \
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/wire2str.h $(srcdir)/services/mesh.h \
+ $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
+ $(srcdir)/dnscrypt/cert.h \
+ $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/services/authzone.h \
+ $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h \
+ 
 val_utils.lo val_utils.o: $(srcdir)/validator/val_utils.c config.h $(srcdir)/validator/val_utils.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/validator/validator.h $(srcdir)/util/module.h \
@@ -1210,47 +1237,124 @@ dns64.lo dns64.o: $(srcdir)/dns64/dns64.c config.h $(srcdir)/dns64/dns64.h $(src
  $(srcdir)/sldns/pkthdr.h $(srcdir)/services/cache/dns.h $(srcdir)/services/cache/rrset.h \
  $(srcdir)/util/storage/slabhash.h $(srcdir)/util/config_file.h $(srcdir)/util/fptr_wlist.h \
  $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
+ $(srcdir)/dnscrypt/cert.h \
  $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h \
  $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h \
  $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h \
  $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/util/net_help.h \
  $(srcdir)/util/random.h $(srcdir)/util/regional.h $(srcdir)/util/data/dname.h $(srcdir)/sldns/str2wire.h
-edns-subnet.lo edns-subnet.o: $(srcdir)/edns-subnet/edns-subnet.c config.h
-subnetmod.lo subnetmod.o: $(srcdir)/edns-subnet/subnetmod.c config.h
+edns-subnet.lo edns-subnet.o: $(srcdir)/edns-subnet/edns-subnet.c config.h \
+ $(srcdir)/edns-subnet/edns-subnet.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h $(srcdir)/util/random.h
+subnetmod.lo subnetmod.o: $(srcdir)/edns-subnet/subnetmod.c config.h $(srcdir)/edns-subnet/subnetmod.h \
+ $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/sldns/rrdef.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/services/outbound_list.h \
+ $(srcdir)/util/alloc.h $(srcdir)/util/net_help.h $(srcdir)/util/random.h $(srcdir)/util/storage/slabhash.h \
+ $(srcdir)/util/data/dname.h $(srcdir)/edns-subnet/addrtree.h $(srcdir)/edns-subnet/edns-subnet.h \
+ $(srcdir)/edns-subnet/subnet-whitelist.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h \
+ $(srcdir)/services/mesh.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
+  $(srcdir)/dnscrypt/cert.h \
+ $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/services/view.h \
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h \
+ $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h \
+ $(srcdir)/services/cache/dns.h $(srcdir)/util/regional.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h \
+ $(srcdir)/sldns/wire2str.h $(srcdir)/iterator/iter_utils.h $(srcdir)/iterator/iter_resptype.h \
+ $(srcdir)/cachedb/cachedb.h
 addrtree.lo addrtree.o: $(srcdir)/edns-subnet/addrtree.c config.h $(srcdir)/util/log.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h \
  $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/edns-subnet/addrtree.h
-subnet-whitelist.lo subnet-whitelist.o: $(srcdir)/edns-subnet/subnet-whitelist.c config.h
+subnet-whitelist.lo subnet-whitelist.o: $(srcdir)/edns-subnet/subnet-whitelist.c config.h \
+ $(srcdir)/edns-subnet/edns-subnet.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h $(srcdir)/util/random.h \
+ $(srcdir)/edns-subnet/subnet-whitelist.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h \
+ $(srcdir)/util/regional.h $(srcdir)/util/config_file.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/str2wire.h \
+ $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h
+cachedb.lo cachedb.o: $(srcdir)/cachedb/cachedb.c config.h $(srcdir)/cachedb/cachedb.h $(srcdir)/util/module.h \
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/msgreply.h \
+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgparse.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/cachedb/redis.h $(srcdir)/util/regional.h $(srcdir)/util/net_help.h \
+ $(srcdir)/util/random.h $(srcdir)/util/config_file.h $(srcdir)/util/data/dname.h $(srcdir)/util/data/msgencode.h \
+ $(srcdir)/services/cache/dns.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/util/netevent.h \
+ $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/dnscrypt/cert.h \
+ $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h \
+ $(srcdir)/respip/respip.h $(srcdir)/validator/val_neg.h $(srcdir)/validator/val_secalgo.h \
+ $(srcdir)/iterator/iter_utils.h $(srcdir)/iterator/iter_resptype.h $(srcdir)/sldns/parseutil.h \
+ $(srcdir)/sldns/wire2str.h
+redis.lo redis.o: $(srcdir)/cachedb/redis.c config.h $(srcdir)/cachedb/redis.h $(srcdir)/cachedb/cachedb.h \
+ $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/sldns/rrdef.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/util/alloc.h $(srcdir)/util/config_file.h \
+ $(srcdir)/util/timeval_func.h $(srcdir)/sldns/sbuffer.h
 respip.lo respip.o: $(srcdir)/respip/respip.c config.h $(srcdir)/services/localzone.h $(srcdir)/util/rbtree.h \
  $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/module.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
  $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/services/view.h \
  $(srcdir)/sldns/sbuffer.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h $(srcdir)/util/netevent.h \
- $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/services/modstack.h \
- $(srcdir)/services/rpz.h $(srcdir)/util/config_file.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
- $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/services/cache/dns.h \
- $(srcdir)/sldns/str2wire.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/util/net_help.h \
- $(srcdir)/util/random.h $(srcdir)/util/regional.h $(srcdir)/util/data/dname.h
+ $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/dnscrypt/cert.h \
+ $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/util/config_file.h $(srcdir)/daemon/stats.h \
+ $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h \
+ $(srcdir)/services/cache/dns.h $(srcdir)/sldns/str2wire.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h \
+ $(srcdir)/util/net_help.h $(srcdir)/util/random.h $(srcdir)/util/regional.h $(srcdir)/util/data/dname.h
 checklocks.lo checklocks.o: $(srcdir)/testcode/checklocks.c config.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/testcode/checklocks.h
-ipsecmod.lo ipsecmod.o: $(srcdir)/ipsecmod/ipsecmod.c config.h
-ipsecmod-whitelist.lo ipsecmod-whitelist.o: $(srcdir)/ipsecmod/ipsecmod-whitelist.c config.h
-tsig.lo tsig.o: $(srcdir)/util/tsig.c config.h $(srcdir)/util/tsig.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
- $(srcdir)/util/rbtree.h $(srcdir)/util/config_file.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/net_help.h \
- $(srcdir)/util/random.h $(srcdir)/util/regional.h $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/pkthdr.h \
- $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/str2wire.h $(srcdir)/util/data/msgparse.h \
- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/data/dname.h
+dnstap.lo dnstap.o: $(srcdir)/dnstap/dnstap.c  config.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/util/config_file.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h \
+ $(srcdir)/util/random.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
+  $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h \
+ $(srcdir)/dnstap/dnstap.h $(srcdir)/dnstap/dtstream.h dnstap/dnstap.pb-c.h
+dnstap.pb-c.lo dnstap.pb-c.o: dnstap/dnstap.pb-c.c dnstap/dnstap.pb-c.h
+dnstap_fstrm.lo dnstap_fstrm.o: $(srcdir)/dnstap/dnstap_fstrm.c config.h $(srcdir)/dnstap/dnstap_fstrm.h \
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/wire2str.h
+dtstream.lo dtstream.o: $(srcdir)/dnstap/dtstream.c config.h $(srcdir)/dnstap/dtstream.h $(srcdir)/util/locks.h \
+ $(srcdir)/util/log.h $(srcdir)/dnstap/dnstap_fstrm.h $(srcdir)/util/config_file.h $(srcdir)/sldns/rrdef.h \
+ $(srcdir)/util/ub_event.h $(srcdir)/util/net_help.h $(srcdir)/util/random.h $(srcdir)/services/outside_network.h \
+ $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h $(srcdir)/util/regional.h $(srcdir)/util/netevent.h \
+ $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/dnscrypt/cert.h \
+  $(srcdir)/sldns/sbuffer.h \
+ 
+dnscrypt.lo dnscrypt.o: $(srcdir)/dnscrypt/dnscrypt.c config.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/util/config_file.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h \
+ $(srcdir)/util/random.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
+  $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h \
+ $(srcdir)/util/storage/slabhash.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/storage/lookup3.h
+ipsecmod.lo ipsecmod.o: $(srcdir)/ipsecmod/ipsecmod.c config.h $(srcdir)/ipsecmod/ipsecmod.h \
+ $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/sldns/rrdef.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/util/rbtree.h \
+ $(srcdir)/ipsecmod/ipsecmod-whitelist.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/fptr_wlist.h \
+ $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
+ $(srcdir)/dnscrypt/cert.h \
+ $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h \
+ $(srcdir)/services/localzone.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h \
+ $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h \
+ $(srcdir)/respip/respip.h $(srcdir)/util/regional.h $(srcdir)/util/net_help.h $(srcdir)/util/random.h \
+ $(srcdir)/services/cache/dns.h $(srcdir)/sldns/wire2str.h
+ipsecmod-whitelist.lo ipsecmod-whitelist.o: $(srcdir)/ipsecmod/ipsecmod-whitelist.c config.h \
+ $(srcdir)/ipsecmod/ipsecmod.h $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
+ $(srcdir)/util/log.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/sldns/rrdef.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/util/rbtree.h \
+ $(srcdir)/ipsecmod/ipsecmod-whitelist.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/regional.h \
+ $(srcdir)/util/config_file.h $(srcdir)/util/data/dname.h $(srcdir)/sldns/str2wire.h
+ipset.lo ipset.o: $(srcdir)/ipset/ipset.c config.h $(srcdir)/ipset/ipset.h $(srcdir)/util/module.h \
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/msgreply.h \
+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgparse.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/util/regional.h $(srcdir)/util/net_help.h $(srcdir)/util/random.h \
+ $(srcdir)/util/config_file.h $(srcdir)/services/cache/dns.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/wire2str.h \
+ $(srcdir)/sldns/parseutil.h
 unitanchor.lo unitanchor.o: $(srcdir)/testcode/unitanchor.c config.h $(srcdir)/util/log.h $(srcdir)/util/data/dname.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/testcode/unitmain.h \
  $(srcdir)/validator/val_anchor.h $(srcdir)/util/rbtree.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/rrdef.h
 unitdname.lo unitdname.o: $(srcdir)/testcode/unitdname.c config.h $(srcdir)/util/log.h $(srcdir)/testcode/unitmain.h \
  $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/sldns/sbuffer.h \
- $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/rrdef.h
+ $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/wire2str.h
 unitlruhash.lo unitlruhash.o: $(srcdir)/testcode/unitlruhash.c config.h $(srcdir)/testcode/unitmain.h \
  $(srcdir)/util/log.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/storage/slabhash.h
-unitmain.lo unitmain.o: $(srcdir)/testcode/unitmain.c config.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/keyraw.h \
- $(srcdir)/util/log.h $(srcdir)/testcode/unitmain.h $(srcdir)/util/alloc.h $(srcdir)/util/locks.h $(srcdir)/util/net_help.h \
+unitmain.lo unitmain.o: $(srcdir)/testcode/unitmain.c config.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/keyraw.h \
+ $(srcdir)/util/log.h \
+ $(srcdir)/testcode/unitmain.h $(srcdir)/util/alloc.h $(srcdir)/util/locks.h $(srcdir)/util/net_help.h \
  $(srcdir)/util/random.h $(srcdir)/util/config_file.h $(srcdir)/util/rtt.h $(srcdir)/util/timehist.h \
  $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/util/data/msgreply.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/module.h \
@@ -1281,7 +1385,8 @@ unitverify.lo unitverify.o: $(srcdir)/testcode/unitverify.c config.h $(srcdir)/u
  $(srcdir)/util/data/msgparse.h $(srcdir)/validator/val_utils.h $(srcdir)/testcode/testpkts.h \
  $(srcdir)/util/data/dname.h $(srcdir)/util/regional.h $(srcdir)/util/alloc.h $(srcdir)/util/net_help.h \
  $(srcdir)/util/random.h $(srcdir)/util/config_file.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/keyraw.h \
- $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/wire2str.h
+ $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/wire2str.h \
+ 
 readhex.lo readhex.o: $(srcdir)/testcode/readhex.c config.h $(srcdir)/testcode/readhex.h $(srcdir)/util/log.h \
  $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/parseutil.h
 testpkts.lo testpkts.o: $(srcdir)/testcode/testpkts.c config.h $(srcdir)/testcode/testpkts.h \
@@ -1290,38 +1395,51 @@ testpkts.lo testpkts.o: $(srcdir)/testcode/testpkts.c config.h $(srcdir)/testcod
 unitldns.lo unitldns.o: $(srcdir)/testcode/unitldns.c config.h $(srcdir)/util/log.h $(srcdir)/testcode/unitmain.h \
  $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/wire2str.h \
  $(srcdir)/sldns/parseutil.h
-unitecs.lo unitecs.o: $(srcdir)/testcode/unitecs.c config.h
+unitecs.lo unitecs.o: $(srcdir)/testcode/unitecs.c config.h $(srcdir)/util/log.h $(srcdir)/util/module.h \
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/data/msgreply.h \
+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgparse.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/testcode/unitmain.h $(srcdir)/edns-subnet/addrtree.h \
+ $(srcdir)/edns-subnet/subnetmod.h $(srcdir)/services/outbound_list.h $(srcdir)/util/alloc.h \
+ $(srcdir)/util/net_help.h $(srcdir)/util/random.h $(srcdir)/util/storage/slabhash.h $(srcdir)/util/data/dname.h \
+ $(srcdir)/edns-subnet/edns-subnet.h
 unitauth.lo unitauth.o: $(srcdir)/testcode/unitauth.c config.h $(srcdir)/services/authzone.h \
  $(srcdir)/util/rbtree.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/services/mesh.h $(srcdir)/util/netevent.h \
- $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/util/data/msgparse.h \
- $(srcdir)/util/storage/lruhash.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h \
- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/modstack.h \
- $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h \
- $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h $(srcdir)/daemon/stats.h \
- $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/testcode/unitmain.h \
- $(srcdir)/util/regional.h $(srcdir)/util/net_help.h $(srcdir)/util/random.h $(srcdir)/services/cache/dns.h \
- $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/wire2str.h
+ $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/dnscrypt/cert.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/util/storage/lruhash.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
+ $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
+ $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/util/config_file.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h \
+ $(srcdir)/respip/respip.h $(srcdir)/testcode/unitmain.h $(srcdir)/util/regional.h $(srcdir)/util/net_help.h \
+ $(srcdir)/util/random.h $(srcdir)/services/cache/dns.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/wire2str.h
 unitzonemd.lo unitzonemd.o: $(srcdir)/testcode/unitzonemd.c config.h $(srcdir)/util/log.h \
  $(srcdir)/testcode/unitmain.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/rrdef.h $(srcdir)/services/authzone.h \
  $(srcdir)/util/rbtree.h $(srcdir)/util/locks.h $(srcdir)/services/mesh.h $(srcdir)/util/netevent.h \
- $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/util/data/msgparse.h \
- $(srcdir)/util/storage/lruhash.h $(srcdir)/sldns/pkthdr.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
- $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h \
- $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h \
- $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
- $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/util/data/dname.h $(srcdir)/util/regional.h \
- $(srcdir)/validator/val_anchor.h
+ $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/dnscrypt/cert.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/util/storage/lruhash.h $(srcdir)/sldns/pkthdr.h $(srcdir)/util/module.h \
+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/modstack.h \
+ $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h \
+ $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h $(srcdir)/daemon/stats.h \
+ $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/util/data/dname.h \
+ $(srcdir)/util/regional.h $(srcdir)/validator/val_anchor.h
 unittcpreuse.lo unittcpreuse.o: $(srcdir)/testcode/unittcpreuse.c config.h $(srcdir)/testcode/unitmain.h \
  $(srcdir)/util/log.h $(srcdir)/util/random.h $(srcdir)/services/outside_network.h $(srcdir)/util/alloc.h \
  $(srcdir)/util/locks.h $(srcdir)/util/rbtree.h $(srcdir)/util/regional.h $(srcdir)/util/netevent.h \
- $(srcdir)/dnscrypt/dnscrypt.h  
-unitdoq.lo unitdoq.o: $(srcdir)/testcode/unitdoq.c config.h
+ $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/dnscrypt/cert.h \
+ 
+unitdoq.lo unitdoq.o: $(srcdir)/testcode/unitdoq.c config.h $(srcdir)/util/netevent.h \
+ $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/dnscrypt/cert.h \
+ $(srcdir)/util/locks.h $(srcdir)/util/log.h \
+ $(srcdir)/services/listen_dnsport.h $(srcdir)/util/rbtree.h $(srcdir)/daemon/acl_list.h \
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h \
+ $(srcdir)/testcode/unitmain.h
 unitinfra.lo unitinfra.o: $(srcdir)/testcode/unitinfra.c config.h $(srcdir)/testcode/unitmain.h $(srcdir)/util/log.h \
  $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/util/data/msgreply.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/data/packed_rrset.h \
  $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
  $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/util/rtt.h \
  $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
+ $(srcdir)/dnscrypt/cert.h \
  $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h $(srcdir)/util/random.h
 unittsig.lo unittsig.o: $(srcdir)/testcode/unittsig.c config.h $(srcdir)/util/tsig.h $(srcdir)/util/locks.h \
  $(srcdir)/util/log.h $(srcdir)/util/rbtree.h $(srcdir)/util/config_file.h $(srcdir)/sldns/rrdef.h \
@@ -1334,42 +1452,50 @@ acl_list.lo acl_list.o: $(srcdir)/daemon/acl_list.c config.h $(srcdir)/daemon/ac
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
  $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/sbuffer.h \
  $(srcdir)/services/listen_dnsport.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-  $(srcdir)/sldns/str2wire.h
-cachedump.lo cachedump.o: $(srcdir)/daemon/cachedump.c config.h $(srcdir)/daemon/cachedump.h \
- $(srcdir)/daemon/remote.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/daemon/worker.h \
+  $(srcdir)/dnscrypt/cert.h \
+ $(srcdir)/sldns/str2wire.h
+cachedump.lo cachedump.o: $(srcdir)/daemon/cachedump.c config.h \
+ $(srcdir)/daemon/cachedump.h $(srcdir)/daemon/remote.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
+ $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/netevent.h \
+ $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/dnscrypt/cert.h \
+ $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgparse.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h \
+ $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h  \
+ $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/dns.h \
+ $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/util/rtt.h \
+ $(srcdir)/services/outside_network.h $(srcdir)/util/regional.h $(srcdir)/util/net_help.h $(srcdir)/util/random.h \
+ $(srcdir)/util/data/dname.h $(srcdir)/util/config_file.h $(srcdir)/iterator/iterator.h \
+ $(srcdir)/services/outbound_list.h $(srcdir)/iterator/iter_delegpt.h $(srcdir)/iterator/iter_utils.h \
+ $(srcdir)/iterator/iter_resptype.h $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h \
+ $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h
+daemon.lo daemon.o: $(srcdir)/daemon/daemon.c config.h \
+ $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h \
+   $(srcdir)/daemon/worker.h \
  $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-  $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h \
- $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/daemon/stats.h \
- $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h \
-  $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
- $(srcdir)/services/cache/dns.h $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h \
- $(srcdir)/util/rbtree.h $(srcdir)/util/rtt.h $(srcdir)/services/outside_network.h $(srcdir)/util/regional.h \
- $(srcdir)/util/net_help.h $(srcdir)/util/random.h $(srcdir)/util/data/dname.h $(srcdir)/util/config_file.h \
- $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/iterator/iter_delegpt.h \
- $(srcdir)/iterator/iter_utils.h $(srcdir)/iterator/iter_resptype.h $(srcdir)/iterator/iter_fwd.h \
- $(srcdir)/iterator/iter_hints.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h
-daemon.lo daemon.o: $(srcdir)/daemon/daemon.c config.h $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h \
- $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h  \
-  $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h \
- $(srcdir)/sldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
- $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h $(srcdir)/util/data/msgreply.h $(srcdir)/sldns/rrdef.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
- $(srcdir)/libunbound/unbound.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h $(srcdir)/daemon/remote.h \
+ $(srcdir)/dnscrypt/cert.h \
+ $(srcdir)/util/data/msgreply.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/util/module.h \
+ $(srcdir)/dnstap/dnstap.h $(srcdir)/daemon/remote.h \
  $(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/services/view.h \
  $(srcdir)/util/config_file.h $(srcdir)/util/shm_side/shm_main.h $(srcdir)/util/storage/lookup3.h \
  $(srcdir)/util/storage/slabhash.h $(srcdir)/util/tcp_conn_limit.h $(srcdir)/util/edns.h \
- $(srcdir)/services/listen_dnsport.h $(srcdir)/services/cache/rrset.h $(srcdir)/services/cache/infra.h \
- $(srcdir)/util/rtt.h $(srcdir)/services/localzone.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h \
- $(srcdir)/services/rpz.h $(srcdir)/respip/respip.h $(srcdir)/util/random.h $(srcdir)/util/tube.h $(srcdir)/util/net_help.h \
- $(srcdir)/util/tsig.h $(srcdir)/sldns/keyraw.h $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h
-remote.lo remote.o: $(srcdir)/daemon/remote.c config.h $(srcdir)/daemon/remote.h $(srcdir)/util/locks.h \
- $(srcdir)/util/log.h $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
- $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/netevent.h \
- $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/util/alloc.h \
- $(srcdir)/util/data/msgreply.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
- $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/util/module.h \
- $(srcdir)/dnstap/dnstap.h  $(srcdir)/daemon/daemon.h \
+ $(srcdir)/services/listen_dnsport.h \
+ $(srcdir)/services/cache/rrset.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
+ $(srcdir)/services/localzone.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h $(srcdir)/services/rpz.h \
+ $(srcdir)/respip/respip.h $(srcdir)/util/random.h $(srcdir)/util/tube.h $(srcdir)/util/net_help.h $(srcdir)/util/tsig.h \
+ $(srcdir)/sldns/keyraw.h $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h \
+ $(srcdir)/cachedb/cachedb.h
+remote.lo remote.o: $(srcdir)/daemon/remote.c config.h \
+ $(srcdir)/daemon/remote.h \
+ $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h \
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
+ $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
+ $(srcdir)/dnscrypt/cert.h \
+ $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgparse.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h \
+ $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h  $(srcdir)/daemon/daemon.h \
  $(srcdir)/services/modstack.h $(srcdir)/daemon/cachedump.h $(srcdir)/util/config_file.h \
  $(srcdir)/util/net_help.h $(srcdir)/util/random.h $(srcdir)/util/ub_event.h $(srcdir)/services/listen_dnsport.h \
  $(srcdir)/util/rbtree.h $(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h \
@@ -1383,27 +1509,33 @@ remote.lo remote.o: $(srcdir)/daemon/remote.c config.h $(srcdir)/daemon/remote.h
  $(srcdir)/iterator/iter_delegpt.h $(srcdir)/iterator/iter_utils.h $(srcdir)/iterator/iter_resptype.h \
  $(srcdir)/iterator/iter_donotq.h $(srcdir)/iterator/iter_priv.h $(srcdir)/services/outside_network.h \
  $(srcdir)/util/regional.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/wire2str.h \
- $(srcdir)/util/timeval_func.h $(srcdir)/util/tcp_conn_limit.h $(srcdir)/util/edns.h
+ $(srcdir)/util/timeval_func.h $(srcdir)/util/tcp_conn_limit.h $(srcdir)/util/edns.h $(srcdir)/util/tsig.h $(srcdir)/cachedb/cachedb.h \
+ $(srcdir)/edns-subnet/subnetmod.h $(srcdir)/edns-subnet/addrtree.h $(srcdir)/edns-subnet/edns-subnet.h
 stats.lo stats.o: $(srcdir)/daemon/stats.c config.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
  $(srcdir)/libunbound/unbound.h $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
+ $(srcdir)/dnscrypt/cert.h \
  $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgparse.h \
  $(srcdir)/sldns/pkthdr.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h  \
  $(srcdir)/daemon/daemon.h $(srcdir)/services/modstack.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
  $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h \
  $(srcdir)/services/view.h $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/respip/respip.h \
  $(srcdir)/services/outside_network.h $(srcdir)/util/regional.h $(srcdir)/services/listen_dnsport.h \
- $(srcdir)/daemon/acl_list.h $(srcdir)/util/tube.h $(srcdir)/util/net_help.h $(srcdir)/util/random.h \
- $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h $(srcdir)/validator/val_nsec3.h \
- $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/services/cache/rrset.h \
- $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
- $(srcdir)/validator/val_kcache.h $(srcdir)/validator/val_neg.h
+ $(srcdir)/daemon/acl_list.h \
+ $(srcdir)/util/tube.h $(srcdir)/util/net_help.h $(srcdir)/util/random.h $(srcdir)/validator/validator.h \
+ $(srcdir)/validator/val_utils.h $(srcdir)/validator/val_nsec3.h $(srcdir)/iterator/iterator.h \
+ $(srcdir)/services/outbound_list.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
+ $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h $(srcdir)/validator/val_kcache.h \
+ $(srcdir)/validator/val_neg.h $(srcdir)/edns-subnet/subnetmod.h $(srcdir)/util/data/dname.h \
+ $(srcdir)/edns-subnet/addrtree.h $(srcdir)/edns-subnet/edns-subnet.h \
+ 
 unbound.lo unbound.o: $(srcdir)/daemon/unbound.c config.h $(srcdir)/util/log.h $(srcdir)/daemon/daemon.h \
  $(srcdir)/util/locks.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h  \
-  $(srcdir)/daemon/remote.h $(srcdir)/util/config_file.h \
- $(srcdir)/sldns/rrdef.h $(srcdir)/util/storage/slabhash.h $(srcdir)/util/storage/lruhash.h \
- $(srcdir)/services/listen_dnsport.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
+  $(srcdir)/daemon/remote.h \
+ $(srcdir)/util/config_file.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/storage/slabhash.h \
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/services/listen_dnsport.h $(srcdir)/util/netevent.h \
+ $(srcdir)/dnscrypt/dnscrypt.h $(srcdir)/dnscrypt/cert.h \
  $(srcdir)/util/rbtree.h $(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h \
  $(srcdir)/services/cache/rrset.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/cache/infra.h \
  $(srcdir)/util/rtt.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/module.h \
@@ -1412,65 +1544,68 @@ unbound.lo unbound.o: $(srcdir)/daemon/unbound.c config.h $(srcdir)/util/log.h $
  $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h \
  $(srcdir)/util/net_help.h $(srcdir)/util/random.h $(srcdir)/util/ub_event.h
 worker.lo worker.o: $(srcdir)/daemon/worker.c config.h $(srcdir)/util/log.h $(srcdir)/util/net_help.h \
- $(srcdir)/util/random.h $(srcdir)/util/tsig.h $(srcdir)/util/locks.h $(srcdir)/util/rbtree.h $(srcdir)/daemon/worker.h \
- $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-  $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h \
- $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/daemon/stats.h \
- $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h \
-  $(srcdir)/daemon/daemon.h $(srcdir)/services/modstack.h \
- $(srcdir)/daemon/remote.h $(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h \
+ $(srcdir)/util/random.h $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
+ $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
+ $(srcdir)/dnscrypt/cert.h \
+ $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgparse.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h \
+ $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h  $(srcdir)/daemon/daemon.h \
+ $(srcdir)/services/modstack.h $(srcdir)/daemon/remote.h \
+ $(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/services/view.h \
  $(srcdir)/util/config_file.h $(srcdir)/util/regional.h $(srcdir)/util/storage/slabhash.h \
- $(srcdir)/services/listen_dnsport.h $(srcdir)/services/outside_network.h \
- $(srcdir)/services/outbound_list.h $(srcdir)/services/cache/rrset.h $(srcdir)/services/cache/infra.h \
- $(srcdir)/util/rtt.h $(srcdir)/services/cache/dns.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h \
- $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/respip/respip.h \
- $(srcdir)/util/data/msgencode.h $(srcdir)/util/data/dname.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h \
- $(srcdir)/util/proxy_protocol.h $(srcdir)/util/edns.h $(srcdir)/util/timeval_func.h \
- $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h $(srcdir)/iterator/iter_utils.h \
- $(srcdir)/iterator/iter_resptype.h $(srcdir)/validator/autotrust.h $(srcdir)/validator/val_anchor.h \
- $(srcdir)/libunbound/context.h $(srcdir)/libunbound/unbound-event.h $(srcdir)/libunbound/libworker.h \
- $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/wire2str.h $(srcdir)/util/shm_side/shm_main.h \
- $(srcdir)/dnstap/dtstream.h
+ $(srcdir)/services/listen_dnsport.h \
+ $(srcdir)/services/outside_network.h $(srcdir)/services/outbound_list.h \
+ $(srcdir)/services/cache/rrset.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
+ $(srcdir)/services/cache/dns.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h $(srcdir)/services/rpz.h \
+ $(srcdir)/services/localzone.h $(srcdir)/respip/respip.h $(srcdir)/util/data/msgencode.h \
+ $(srcdir)/util/data/dname.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/util/proxy_protocol.h \
+ $(srcdir)/util/tsig.h $(srcdir)/util/edns.h $(srcdir)/util/timeval_func.h $(srcdir)/iterator/iter_fwd.h \
+ $(srcdir)/iterator/iter_hints.h $(srcdir)/iterator/iter_utils.h $(srcdir)/iterator/iter_resptype.h \
+ $(srcdir)/validator/autotrust.h $(srcdir)/validator/val_anchor.h $(srcdir)/libunbound/context.h \
+ $(srcdir)/libunbound/unbound-event.h $(srcdir)/libunbound/libworker.h $(srcdir)/sldns/wire2str.h \
+ $(srcdir)/util/shm_side/shm_main.h $(srcdir)/dnstap/dtstream.h
 testbound.lo testbound.o: $(srcdir)/testcode/testbound.c config.h $(srcdir)/testcode/testpkts.h \
  $(srcdir)/testcode/replay.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-  $(srcdir)/util/rbtree.h $(srcdir)/testcode/fake_event.h \
- $(srcdir)/daemon/remote.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/libunbound/worker.h \
- $(srcdir)/sldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
- $(srcdir)/daemon/worker.h $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/sldns/rrdef.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
- $(srcdir)/libunbound/unbound.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h \
+  $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
+ $(srcdir)/util/rbtree.h $(srcdir)/testcode/fake_event.h $(srcdir)/daemon/remote.h \
+ $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h \
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/daemon/worker.h $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h \
+ $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/daemon/stats.h \
+ $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h \
   $(srcdir)/util/config_file.h $(srcdir)/sldns/keyraw.h \
  $(srcdir)/daemon/unbound.c $(srcdir)/daemon/daemon.h $(srcdir)/services/modstack.h \
  $(srcdir)/util/storage/slabhash.h $(srcdir)/services/listen_dnsport.h $(srcdir)/daemon/acl_list.h \
- $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/services/cache/rrset.h \
- $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h \
- $(srcdir)/services/mesh.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/services/authzone.h \
- $(srcdir)/respip/respip.h $(srcdir)/util/net_help.h $(srcdir)/util/random.h $(srcdir)/util/ub_event.h
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h \
+ $(srcdir)/services/cache/rrset.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
+ $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/services/rpz.h \
+ $(srcdir)/services/localzone.h $(srcdir)/services/authzone.h $(srcdir)/respip/respip.h $(srcdir)/util/net_help.h \
+ $(srcdir)/util/random.h $(srcdir)/util/ub_event.h
 testpkts.lo testpkts.o: $(srcdir)/testcode/testpkts.c config.h $(srcdir)/testcode/testpkts.h \
  $(srcdir)/util/net_help.h $(srcdir)/util/log.h $(srcdir)/util/random.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/rrdef.h \
  $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/wire2str.h
 worker.lo worker.o: $(srcdir)/daemon/worker.c config.h $(srcdir)/util/log.h $(srcdir)/util/net_help.h \
- $(srcdir)/util/random.h $(srcdir)/util/tsig.h $(srcdir)/util/locks.h $(srcdir)/util/rbtree.h $(srcdir)/daemon/worker.h \
- $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-  $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h \
- $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/daemon/stats.h \
- $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h \
-  $(srcdir)/daemon/daemon.h $(srcdir)/services/modstack.h \
- $(srcdir)/daemon/remote.h $(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h \
+ $(srcdir)/util/random.h $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
+ $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
+ $(srcdir)/dnscrypt/cert.h \
+ $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgparse.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h \
+ $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h  $(srcdir)/daemon/daemon.h \
+ $(srcdir)/services/modstack.h $(srcdir)/daemon/remote.h \
+ $(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/services/view.h \
  $(srcdir)/util/config_file.h $(srcdir)/util/regional.h $(srcdir)/util/storage/slabhash.h \
- $(srcdir)/services/listen_dnsport.h $(srcdir)/services/outside_network.h \
- $(srcdir)/services/outbound_list.h $(srcdir)/services/cache/rrset.h $(srcdir)/services/cache/infra.h \
- $(srcdir)/util/rtt.h $(srcdir)/services/cache/dns.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h \
- $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/respip/respip.h \
- $(srcdir)/util/data/msgencode.h $(srcdir)/util/data/dname.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h \
- $(srcdir)/util/proxy_protocol.h $(srcdir)/util/edns.h $(srcdir)/util/timeval_func.h \
- $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h $(srcdir)/iterator/iter_utils.h \
- $(srcdir)/iterator/iter_resptype.h $(srcdir)/validator/autotrust.h $(srcdir)/validator/val_anchor.h \
- $(srcdir)/libunbound/context.h $(srcdir)/libunbound/unbound-event.h $(srcdir)/libunbound/libworker.h \
- $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/wire2str.h $(srcdir)/util/shm_side/shm_main.h \
- $(srcdir)/dnstap/dtstream.h
+ $(srcdir)/services/listen_dnsport.h \
+ $(srcdir)/services/outside_network.h $(srcdir)/services/outbound_list.h \
+ $(srcdir)/services/cache/rrset.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
+ $(srcdir)/services/cache/dns.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h $(srcdir)/services/rpz.h \
+ $(srcdir)/services/localzone.h $(srcdir)/respip/respip.h $(srcdir)/util/data/msgencode.h \
+ $(srcdir)/util/data/dname.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/util/proxy_protocol.h \
+ $(srcdir)/util/tsig.h $(srcdir)/util/edns.h $(srcdir)/util/timeval_func.h $(srcdir)/iterator/iter_fwd.h \
+ $(srcdir)/iterator/iter_hints.h $(srcdir)/iterator/iter_utils.h $(srcdir)/iterator/iter_resptype.h \
+ $(srcdir)/validator/autotrust.h $(srcdir)/validator/val_anchor.h $(srcdir)/libunbound/context.h \
+ $(srcdir)/libunbound/unbound-event.h $(srcdir)/libunbound/libworker.h $(srcdir)/sldns/wire2str.h \
+ $(srcdir)/util/shm_side/shm_main.h $(srcdir)/dnstap/dtstream.h
 acl_list.lo acl_list.o: $(srcdir)/daemon/acl_list.c config.h $(srcdir)/daemon/acl_list.h \
  $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/services/view.h $(srcdir)/util/locks.h \
  $(srcdir)/util/log.h $(srcdir)/util/regional.h $(srcdir)/util/config_file.h $(srcdir)/sldns/rrdef.h \
@@ -1478,65 +1613,77 @@ acl_list.lo acl_list.o: $(srcdir)/daemon/acl_list.c config.h $(srcdir)/daemon/ac
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
  $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/sbuffer.h \
  $(srcdir)/services/listen_dnsport.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-  $(srcdir)/sldns/str2wire.h
-daemon.lo daemon.o: $(srcdir)/daemon/daemon.c config.h $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h \
- $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h  \
-  $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h \
- $(srcdir)/sldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
- $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h $(srcdir)/util/data/msgreply.h $(srcdir)/sldns/rrdef.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
- $(srcdir)/libunbound/unbound.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h $(srcdir)/daemon/remote.h \
+  $(srcdir)/dnscrypt/cert.h \
+ $(srcdir)/sldns/str2wire.h
+daemon.lo daemon.o: $(srcdir)/daemon/daemon.c config.h \
+ $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h \
+   $(srcdir)/daemon/worker.h \
+ $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h \
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
+ $(srcdir)/dnscrypt/cert.h \
+ $(srcdir)/util/data/msgreply.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/util/module.h \
+ $(srcdir)/dnstap/dnstap.h $(srcdir)/daemon/remote.h \
  $(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/services/view.h \
  $(srcdir)/util/config_file.h $(srcdir)/util/shm_side/shm_main.h $(srcdir)/util/storage/lookup3.h \
  $(srcdir)/util/storage/slabhash.h $(srcdir)/util/tcp_conn_limit.h $(srcdir)/util/edns.h \
- $(srcdir)/services/listen_dnsport.h $(srcdir)/services/cache/rrset.h $(srcdir)/services/cache/infra.h \
- $(srcdir)/util/rtt.h $(srcdir)/services/localzone.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h \
- $(srcdir)/services/rpz.h $(srcdir)/respip/respip.h $(srcdir)/util/random.h $(srcdir)/util/tube.h $(srcdir)/util/net_help.h \
- $(srcdir)/util/tsig.h $(srcdir)/sldns/keyraw.h $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h
+ $(srcdir)/services/listen_dnsport.h \
+ $(srcdir)/services/cache/rrset.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
+ $(srcdir)/services/localzone.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h $(srcdir)/services/rpz.h \
+ $(srcdir)/respip/respip.h $(srcdir)/util/random.h $(srcdir)/util/tube.h $(srcdir)/util/net_help.h $(srcdir)/util/tsig.h \
+ $(srcdir)/sldns/keyraw.h $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h \
+ $(srcdir)/cachedb/cachedb.h
 stats.lo stats.o: $(srcdir)/daemon/stats.c config.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
  $(srcdir)/libunbound/unbound.h $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
+ $(srcdir)/dnscrypt/cert.h \
  $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgparse.h \
  $(srcdir)/sldns/pkthdr.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h  \
  $(srcdir)/daemon/daemon.h $(srcdir)/services/modstack.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
  $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h \
  $(srcdir)/services/view.h $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/respip/respip.h \
  $(srcdir)/services/outside_network.h $(srcdir)/util/regional.h $(srcdir)/services/listen_dnsport.h \
- $(srcdir)/daemon/acl_list.h $(srcdir)/util/tube.h $(srcdir)/util/net_help.h $(srcdir)/util/random.h \
- $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h $(srcdir)/validator/val_nsec3.h \
- $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/services/cache/rrset.h \
- $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
- $(srcdir)/validator/val_kcache.h $(srcdir)/validator/val_neg.h
+ $(srcdir)/daemon/acl_list.h \
+ $(srcdir)/util/tube.h $(srcdir)/util/net_help.h $(srcdir)/util/random.h $(srcdir)/validator/validator.h \
+ $(srcdir)/validator/val_utils.h $(srcdir)/validator/val_nsec3.h $(srcdir)/iterator/iterator.h \
+ $(srcdir)/services/outbound_list.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
+ $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h $(srcdir)/validator/val_kcache.h \
+ $(srcdir)/validator/val_neg.h $(srcdir)/edns-subnet/subnetmod.h $(srcdir)/util/data/dname.h \
+ $(srcdir)/edns-subnet/addrtree.h $(srcdir)/edns-subnet/edns-subnet.h \
+ 
 replay.lo replay.o: $(srcdir)/testcode/replay.c config.h $(srcdir)/util/log.h $(srcdir)/util/net_help.h \
  $(srcdir)/util/random.h $(srcdir)/util/config_file.h $(srcdir)/sldns/rrdef.h $(srcdir)/testcode/replay.h \
  $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
+ $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h \
  $(srcdir)/testcode/testpkts.h $(srcdir)/util/rbtree.h $(srcdir)/testcode/fake_event.h $(srcdir)/sldns/str2wire.h \
  $(srcdir)/util/timeval_func.h
 fake_event.lo fake_event.o: $(srcdir)/testcode/fake_event.c config.h $(srcdir)/testcode/fake_event.h \
  $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
- $(srcdir)/util/net_help.h $(srcdir)/util/log.h $(srcdir)/util/random.h $(srcdir)/util/data/msgparse.h \
- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgencode.h \
- $(srcdir)/util/data/dname.h $(srcdir)/util/storage/slabhash.h $(srcdir)/util/edns.h \
- $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/util/config_file.h \
- $(srcdir)/services/listen_dnsport.h $(srcdir)/daemon/acl_list.h $(srcdir)/services/view.h \
+ $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
+ $(srcdir)/util/net_help.h $(srcdir)/util/random.h $(srcdir)/util/data/msgparse.h \
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgreply.h \
+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgencode.h $(srcdir)/util/data/dname.h \
+ $(srcdir)/util/storage/slabhash.h $(srcdir)/util/edns.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h \
+ $(srcdir)/util/config_file.h $(srcdir)/services/listen_dnsport.h $(srcdir)/daemon/acl_list.h \
+ $(srcdir)/services/view.h \
  $(srcdir)/services/outside_network.h $(srcdir)/util/alloc.h $(srcdir)/util/regional.h \
   $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
  $(srcdir)/testcode/replay.h $(srcdir)/testcode/testpkts.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/module.h \
  $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h \
  $(srcdir)/services/localzone.h $(srcdir)/sldns/sbuffer.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h \
  $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/sldns/wire2str.h \
- $(srcdir)/sldns/str2wire.h $(srcdir)/daemon/remote.h $(srcdir)/daemon/daemon.h $(srcdir)/util/timeval_func.h
+ $(srcdir)/sldns/str2wire.h $(srcdir)/daemon/remote.h \
+ $(srcdir)/daemon/daemon.h $(srcdir)/util/timeval_func.h
 lock_verify.lo lock_verify.o: $(srcdir)/testcode/lock_verify.c config.h $(srcdir)/util/log.h $(srcdir)/util/rbtree.h \
  $(srcdir)/util/locks.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/module.h \
- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/sldns/rrdef.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h \
- $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
- $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h \
- $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
- $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h
+  $(srcdir)/dnscrypt/cert.h \
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgparse.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h \
+ $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h \
+ $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h \
+ $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h
 pktview.lo pktview.o: $(srcdir)/testcode/pktview.c config.h $(srcdir)/util/log.h $(srcdir)/util/data/dname.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
  $(srcdir)/sldns/rrdef.h $(srcdir)/testcode/unitmain.h $(srcdir)/testcode/readhex.h $(srcdir)/sldns/sbuffer.h \
@@ -1545,36 +1692,38 @@ readhex.lo readhex.o: $(srcdir)/testcode/readhex.c config.h $(srcdir)/testcode/r
  $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/parseutil.h
 memstats.lo memstats.o: $(srcdir)/testcode/memstats.c config.h $(srcdir)/util/log.h $(srcdir)/util/rbtree.h \
  $(srcdir)/util/locks.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/module.h \
- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/sldns/rrdef.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h \
- $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
- $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h \
- $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
- $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h
+  $(srcdir)/dnscrypt/cert.h \
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgparse.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h \
+ $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h \
+ $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h \
+ $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h
 unbound-checkconf.lo unbound-checkconf.o: $(srcdir)/smallapp/unbound-checkconf.c config.h $(srcdir)/util/log.h \
  $(srcdir)/util/config_file.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/locks.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
  $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/util/net_help.h $(srcdir)/util/random.h \
- $(srcdir)/util/regional.h $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h \
- $(srcdir)/iterator/iter_fwd.h $(srcdir)/util/rbtree.h $(srcdir)/iterator/iter_hints.h \
+ $(srcdir)/util/regional.h $(srcdir)/util/tsig.h $(srcdir)/util/rbtree.h $(srcdir)/iterator/iterator.h \
+ $(srcdir)/services/outbound_list.h $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h \
  $(srcdir)/util/storage/dnstree.h $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h \
  $(srcdir)/validator/val_nsec3.h $(srcdir)/services/localzone.h $(srcdir)/services/view.h \
  $(srcdir)/sldns/sbuffer.h $(srcdir)/services/listen_dnsport.h $(srcdir)/util/netevent.h \
- $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/daemon/acl_list.h \
+ $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/dnscrypt/cert.h \
+ $(srcdir)/daemon/acl_list.h \
  $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h \
  $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h \
- $(srcdir)/sldns/str2wire.h
+ $(srcdir)/sldns/str2wire.h $(PYTHONMOD_HEADER) $(srcdir)/edns-subnet/subnet-whitelist.h
 worker_cb.lo worker_cb.o: $(srcdir)/smallapp/worker_cb.c config.h $(srcdir)/libunbound/context.h \
  $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h \
  $(srcdir)/libunbound/unbound.h $(srcdir)/libunbound/unbound-event.h $(srcdir)/util/data/packed_rrset.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
  $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-  $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
- $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/util/tube.h \
- $(srcdir)/services/mesh.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
- $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/util/config_file.h \
- $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/respip/respip.h
+  $(srcdir)/dnscrypt/cert.h \
+ $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgparse.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/services/rpz.h \
+ $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h \
+ $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
+ $(srcdir)/respip/respip.h $(srcdir)/dnstap/dtstream.h
 context.lo context.o: $(srcdir)/libunbound/context.c config.h $(srcdir)/libunbound/context.h \
  $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h \
  $(srcdir)/libunbound/unbound.h $(srcdir)/libunbound/unbound-event.h $(srcdir)/util/data/packed_rrset.h \
@@ -1584,10 +1733,11 @@ context.lo context.o: $(srcdir)/libunbound/context.c config.h $(srcdir)/libunbou
  $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/services/cache/rrset.h \
  $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
  $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
+ $(srcdir)/dnscrypt/cert.h \
  $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h $(srcdir)/services/rpz.h $(srcdir)/daemon/stats.h \
  $(srcdir)/util/timehist.h $(srcdir)/respip/respip.h $(srcdir)/services/listen_dnsport.h \
- $(srcdir)/daemon/acl_list.h $(srcdir)/util/edns.h $(srcdir)/util/tsig.h $(srcdir)/iterator/iter_fwd.h \
- $(srcdir)/iterator/iter_hints.h
+ $(srcdir)/daemon/acl_list.h \
+ $(srcdir)/util/edns.h $(srcdir)/util/tsig.h $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h
 libunbound.lo libunbound.o: $(srcdir)/libunbound/libunbound.c $(srcdir)/libunbound/unbound.h \
  $(srcdir)/libunbound/unbound-event.h config.h $(srcdir)/libunbound/context.h $(srcdir)/util/locks.h \
  $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h \
@@ -1597,17 +1747,18 @@ libunbound.lo libunbound.o: $(srcdir)/libunbound/libunbound.c $(srcdir)/libunbou
  $(srcdir)/util/net_help.h $(srcdir)/util/tube.h $(srcdir)/util/ub_event.h $(srcdir)/util/edns.h \
  $(srcdir)/util/storage/dnstree.h $(srcdir)/util/tsig.h $(srcdir)/services/localzone.h $(srcdir)/services/view.h \
  $(srcdir)/sldns/sbuffer.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h $(srcdir)/util/netevent.h \
- $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/services/cache/rrset.h \
- $(srcdir)/util/storage/slabhash.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h \
- $(srcdir)/services/rpz.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/respip/respip.h \
- $(srcdir)/services/listen_dnsport.h $(srcdir)/daemon/acl_list.h $(srcdir)/iterator/iter_fwd.h \
- $(srcdir)/iterator/iter_hints.h
-libworker.lo libworker.o: $(srcdir)/libunbound/libworker.c config.h $(srcdir)/libunbound/libworker.h \
- $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
- $(srcdir)/libunbound/context.h $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h \
- $(srcdir)/libunbound/unbound.h $(srcdir)/libunbound/unbound-event.h $(srcdir)/libunbound/worker.h \
- $(srcdir)/sldns/sbuffer.h $(srcdir)/services/outside_network.h $(srcdir)/util/regional.h \
- $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
+ $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/dnscrypt/cert.h \
+ $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/services/authzone.h \
+ $(srcdir)/services/mesh.h $(srcdir)/services/rpz.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
+ $(srcdir)/respip/respip.h $(srcdir)/services/listen_dnsport.h $(srcdir)/daemon/acl_list.h \
+ $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h
+libworker.lo libworker.o: $(srcdir)/libunbound/libworker.c config.h \
+ $(srcdir)/libunbound/libworker.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
+ $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/libunbound/context.h $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h \
+ $(srcdir)/services/modstack.h $(srcdir)/libunbound/unbound.h $(srcdir)/libunbound/unbound-event.h \
+ $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h $(srcdir)/services/outside_network.h \
+ $(srcdir)/util/regional.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
+  $(srcdir)/dnscrypt/cert.h \
   $(srcdir)/services/mesh.h $(srcdir)/util/data/msgparse.h \
  $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
  $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h \
@@ -1615,19 +1766,23 @@ libworker.lo libworker.o: $(srcdir)/libunbound/libworker.c config.h $(srcdir)/li
  $(srcdir)/util/timehist.h $(srcdir)/respip/respip.h $(srcdir)/services/cache/rrset.h \
  $(srcdir)/util/storage/slabhash.h $(srcdir)/services/outbound_list.h $(srcdir)/util/fptr_wlist.h \
  $(srcdir)/util/tube.h $(srcdir)/util/random.h $(srcdir)/util/proxy_protocol.h $(srcdir)/util/storage/lookup3.h \
- $(srcdir)/util/net_help.h $(srcdir)/util/data/dname.h $(srcdir)/util/data/msgencode.h $(srcdir)/sldns/str2wire.h
+ $(srcdir)/util/net_help.h $(srcdir)/util/data/dname.h $(srcdir)/util/data/msgencode.h $(srcdir)/sldns/str2wire.h \
+ $(srcdir)/dnstap/dtstream.h
 unbound-host.lo unbound-host.o: $(srcdir)/smallapp/unbound-host.c config.h $(srcdir)/libunbound/unbound.h \
- $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/wire2str.h
+ $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/wire2str.h \
+ 
 asynclook.lo asynclook.o: $(srcdir)/testcode/asynclook.c config.h $(srcdir)/libunbound/unbound.h \
  $(srcdir)/libunbound/context.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h \
  $(srcdir)/services/modstack.h $(srcdir)/libunbound/unbound-event.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/util/storage/lruhash.h $(srcdir)/sldns/rrdef.h
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/sldns/rrdef.h \
+ 
 streamtcp.lo streamtcp.o: $(srcdir)/testcode/streamtcp.c config.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/net_help.h $(srcdir)/util/random.h $(srcdir)/util/proxy_protocol.h \
  $(srcdir)/util/data/msgencode.h $(srcdir)/util/data/msgparse.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgreply.h \
  $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/dname.h $(srcdir)/sldns/sbuffer.h \
- $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/wire2str.h
+ $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/wire2str.h \
+ 
 perf.lo perf.o: $(srcdir)/testcode/perf.c config.h $(srcdir)/util/log.h $(srcdir)/util/locks.h $(srcdir)/util/net_help.h \
  $(srcdir)/util/random.h $(srcdir)/util/data/msgencode.h $(srcdir)/util/data/msgreply.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/sldns/rrdef.h \
@@ -1635,8 +1790,8 @@ perf.lo perf.o: $(srcdir)/testcode/perf.c config.h $(srcdir)/util/log.h $(srcdir
  $(srcdir)/sldns/str2wire.h
 delayer.lo delayer.o: $(srcdir)/testcode/delayer.c config.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h \
  $(srcdir)/util/random.h $(srcdir)/util/config_file.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/sbuffer.h
-unbound-control.lo unbound-control.o: $(srcdir)/smallapp/unbound-control.c config.h $(srcdir)/util/log.h \
- $(srcdir)/util/config_file.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/locks.h $(srcdir)/util/net_help.h \
+unbound-control.lo unbound-control.o: $(srcdir)/smallapp/unbound-control.c config.h \
+ $(srcdir)/util/log.h $(srcdir)/util/config_file.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/locks.h $(srcdir)/util/net_help.h \
  $(srcdir)/util/random.h $(srcdir)/util/shm_side/shm_main.h $(srcdir)/libunbound/unbound.h \
  $(srcdir)/util/timeval_func.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/sldns/wire2str.h \
  $(srcdir)/sldns/pkthdr.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/util/rbtree.h \
@@ -1644,41 +1799,49 @@ unbound-control.lo unbound-control.o: $(srcdir)/smallapp/unbound-control.c confi
  $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
  $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h \
  $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
+ $(srcdir)/dnscrypt/cert.h \
  $(srcdir)/services/modstack.h $(srcdir)/respip/respip.h $(srcdir)/services/listen_dnsport.h \
- $(srcdir)/daemon/acl_list.h
+ $(srcdir)/daemon/acl_list.h \
+ 
 unbound-anchor.lo unbound-anchor.o: $(srcdir)/smallapp/unbound-anchor.c config.h $(srcdir)/libunbound/unbound.h \
- $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/parseutil.h
-petal.lo petal.o: $(srcdir)/testcode/petal.c config.h
+ $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/parseutil.h \
+ 
+petal.lo petal.o: $(srcdir)/testcode/petal.c config.h \
+ 
 unbound-dnstap-socket.lo unbound-dnstap-socket.o: $(srcdir)/dnstap/unbound-dnstap-socket.c config.h \
  $(srcdir)/dnstap/dtstream.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/dnstap/dnstap_fstrm.h \
  $(srcdir)/util/ub_event.h $(srcdir)/util/net_help.h $(srcdir)/util/random.h $(srcdir)/services/listen_dnsport.h \
  $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
+ $(srcdir)/dnscrypt/cert.h \
  $(srcdir)/util/rbtree.h $(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h \
- $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/pkthdr.h $(srcdir)/util/config_file.h \
- $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
- $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h \
- $(srcdir)/util/data/msgparse.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h \
- $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h  $(srcdir)/daemon/remote.h \
- $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h \
- $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/services/authzone.h $(srcdir)/respip/respip.h \
- $(srcdir)/libunbound/context.h $(srcdir)/libunbound/unbound-event.h
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/pkthdr.h dnstap/dnstap.pb-c.h \
+ $(srcdir)/util/config_file.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/packed_rrset.h \
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/util/alloc.h \
+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
+ $(srcdir)/libunbound/unbound.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h \
+  $(srcdir)/daemon/remote.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h \
+ $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
+ $(srcdir)/services/authzone.h $(srcdir)/respip/respip.h $(srcdir)/libunbound/context.h \
+ $(srcdir)/libunbound/unbound-event.h
 pythonmod_utils.lo pythonmod_utils.o: $(srcdir)/pythonmod/pythonmod_utils.c config.h \
  $(srcdir)/pythonmod/pythonmod_utils.h $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
  $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/util/netevent.h \
- $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/util/net_help.h \
- $(srcdir)/util/random.h $(srcdir)/services/cache/dns.h $(srcdir)/services/cache/rrset.h \
- $(srcdir)/util/storage/slabhash.h $(srcdir)/util/regional.h $(srcdir)/iterator/iter_delegpt.h \
- $(srcdir)/sldns/sbuffer.h
+ $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/dnscrypt/cert.h \
+ $(srcdir)/util/net_help.h $(srcdir)/util/random.h $(srcdir)/services/cache/dns.h \
+ $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/util/regional.h \
+ $(srcdir)/iterator/iter_delegpt.h $(srcdir)/sldns/sbuffer.h \
+ 
 win_svc.lo win_svc.o: $(srcdir)/winrc/win_svc.c config.h $(srcdir)/winrc/win_svc.h $(srcdir)/winrc/w_inst.h \
  $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h \
    $(srcdir)/daemon/worker.h \
  $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
+ $(srcdir)/dnscrypt/cert.h \
  $(srcdir)/util/data/msgreply.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
  $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/util/module.h \
- $(srcdir)/dnstap/dnstap.h $(srcdir)/daemon/remote.h $(srcdir)/util/config_file.h $(srcdir)/util/ub_event.h \
- $(srcdir)/util/net_help.h $(srcdir)/util/random.h
+ $(srcdir)/dnstap/dnstap.h $(srcdir)/daemon/remote.h \
+ $(srcdir)/util/config_file.h $(srcdir)/util/ub_event.h $(srcdir)/util/net_help.h $(srcdir)/util/random.h
 w_inst.lo w_inst.o: $(srcdir)/winrc/w_inst.c config.h $(srcdir)/winrc/w_inst.h $(srcdir)/winrc/win_svc.h
 unbound-service-install.lo unbound-service-install.o: $(srcdir)/winrc/unbound-service-install.c config.h \
  $(srcdir)/winrc/w_inst.h
@@ -1686,12 +1849,14 @@ unbound-service-remove.lo unbound-service-remove.o: $(srcdir)/winrc/unbound-serv
  $(srcdir)/winrc/w_inst.h
 anchor-update.lo anchor-update.o: $(srcdir)/winrc/anchor-update.c config.h $(srcdir)/libunbound/unbound.h \
  $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/wire2str.h
-keyraw.lo keyraw.o: $(srcdir)/sldns/keyraw.c config.h $(srcdir)/sldns/keyraw.h $(srcdir)/sldns/rrdef.h
+keyraw.lo keyraw.o: $(srcdir)/sldns/keyraw.c config.h $(srcdir)/sldns/keyraw.h \
+ $(srcdir)/sldns/rrdef.h \
+ 
 sbuffer.lo sbuffer.o: $(srcdir)/sldns/sbuffer.c config.h $(srcdir)/sldns/sbuffer.h
 wire2str.lo wire2str.o: $(srcdir)/sldns/wire2str.c config.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h \
  $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/sbuffer.h \
- $(srcdir)/sldns/keyraw.h $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
- $(srcdir)/util/log.h
+ $(srcdir)/sldns/keyraw.h \
+ $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h
 parse.lo parse.o: $(srcdir)/sldns/parse.c config.h $(srcdir)/sldns/parse.h $(srcdir)/sldns/parseutil.h \
  $(srcdir)/sldns/sbuffer.h
 parseutil.lo parseutil.o: $(srcdir)/sldns/parseutil.c config.h $(srcdir)/sldns/parseutil.h
@@ -1702,12 +1867,15 @@ dohclient.lo dohclient.o: $(srcdir)/testcode/dohclient.c config.h $(srcdir)/sldn
  $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/parseutil.h \
  $(srcdir)/util/data/msgencode.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
- $(srcdir)/sldns/pkthdr.h $(srcdir)/util/net_help.h $(srcdir)/util/random.h
-doqclient.lo doqclient.o: $(srcdir)/testcode/doqclient.c config.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/daemon/worker.h \
- $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-  $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h \
- $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/daemon/stats.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/util/net_help.h $(srcdir)/util/random.h \
+ 
+doqclient.lo doqclient.o: $(srcdir)/testcode/doqclient.c config.h \
+ $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/net_help.h $(srcdir)/util/random.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/wire2str.h $(srcdir)/util/data/msgreply.h \
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgencode.h \
+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/util/data/dname.h $(srcdir)/util/ub_event.h \
+ $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
+  $(srcdir)/dnscrypt/cert.h $(srcdir)/util/alloc.h $(srcdir)/daemon/stats.h \
  $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h \
   $(srcdir)/daemon/remote.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h \
  $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h \
@@ -1730,9 +1898,11 @@ strlcat.lo strlcat.o: $(srcdir)/compat/strlcat.c config.h
 strlcpy.lo strlcpy.o: $(srcdir)/compat/strlcpy.c config.h
 strptime.lo strptime.o: $(srcdir)/compat/strptime.c config.h
 getentropy_freebsd.lo getentropy_freebsd.o: $(srcdir)/compat/getentropy_freebsd.c
-getentropy_linux.lo getentropy_linux.o: $(srcdir)/compat/getentropy_linux.c config.h
+getentropy_linux.lo getentropy_linux.o: $(srcdir)/compat/getentropy_linux.c config.h \
+ 
 getentropy_osx.lo getentropy_osx.o: $(srcdir)/compat/getentropy_osx.c
-getentropy_solaris.lo getentropy_solaris.o: $(srcdir)/compat/getentropy_solaris.c config.h
+getentropy_solaris.lo getentropy_solaris.o: $(srcdir)/compat/getentropy_solaris.c config.h \
+ 
 getentropy_win.lo getentropy_win.o: $(srcdir)/compat/getentropy_win.c
 explicit_bzero.lo explicit_bzero.o: $(srcdir)/compat/explicit_bzero.c config.h
 arc4random.lo arc4random.o: $(srcdir)/compat/arc4random.c config.h $(srcdir)/compat/chacha_private.h
diff --git a/README.md b/README.md
index 3bbd38b3b..0eb8bb2e5 100644
--- a/README.md
+++ b/README.md
@@ -4,7 +4,7 @@
 [![Packaging status](https://repology.org/badge/tiny-repos/unbound.svg)](https://repology.org/project/unbound/versions)
 [![Fuzzing Status](https://oss-fuzz-build-logs.storage.googleapis.com/badges/unbound.svg)](https://bugs.chromium.org/p/oss-fuzz/issues/list?sort=-opened&can=1&q=proj:unbound)
 [![Documentation Status](https://readthedocs.org/projects/unbound/badge/?version=latest)](https://unbound.readthedocs.io/en/latest/?badge=latest)
-[![Mastodon Follow](https://img.shields.io/mastodon/follow/109262826617293067?domain=https%3A%2F%2Ffosstodon.org&style=social)](https://fosstodon.org/@nlnetlabs)
+[![Mastodon Follow](https://img.shields.io/mastodon/follow/114692612288811644?domain=social.nlnetlabs.nl&style=social)](https://social.nlnetlabs.nl/@nlnetlabs)
 
 Unbound is a validating, recursive, caching DNS resolver. It is designed to be
 fast and lean and incorporates modern features based on open standards. If you
diff --git a/acx_nlnetlabs.m4 b/acx_nlnetlabs.m4
index 6a01dc5a4..c8195f5e1 100644
--- a/acx_nlnetlabs.m4
+++ b/acx_nlnetlabs.m4
@@ -2,7 +2,10 @@
 # Copyright 2009, Wouter Wijngaards, NLnet Labs.   
 # BSD licensed.
 #
-# Version 48
+# Version 50
+# 2025-09-29 add ac_cv_func_malloc_0_nonnull as a cache value for the malloc(0)
+#            check by ACX_FUNC_MALLOC.
+# 2025-09-29 add ACX_CHECK_NONSTRING_ATTRIBUTE, AHX_CONFIG_NONSTRING_ATTRIBUTE.
 # 2024-01-16 fix to add -l:libssp.a to -lcrypto link check.
 #	     and check for getaddrinfo with only header.
 # 2024-01-15 fix to add crypt32 to -lcrypto link check when checking for gdi32.
@@ -71,6 +74,7 @@
 # ACX_DEPFLAG			- find cc dependency flags.
 # ACX_DETERMINE_EXT_FLAGS_UNBOUND - find out which flags enable BSD and POSIX.
 # ACX_CHECK_FORMAT_ATTRIBUTE	- find cc printf format syntax.
+# ACX_CHECK_NONSTRING_ATTRIBUTE - find cc nonstring attribute syntax.
 # ACX_CHECK_UNUSED_ATTRIBUTE	- find cc variable unused syntax.
 # ACX_CHECK_FLTO		- see if cc supports -flto and use it if so.
 # ACX_LIBTOOL_C_ONLY		- create libtool for C only, improved.
@@ -92,6 +96,7 @@
 # ACX_FUNC_IOCTLSOCKET		- find ioctlsocket, portably.
 # ACX_FUNC_MALLOC		- check malloc, define replacement .
 # AHX_CONFIG_FORMAT_ATTRIBUTE	- config.h text for format.
+# AHX_CONFIG_NONSTRING_ATTRIBUTE - config.h text for nonstring.
 # AHX_CONFIG_UNUSED_ATTRIBUTE	- config.h text for unused.
 # AHX_CONFIG_FSEEKO		- define fseeko, ftello fallback.
 # AHX_CONFIG_RAND_MAX		- define RAND_MAX if needed.
@@ -490,7 +495,7 @@ AC_DEFUN([AHX_CONFIG_FORMAT_ATTRIBUTE],
 ])
 
 dnl Check how to mark function arguments as unused.
-dnl result in HAVE_ATTR_UNUSED.  
+dnl result in HAVE_ATTR_UNUSED.
 dnl Make sure you include AHX_CONFIG_UNUSED_ATTRIBUTE also.
 AC_DEFUN([ACX_CHECK_UNUSED_ATTRIBUTE],
 [AC_REQUIRE([AC_PROG_CC])
@@ -525,6 +530,45 @@ if test $ac_cv_c_unused_attribute = yes; then
 fi
 ])dnl
 
+dnl Check how to mark function arguments as nonstring.
+dnl result in HAVE_ATTR_NONSTRING.
+dnl Make sure you include AHX_CONFIG_NONSTRING_ATTRIBUTE also.
+AC_DEFUN([ACX_CHECK_NONSTRING_ATTRIBUTE],
+[AC_REQUIRE([AC_PROG_CC])
+AC_MSG_CHECKING(whether the C compiler (${CC-cc}) accepts the "nonstring" attribute)
+AC_CACHE_VAL(ac_cv_c_nonstring_attribute,
+[ac_cv_c_nonstring_attribute=no
+AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[#include <stdio.h>
+struct test {
+    char __attribute__((nonstring)) s[1];
+};
+]], [[
+   struct test t = { "1" };
+   (void) t;
+]])],[ac_cv_c_nonstring_attribute="yes"],[ac_cv_c_nonstring_attribute="no"])
+])
+
+dnl Setup ATTR_NONSTRING config.h parts.
+dnl make sure you call ACX_CHECK_NONSTRING_ATTRIBUTE also.
+AC_DEFUN([AHX_CONFIG_NONSTRING_ATTRIBUTE],
+[
+#if defined(DOXYGEN)
+#  define ATTR_NONSTRING(x)  x
+#elif defined(__cplusplus)
+#  define ATTR_NONSTRING(x)  __attribute__((nonstring)) x
+#elif defined(HAVE_ATTR_NONSTRING)
+#  define ATTR_NONSTRING(x)  __attribute__((nonstring)) x
+#else /* !HAVE_ATTR_NONSTRING */
+#  define ATTR_NONSTRING(x)  x
+#endif /* !HAVE_ATTR_NONSTRING */
+])
+
+AC_MSG_RESULT($ac_cv_c_nonstring_attribute)
+if test $ac_cv_c_nonstring_attribute = yes; then
+  AC_DEFINE(HAVE_ATTR_NONSTRING, 1, [Whether the C compiler accepts the "nonstring" attribute])
+fi
+])dnl
+
 dnl Pre-fun for ACX_LIBTOOL_C_ONLY
 AC_DEFUN([ACX_LIBTOOL_C_PRE], [
 # skip these tests, we do not need them.
@@ -1190,8 +1234,9 @@ dnl detect malloc and provide malloc compat prototype.
 dnl $1: unique name for compat code
 AC_DEFUN([ACX_FUNC_MALLOC],
 [
-	AC_MSG_CHECKING([for GNU libc compatible malloc])
-	AC_RUN_IFELSE([AC_LANG_PROGRAM(
+	AC_CACHE_CHECK([for GNU libc compatible malloc],[ac_cv_func_malloc_0_nonnull],
+	[
+		AC_RUN_IFELSE([AC_LANG_PROGRAM(
 [[#if defined STDC_HEADERS || defined HAVE_STDLIB_H
 #include <stdlib.h>
 #else
@@ -1199,14 +1244,16 @@ char *malloc ();
 #endif
 ]], [ if(malloc(0) != 0) return 1;])
 ],
-	[AC_MSG_RESULT([no])
-	AC_LIBOBJ(malloc)
-	AC_DEFINE_UNQUOTED([malloc], [rpl_malloc_$1], [Define if  replacement function should be used.])] ,
-	[AC_MSG_RESULT([yes])
-	AC_DEFINE([HAVE_MALLOC], 1, [If have GNU libc compatible malloc])],
-	[AC_MSG_RESULT([no (crosscompile)])
-	AC_LIBOBJ(malloc)
-	AC_DEFINE_UNQUOTED([malloc], [rpl_malloc_$1], [Define if  replacement function should be used.])] )
+		[ac_cv_func_malloc_0_nonnull=no],
+		[ac_cv_func_malloc_0_nonnull=yes],
+		[ac_cv_func_malloc_0_nonnull="no (crosscompile)"])
+	])
+	AS_IF([test "$ac_cv_func_malloc_0_nonnull" = yes],
+		[AC_DEFINE([HAVE_MALLOC], 1, [If have GNU libc compatible malloc])],
+	[
+		AC_LIBOBJ(malloc)
+		AC_DEFINE_UNQUOTED([malloc], [rpl_malloc_$1], [Define if  replacement function should be used.])
+	])
 ])
 
 dnl Define fallback for fseeko and ftello if needed.
diff --git a/cachedb/cachedb.c b/cachedb/cachedb.c
index bdb1754e4..b45c0a3ea 100644
--- a/cachedb/cachedb.c
+++ b/cachedb/cachedb.c
@@ -401,12 +401,9 @@ prep_data(struct module_qstate* qstate, struct sldns_buffer* buf)
 	   FLAGS_GET_RCODE(qstate->return_msg->rep->flags) !=
 		LDNS_RCODE_YXDOMAIN)
 		return 0;
-	/* We don't store the reply if its TTL is 0 unless serve-expired is
-	 * enabled.  Such a reply won't be reusable and simply be a waste for
-	 * the backend.  It's also compatible with the default behavior of
-	 * dns_cache_store_msg(). */
-	if(qstate->return_msg->rep->ttl == 0 &&
-		!qstate->env->cfg->serve_expired)
+	/* We don't store the reply if its TTL is 0. This is probably coming
+	 * from upstream and it is not meant to be stored. */
+	if(qstate->return_msg->rep->ttl == 0)
 		return 0;
 
 	/* The EDE is added to the out-list so it is encoded in the cached message */
@@ -460,7 +457,7 @@ good_expiry_and_qinfo(struct module_qstate* qstate, struct sldns_buffer* buf)
 	 * - serve_expired needs to be set
 	 * - if SERVE_EXPIRED_TTL is set make sure that the record is not older
 	 *   than that. */
-	if((time_t)expiry < *qstate->env->now &&
+	if(TTL_IS_EXPIRED((time_t)expiry, *qstate->env->now) &&
 		(!qstate->env->cfg->serve_expired ||
 			(SERVE_EXPIRED_TTL &&
 			*qstate->env->now - (time_t)expiry > SERVE_EXPIRED_TTL)))
@@ -472,7 +469,8 @@ good_expiry_and_qinfo(struct module_qstate* qstate, struct sldns_buffer* buf)
 /* Adjust the TTL of the given RRset by 'subtract'.  If 'subtract' is
  * negative, set the TTL to 0. */
 static void
-packed_rrset_ttl_subtract(struct packed_rrset_data* data, time_t subtract)
+packed_rrset_ttl_subtract(struct packed_rrset_data* data, time_t subtract,
+	time_t timestamp)
 {
 	size_t i;
 	size_t total = data->count + data->rrsig_count;
@@ -484,13 +482,13 @@ packed_rrset_ttl_subtract(struct packed_rrset_data* data, time_t subtract)
 			data->rr_ttl[i] -= subtract;
 		else	data->rr_ttl[i] = 0;
 	}
-	data->ttl_add = (subtract < data->ttl_add) ? (data->ttl_add - subtract) : 0;
+	data->ttl_add = timestamp;
 }
 
 /* Adjust the TTL of a DNS message and its RRs by 'adjust'.  If 'adjust' is
  * negative, set the TTLs to 0. */
 static void
-adjust_msg_ttl(struct dns_msg* msg, time_t adjust)
+adjust_msg_ttl(struct dns_msg* msg, time_t adjust, time_t timestamp)
 {
 	size_t i;
 	if(adjust >= 0 && msg->rep->ttl > adjust)
@@ -502,13 +500,13 @@ adjust_msg_ttl(struct dns_msg* msg, time_t adjust)
 
 	for(i=0; i<msg->rep->rrset_count; i++) {
 		packed_rrset_ttl_subtract((struct packed_rrset_data*)msg->
-			rep->rrsets[i]->entry.data, adjust);
+			rep->rrsets[i]->entry.data, adjust, timestamp);
 	}
 }
 
 /* Set the TTL of the given RRset to fixed value. */
 static void
-packed_rrset_ttl_set(struct packed_rrset_data* data, time_t ttl)
+packed_rrset_ttl_set(struct packed_rrset_data* data, time_t ttl, time_t timestamp)
 {
 	size_t i;
 	size_t total = data->count + data->rrsig_count;
@@ -516,12 +514,12 @@ packed_rrset_ttl_set(struct packed_rrset_data* data, time_t ttl)
 	for(i=0; i<total; i++) {
 		data->rr_ttl[i] = ttl;
 	}
-	data->ttl_add = 0;
+	data->ttl_add = timestamp;
 }
 
 /* Set the TTL of a DNS message and its RRs by to a fixed value. */
 static void
-set_msg_ttl(struct dns_msg* msg, time_t ttl)
+set_msg_ttl(struct dns_msg* msg, time_t ttl, time_t timestamp)
 {
 	size_t i;
 	msg->rep->ttl = ttl;
@@ -530,14 +528,14 @@ set_msg_ttl(struct dns_msg* msg, time_t ttl)
 
 	for(i=0; i<msg->rep->rrset_count; i++) {
 		packed_rrset_ttl_set((struct packed_rrset_data*)msg->
-			rep->rrsets[i]->entry.data, ttl);
+			rep->rrsets[i]->entry.data, ttl, timestamp);
 	}
 }
 
 /** convert dns message in buffer to return_msg */
 static int
 parse_data(struct module_qstate* qstate, struct sldns_buffer* buf,
-	int* msg_expired)
+	int* msg_expired, time_t* msg_timestamp, time_t* msg_expiry)
 {
 	struct msg_parse* prs;
 	struct edns_data edns;
@@ -554,6 +552,9 @@ parse_data(struct module_qstate* qstate, struct sldns_buffer* buf,
 		&timestamp, sizeof(timestamp));
 	expiry = be64toh(expiry);
 	timestamp = be64toh(timestamp);
+	log_assert(timestamp <= expiry);
+	*msg_expiry = (time_t)expiry;
+	*msg_timestamp = (time_t)timestamp;
 
 	/* parse DNS packet */
 	regional_free_all(qstate->env->scratch);
@@ -605,11 +606,9 @@ parse_data(struct module_qstate* qstate, struct sldns_buffer* buf,
 		return 1; /* message from the future (clock skew?) */
 	}
 	adjust = *qstate->env->now - (time_t)timestamp;
-	if(qstate->return_msg->rep->ttl < adjust) {
+	if(TTL_IS_EXPIRED((time_t)expiry, *qstate->env->now)) {
 		verbose(VERB_ALGO, "cachedb msg expired");
 		*msg_expired = 1;
-		/* If serve-expired is enabled, we still use an expired message
-		 * setting the TTL to 0. */
 		if(!qstate->env->cfg->serve_expired ||
 			(FLAGS_GET_RCODE(qstate->return_msg->rep->flags)
 			!= LDNS_RCODE_NOERROR &&
@@ -618,23 +617,21 @@ parse_data(struct module_qstate* qstate, struct sldns_buffer* buf,
 			FLAGS_GET_RCODE(qstate->return_msg->rep->flags)
 			!= LDNS_RCODE_YXDOMAIN))
 			return 0; /* message expired */
-		else
-			adjust = -1;
+		/* If serve-expired is enabled, we still use an expired message.
+		 * Set the TTL to 0 now and it will be handled specially later
+		 * when we need to store it internally. */
+		adjust = -1;
 	}
+	adjust_msg_ttl(qstate->return_msg, adjust, timestamp);
 	verbose(VERB_ALGO, "cachedb msg adjusted down by %d", (int)adjust);
-	adjust_msg_ttl(qstate->return_msg, adjust);
 	if(qstate->env->cfg->aggressive_nsec) {
 		limit_nsec_ttl(qstate->return_msg);
 	}
 
 	/* Similar to the unbound worker, if serve-expired is enabled and
 	 * the msg would be considered to be expired, mark the state so a
-	 * refetch will be scheduled.  The comparison between 'expiry' and
-	 * 'now' should be redundant given how these values were calculated,
-	 * but we check it just in case as does good_expiry_and_qinfo(). */
-	if(qstate->env->cfg->serve_expired &&
-		!qstate->env->cfg->serve_expired_client_timeout &&
-		(adjust == -1 || (time_t)expiry < *qstate->env->now)) {
+	 * refetch will be scheduled. */
+	if(*msg_expired && !qstate->env->cfg->serve_expired_client_timeout) {
 		qstate->need_refetch = 1;
 	}
 
@@ -647,7 +644,7 @@ parse_data(struct module_qstate* qstate, struct sldns_buffer* buf,
  */
 static int
 cachedb_extcache_lookup(struct module_qstate* qstate, struct cachedb_env* ie,
-	int* msg_expired)
+	int* msg_expired, time_t* msg_timestamp, time_t* msg_expiry)
 {
 	char key[(CACHEDB_HASHSIZE/8)*2+1];
 	calc_hash(&qstate->qinfo, qstate->env, key, sizeof(key));
@@ -664,7 +661,8 @@ cachedb_extcache_lookup(struct module_qstate* qstate, struct cachedb_env* ie,
 	}
 
 	/* parse dns message into return_msg */
-	if( !parse_data(qstate, qstate->env->scratch_buffer, msg_expired) ) {
+	if( !parse_data(qstate, qstate->env->scratch_buffer, msg_expired,
+		msg_timestamp, msg_expiry) ) {
 		return 0;
 	}
 	return 1;
@@ -736,20 +734,24 @@ cachedb_intcache_lookup(struct module_qstate* qstate, struct cachedb_env* cde)
  * Store query into the internal cache of unbound.
  */
 static void
-cachedb_intcache_store(struct module_qstate* qstate, int msg_expired)
+cachedb_intcache_store(struct module_qstate* qstate, int msg_expired,
+	time_t msg_timestamp, time_t msg_expiry)
 {
 	uint32_t store_flags = qstate->query_flags;
 	int serve_expired = qstate->env->cfg->serve_expired;
-
-	if(qstate->env->cfg->serve_expired)
-		store_flags |= DNSCACHE_STORE_ZEROTTL;
 	if(!qstate->return_msg)
 		return;
 	if(serve_expired && msg_expired) {
-		/* Set TTLs to a value such that value + *env->now is
-		 * going to be now-3 seconds. Making it expired
-		 * in the cache. */
-		set_msg_ttl(qstate->return_msg, (time_t)-3);
+		time_t original_ttl = msg_expiry - msg_timestamp;
+		store_flags |= DNSCACHE_STORE_EXPIRED_MSG_CACHEDB;
+		/* Pass the original TTL of the expired message and signal with
+		 * the DNSCACHE_STORE_EXPIRED_MSG_CACHEDB flag that
+		 * dns_cache_store_msg() needs to set absolute expired TTLs
+		 * based on the original message TTL.
+		 * Results as expired message in the cache */
+		set_msg_ttl(qstate->return_msg, original_ttl, 0);
+		verbose(VERB_ALGO, "cachedb expired msg set to be expired now "
+			"(original ttl: %d)", (int)original_ttl);
 		/* The expired entry does not get checked by the validator
 		 * and we need a validation value for it. */
 		if(qstate->env->cfg->cachedb_check_when_serve_expired)
@@ -767,12 +769,14 @@ cachedb_intcache_store(struct module_qstate* qstate, int msg_expired)
 			 * of cache. */
 			return;
 		}
-		/* set TTLs to zero again */
-		adjust_msg_ttl(qstate->return_msg, -1);
 		/* Send serve expired responses based on the cachedb
 		 * returned message, that was just stored in the cache.
 		 * It can then continue to work on this query. */
 		mesh_respond_serve_expired(qstate->mesh_info);
+		/* set TTLs as expired for this return_msg in case it is used
+		 * later on */
+		set_msg_ttl(qstate->return_msg,
+			EXPIRED_REPLY_TTL_CALC(msg_expiry, msg_timestamp), 0);
 	}
 }
 
@@ -790,6 +794,7 @@ cachedb_handle_query(struct module_qstate* qstate,
 	struct cachedb_env* ie, int id)
 {
 	int msg_expired = 0;
+	time_t msg_timestamp, msg_expiry;
 	qstate->is_cachedb_answer = 0;
 	/* check if we are enabled, and skip if so */
 	if(!ie->enabled) {
@@ -824,13 +829,15 @@ cachedb_handle_query(struct module_qstate* qstate,
 	}
 
 	/* ask backend cache to see if we have data */
-	if(cachedb_extcache_lookup(qstate, ie, &msg_expired)) {
+	if(cachedb_extcache_lookup(qstate, ie, &msg_expired, &msg_timestamp,
+		&msg_expiry)) {
 		if(verbosity >= VERB_ALGO)
 			log_dns_msg(ie->backend->name,
 				&qstate->return_msg->qinfo,
 				qstate->return_msg->rep);
 		/* store this result in internal cache */
-		cachedb_intcache_store(qstate, msg_expired);
+		cachedb_intcache_store(qstate,
+			msg_expired, msg_timestamp, msg_expiry);
 		/* In case we have expired data but there is a client timer for expired
 		 * answers, pass execution to next module in order to try updating the
 		 * data first.
@@ -850,6 +857,8 @@ cachedb_handle_query(struct module_qstate* qstate,
 				qstate->ext_state[id] = module_wait_module;
 				return;
 		}
+		/* No 0TTL answers escaping from external cache. */
+		log_assert(qstate->return_msg->rep->ttl > 0);
 		qstate->is_cachedb_answer = 1;
 		/* we are done with the query */
 		qstate->ext_state[id] = module_finished;
diff --git a/cachedb/redis.c b/cachedb/redis.c
index 3dfa95859..9383f1c85 100644
--- a/cachedb/redis.c
+++ b/cachedb/redis.c
@@ -46,6 +46,8 @@
 #include "cachedb/cachedb.h"
 #include "util/alloc.h"
 #include "util/config_file.h"
+#include "util/locks.h"
+#include "util/timeval_func.h"
 #include "sldns/sbuffer.h"
 
 #ifdef USE_REDIS
@@ -75,6 +77,18 @@ struct redis_moddata {
 	/* timeout for connection setup */
 	struct timeval connect_timeout;
 	struct timeval replica_connect_timeout;
+	/* the reconnect interval time. */
+	struct timeval reconnect_interval;
+	struct timeval replica_reconnect_interval;
+	/* reconnect attempts, 0 if connected, counts up failed reconnects. */
+	int reconnect_attempts;
+	int replica_reconnect_attempts;
+	/* Lock on reconnect_wait time. */
+	lock_basic_type wait_lock;
+	lock_basic_type replica_wait_lock;
+	/* reconnect wait time, wait until it has passed before reconnect. */
+	struct timeval reconnect_wait;
+	struct timeval replica_reconnect_wait;
 	/* the redis logical database to use */
 	int logical_db;
 	int replica_logical_db;
@@ -82,6 +96,10 @@ struct redis_moddata {
 	int set_with_ex_available;
 };
 
+/** The limit on the number of redis connect attempts. After failure if
+ * the number is exceeded, the reconnects are throttled by the wait time. */
+#define REDIS_RECONNECT_ATTEMPT_LIMIT 3
+
 static redisReply* redis_command(struct module_env*, struct cachedb_env*,
 	const char*, const uint8_t*, size_t, int);
 
@@ -105,6 +123,8 @@ moddata_clean(struct redis_moddata** moddata) {
 		}
 		free((*moddata)->replica_ctxs);
 	}
+	lock_basic_destroy(&(*moddata)->wait_lock);
+	lock_basic_destroy(&(*moddata)->replica_wait_lock);
 	free(*moddata);
 	*moddata = NULL;
 }
@@ -113,10 +133,39 @@ static redisContext*
 redis_connect(const char* host, int port, const char* path,
 	const char* password, int logical_db,
 	const struct timeval connect_timeout,
-	const struct timeval command_timeout)
+	const struct timeval command_timeout,
+	const struct timeval* reconnect_interval,
+	int* reconnect_attempts,
+	struct timeval* reconnect_wait,
+	lock_basic_type* wait_lock,
+	struct timeval* now_tv,
+	const char* infostr)
 {
+	struct timeval now_val;
 	redisContext* ctx;
 
+	/* See if the redis server is down, and reconnect has to wait. */
+	if(*reconnect_attempts > REDIS_RECONNECT_ATTEMPT_LIMIT) {
+		/* Acquire lock to look at timeval, the integer has atomic
+		 * integrity. */
+		struct timeval wait_tv;
+		if(now_tv) {
+			now_val = *now_tv;
+		} else {
+			if(gettimeofday(&now_val, NULL) < 0)
+				log_err("redis: gettimeofday: %s",
+					strerror(errno));
+		}
+		lock_basic_lock(wait_lock);
+		wait_tv = *reconnect_wait;
+		lock_basic_unlock(wait_lock);
+		if(timeval_smaller(&now_val, &wait_tv)) {
+			verbose(VERB_ALGO, "redis %sdown, reconnect wait",
+				infostr);
+			return NULL;
+		}
+	}
+
 	if(path && path[0]!=0) {
 		ctx = redisConnectUnixWithTimeout(path, connect_timeout);
 	} else {
@@ -126,18 +175,18 @@ redis_connect(const char* host, int port, const char* path,
 		const char *errstr = "out of memory";
 		if(ctx)
 			errstr = ctx->errstr;
-		log_err("failed to connect to redis server: %s", errstr);
+		log_err("failed to connect to redis %sserver: %s", infostr, errstr);
 		goto fail;
 	}
 	if(redisSetTimeout(ctx, command_timeout) != REDIS_OK) {
-		log_err("failed to set redis timeout, %s", ctx->errstr);
+		log_err("failed to set redis %stimeout, %s", infostr, ctx->errstr);
 		goto fail;
 	}
 	if(password && password[0]!=0) {
 		redisReply* rep;
 		rep = redisCommand(ctx, "AUTH %s", password);
 		if(!rep || rep->type == REDIS_REPLY_ERROR) {
-			log_err("failed to authenticate with password");
+			log_err("failed to authenticate %swith password", infostr);
 			freeReplyObject(rep);
 			goto fail;
 		}
@@ -147,18 +196,20 @@ redis_connect(const char* host, int port, const char* path,
 		redisReply* rep;
 		rep = redisCommand(ctx, "SELECT %d", logical_db);
 		if(!rep || rep->type == REDIS_REPLY_ERROR) {
-			log_err("failed to set logical database (%d)",
-				logical_db);
+			log_err("failed %sto set logical database (%d)",
+				infostr, logical_db);
 			freeReplyObject(rep);
 			goto fail;
 		}
 		freeReplyObject(rep);
 	}
+	*reconnect_attempts = 0;
 	if(verbosity >= VERB_OPS) {
 		char port_str[6+1];
 		port_str[0] = ' ';
 		(void)snprintf(port_str+1, sizeof(port_str)-1, "%d", port);
-		verbose(VERB_OPS, "Connection to Redis established (%s%s)",
+		verbose(VERB_OPS, "Connection to Redis %sestablished (%s%s)",
+			infostr,
 			path&&path[0]!=0?path:host,
 			path&&path[0]!=0?"":port_str);
 	}
@@ -167,6 +218,25 @@ redis_connect(const char* host, int port, const char* path,
 fail:
 	if(ctx)
 		redisFree(ctx);
+	(*reconnect_attempts)++;
+	if(*reconnect_attempts > REDIS_RECONNECT_ATTEMPT_LIMIT) {
+		/* Wait for the reconnect interval before trying again. */
+		struct timeval tv;
+		if(now_tv) {
+			now_val = *now_tv;
+		} else {
+			if(gettimeofday(&now_val, NULL) < 0)
+				log_err("redis: gettimeofday: %s",
+					strerror(errno));
+		}
+		tv = now_val;
+		timeval_add(&tv, reconnect_interval);
+		lock_basic_lock(wait_lock);
+		*reconnect_wait = tv;
+		lock_basic_unlock(wait_lock);
+		verbose(VERB_ALGO, "redis %sreconnect wait until %d.%6.6d",
+			infostr, (int)tv.tv_sec, (int)tv.tv_usec);
+	}
 	return NULL;
 }
 
@@ -191,6 +261,13 @@ redis_init(struct module_env* env, struct cachedb_env* cachedb_env)
 		log_err("out of memory");
 		goto fail;
 	}
+	lock_basic_init(&moddata->wait_lock);
+	lock_protect(&moddata->wait_lock, &moddata->reconnect_wait,
+		sizeof(moddata->reconnect_wait));
+	lock_basic_init(&moddata->replica_wait_lock);
+	lock_protect(&moddata->replica_wait_lock,
+		&moddata->replica_reconnect_wait,
+		sizeof(moddata->replica_reconnect_wait));
 	moddata->numctxs = env->cfg->num_threads;
 	/* note: server_host and similar string configuration options are
 	 * shallow references to configured strings; we don't have to free them
@@ -219,6 +296,8 @@ redis_init(struct module_env* env, struct cachedb_env* cachedb_env)
 	set_timeout(&moddata->replica_connect_timeout,
 		env->cfg->redis_replica_timeout,
 		env->cfg->redis_replica_connect_timeout);
+	set_timeout(&moddata->reconnect_interval, 1000, 0);
+	set_timeout(&moddata->replica_reconnect_interval, 1000, 0);
 
 	moddata->logical_db = env->cfg->redis_logical_db;
 	moddata->replica_logical_db = env->cfg->redis_replica_logical_db;
@@ -245,7 +324,13 @@ redis_init(struct module_env* env, struct cachedb_env* cachedb_env)
 			moddata->server_password,
 			moddata->logical_db,
 			moddata->connect_timeout,
-			moddata->command_timeout);
+			moddata->command_timeout,
+			&moddata->reconnect_interval,
+			&moddata->reconnect_attempts,
+			&moddata->reconnect_wait,
+			&moddata->wait_lock,
+			env->now_tv,
+			"");
 		if(!ctx) {
 			log_err("redis_init: failed to init redis "
 				"(for thread %d)", i);
@@ -263,7 +348,13 @@ redis_init(struct module_env* env, struct cachedb_env* cachedb_env)
 				moddata->replica_server_password,
 				moddata->replica_logical_db,
 				moddata->replica_connect_timeout,
-				moddata->replica_command_timeout);
+				moddata->replica_command_timeout,
+				&moddata->replica_reconnect_interval,
+				&moddata->replica_reconnect_attempts,
+				&moddata->replica_reconnect_wait,
+				&moddata->replica_wait_lock,
+				env->now_tv,
+				"replica ");
 			if(!ctx) {
 				log_err("redis_init: failed to init redis "
 					"replica (for thread %d)", i);
@@ -301,7 +392,7 @@ redis_init(struct module_env* env, struct cachedb_env* cachedb_env)
 set_with_ex_fail:
 	log_err("redis_init: failure during redis_init, the "
 		"redis-expire-records option requires the SET with EX command "
-		"(redis >= 2.6.2)");
+		"(redis >= 2.6.12)");
 	return 1;
 fail:
 	moddata_clean(&moddata);
@@ -364,7 +455,13 @@ redis_command(struct module_env* env, struct cachedb_env* cachedb_env,
 				d->replica_server_password,
 				d->replica_logical_db,
 				d->replica_connect_timeout,
-				d->replica_command_timeout);
+				d->replica_command_timeout,
+				&d->replica_reconnect_interval,
+				&d->replica_reconnect_attempts,
+				&d->replica_reconnect_wait,
+				&d->replica_wait_lock,
+				env->now_tv,
+				"replica ");
 		} else {
 			ctx = redis_connect(
 				d->server_host,
@@ -373,7 +470,13 @@ redis_command(struct module_env* env, struct cachedb_env* cachedb_env,
 				d->server_password,
 				d->logical_db,
 				d->connect_timeout,
-				d->command_timeout);
+				d->command_timeout,
+				&d->reconnect_interval,
+				&d->reconnect_attempts,
+				&d->reconnect_wait,
+				&d->wait_lock,
+				env->now_tv,
+				"");
 		}
 		ctx_selector[env->alloc->thread_num] = ctx;
 	}
@@ -405,7 +508,14 @@ redis_lookup(struct module_env* env, struct cachedb_env* cachedb_env,
 	char* key, struct sldns_buffer* result_buffer)
 {
 	redisReply* rep;
-	char cmdbuf[4+(CACHEDB_HASHSIZE/8)*2+1]; /* "GET " + key */
+	/* Supported commands:
+	 * - "GET " + key
+	 */
+#define REDIS_LOOKUP_MAX_BUF_LEN			\
+	4				/* "GET " */	\
+	+(CACHEDB_HASHSIZE/8)*2		/* key hash */	\
+	+ 1				/* \0 */
+	char cmdbuf[REDIS_LOOKUP_MAX_BUF_LEN];
 	int n;
 	int ret = 0;
 
@@ -465,7 +575,13 @@ redis_store(struct module_env* env, struct cachedb_env* cachedb_env,
 	 *   older redis 2.0.0 was "SETEX " + key + " " + ttl + " %b"
 	 * - "EXPIRE " + key + " 0"
 	 */
-	char cmdbuf[6+(CACHEDB_HASHSIZE/8)*2+11+3+1];
+#define REDIS_STORE_MAX_BUF_LEN				\
+	7			/* "EXPIRE " */		\
+	+(CACHEDB_HASHSIZE/8)*2	/* key hash */		\
+	+ 7			/* " %b EX " */		\
+	+ 20			/* ttl (uint64_t) */	\
+	+ 1			/* \0 */
+	char cmdbuf[REDIS_STORE_MAX_BUF_LEN];
 
 	if (!set_ttl) {
 		verbose(VERB_ALGO, "redis_store %s (%d bytes)", key, (int)data_len);
diff --git a/config.h.in b/config.h.in
index 1646c3863..b2c1bc9fd 100644
--- a/config.h.in
+++ b/config.h.in
@@ -66,6 +66,9 @@
 /* Whether the C compiler accepts the "format" attribute */
 #undef HAVE_ATTR_FORMAT
 
+/* Whether the C compiler accepts the "nonstring" attribute */
+#undef HAVE_ATTR_NONSTRING
+
 /* Whether the C compiler accepts the "noreturn" attribute */
 #undef HAVE_ATTR_NORETURN
 
@@ -1390,6 +1393,17 @@
 #endif /* !HAVE_ATTR_UNUSED */
 
 
+#if defined(DOXYGEN)
+#  define ATTR_NONSTRING(x)  x
+#elif defined(__cplusplus)
+#  define ATTR_NONSTRING(x)  __attribute__((nonstring)) x
+#elif defined(HAVE_ATTR_NONSTRING)
+#  define ATTR_NONSTRING(x)  __attribute__((nonstring)) x
+#else /* !HAVE_ATTR_NONSTRING */
+#  define ATTR_NONSTRING(x)  x
+#endif /* !HAVE_ATTR_NONSTRING */
+
+
 #ifndef HAVE_FSEEKO
 #define fseeko fseek
 #define ftello ftell
diff --git a/configure b/configure
index 3b08e096b..3d776cb6a 100755
--- a/configure
+++ b/configure
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.71 for unbound 1.23.2.
+# Generated by GNU Autoconf 2.71 for unbound 1.24.1.
 #
 # Report bugs to <unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues>.
 #
@@ -622,8 +622,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='unbound'
 PACKAGE_TARNAME='unbound'
-PACKAGE_VERSION='1.23.2'
-PACKAGE_STRING='unbound 1.23.2'
+PACKAGE_VERSION='1.24.1'
+PACKAGE_STRING='unbound 1.24.1'
 PACKAGE_BUGREPORT='unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues'
 PACKAGE_URL=''
 
@@ -1514,7 +1514,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures unbound 1.23.2 to adapt to many kinds of systems.
+\`configure' configures unbound 1.24.1 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1580,7 +1580,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of unbound 1.23.2:";;
+     short | recursive ) echo "Configuration of unbound 1.24.1:";;
    esac
   cat <<\_ACEOF
 
@@ -1833,7 +1833,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-unbound configure 1.23.2
+unbound configure 1.24.1
 generated by GNU Autoconf 2.71
 
 Copyright (C) 2021 Free Software Foundation, Inc.
@@ -2490,7 +2490,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by unbound $as_me 1.23.2, which was
+It was created by unbound $as_me 1.24.1, which was
 generated by GNU Autoconf 2.71.  Invocation command line was
 
   $ $0$ac_configure_args_raw
@@ -3252,13 +3252,13 @@ ac_compiler_gnu=$ac_cv_c_compiler_gnu
 
 UNBOUND_VERSION_MAJOR=1
 
-UNBOUND_VERSION_MINOR=23
+UNBOUND_VERSION_MINOR=24
 
-UNBOUND_VERSION_MICRO=2
+UNBOUND_VERSION_MICRO=1
 
 
 LIBUNBOUND_CURRENT=9
-LIBUNBOUND_REVISION=33
+LIBUNBOUND_REVISION=34
 LIBUNBOUND_AGE=1
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -3358,7 +3358,8 @@ LIBUNBOUND_AGE=1
 # 1.22.0 had 9:30:1
 # 1.23.0 had 9:31:1
 # 1.23.1 had 9:32:1
-# 1.23.2 had 9:33:1
+# 1.24.0 had 9:33:1
+# 1.24.1 had 9:34:1
 
 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -6948,6 +6949,53 @@ printf "%s\n" "#define HAVE_ATTR_UNUSED 1" >>confdefs.h
 fi
 
 
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether the C compiler (${CC-cc}) accepts the \"nonstring\" attribute" >&5
+printf %s "checking whether the C compiler (${CC-cc}) accepts the \"nonstring\" attribute... " >&6; }
+if test ${ac_cv_c_nonstring_attribute+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
+  ac_cv_c_nonstring_attribute=no
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+#include <stdio.h>
+struct test {
+    char __attribute__((nonstring)) s[1];
+};
+
+int
+main (void)
+{
+
+   struct test t = { "1" };
+   (void) t;
+
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_compile "$LINENO"
+then :
+  ac_cv_c_nonstring_attribute="yes"
+else $as_nop
+  ac_cv_c_nonstring_attribute="no"
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
+
+fi
+
+
+
+
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_nonstring_attribute" >&5
+printf "%s\n" "$ac_cv_c_nonstring_attribute" >&6; }
+if test $ac_cv_c_nonstring_attribute = yes; then
+
+printf "%s\n" "#define HAVE_ATTR_NONSTRING 1" >>confdefs.h
+
+fi
+
+
 
 
 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether the C compiler (${CC-cc}) accepts the \"weak\" attribute" >&5
@@ -18123,7 +18171,9 @@ if test x_$enable_alloc_nonregional = x_yes; then
 printf "%s\n" "#define UNBOUND_ALLOC_NONREGIONAL 1" >>confdefs.h
 
 fi
-if test x_$enable_alloc_checks = x_yes; then
+if test x_$enable_alloc_checks = x_yes
+then :
+
 
 printf "%s\n" "#define UNBOUND_ALLOC_STATS 1" >>confdefs.h
 
@@ -18131,28 +18181,29 @@ printf "%s\n" "#define UNBOUND_ALLOC_STATS 1" >>confdefs.h
 
 	ASYNCLOOK_ALLOCCHECK_EXTRA_OBJ="alloc.lo"
 
-else
-	if test x_$enable_alloc_lite = x_yes; then
+
+else $as_nop
+
+	if test x_$enable_alloc_lite = x_yes
+then :
+
 
 printf "%s\n" "#define UNBOUND_ALLOC_LITE 1" >>confdefs.h
 
-	else
+
+else $as_nop
+
 
 	{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for GNU libc compatible malloc" >&5
 printf %s "checking for GNU libc compatible malloc... " >&6; }
-	if test "$cross_compiling" = yes
+if test ${ac_cv_func_malloc_0_nonnull+y}
 then :
-  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no (crosscompile)" >&5
-printf "%s\n" "no (crosscompile)" >&6; }
-	case " $LIBOBJS " in
-  *" malloc.$ac_objext "* ) ;;
-  *) LIBOBJS="$LIBOBJS malloc.$ac_objext"
- ;;
-esac
-
-
-printf "%s\n" "#define malloc rpl_malloc_unbound" >>confdefs.h
+  printf %s "(cached) " >&6
+else $as_nop
 
+		if test "$cross_compiling" = yes
+then :
+  ac_cv_func_malloc_0_nonnull="no (crosscompile)"
 else $as_nop
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
@@ -18173,9 +18224,26 @@ main (void)
 _ACEOF
 if ac_fn_c_try_run "$LINENO"
 then :
-  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
-printf "%s\n" "no" >&6; }
-	case " $LIBOBJS " in
+  ac_cv_func_malloc_0_nonnull=no
+else $as_nop
+  ac_cv_func_malloc_0_nonnull=yes
+fi
+rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
+  conftest.$ac_objext conftest.beam conftest.$ac_ext
+fi
+
+
+fi
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_func_malloc_0_nonnull" >&5
+printf "%s\n" "$ac_cv_func_malloc_0_nonnull" >&6; }
+	if test "$ac_cv_func_malloc_0_nonnull" = yes
+then :
+
+printf "%s\n" "#define HAVE_MALLOC 1" >>confdefs.h
+
+else $as_nop
+
+		case " $LIBOBJS " in
   *" malloc.$ac_objext "* ) ;;
   *) LIBOBJS="$LIBOBJS malloc.$ac_objext"
  ;;
@@ -18184,19 +18252,12 @@ esac
 
 printf "%s\n" "#define malloc rpl_malloc_unbound" >>confdefs.h
 
-else $as_nop
-  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-printf "%s\n" "yes" >&6; }
-
-printf "%s\n" "#define HAVE_MALLOC 1" >>confdefs.h
 
 fi
-rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
-  conftest.$ac_objext conftest.beam conftest.$ac_ext
+
+
 fi
 
-
-	fi
 fi
 
 # check windows threads (we use them, not pthreads, on windows).
@@ -25460,7 +25521,7 @@ printf "%s\n" "#define MAXSYSLOGMSGLEN 10240" >>confdefs.h
 
 
 
-version=1.23.2
+version=1.24.1
 
 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for build time" >&5
 printf %s "checking for build time... " >&6; }
@@ -25990,7 +26051,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by unbound $as_me 1.23.2, which was
+This file was extended by unbound $as_me 1.24.1, which was
 generated by GNU Autoconf 2.71.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -26058,7 +26119,7 @@ ac_cs_config_escaped=`printf "%s\n" "$ac_cs_config" | sed "s/^ //; s/'/'\\\\\\\\
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config='$ac_cs_config_escaped'
 ac_cs_version="\\
-unbound config.status 1.23.2
+unbound config.status 1.24.1
 configured by $0, generated by GNU Autoconf 2.71,
   with options \\"\$ac_cs_config\\"
 
diff --git a/configure.ac b/configure.ac
index 9685dac0c..ad7ec3e35 100644
--- a/configure.ac
+++ b/configure.ac
@@ -11,15 +11,15 @@ sinclude(dnscrypt/dnscrypt.m4)
 
 # must be numbers. ac_defun because of later processing
 m4_define([VERSION_MAJOR],[1])
-m4_define([VERSION_MINOR],[23])
-m4_define([VERSION_MICRO],[2])
+m4_define([VERSION_MINOR],[24])
+m4_define([VERSION_MICRO],[1])
 AC_INIT([unbound],m4_defn([VERSION_MAJOR]).m4_defn([VERSION_MINOR]).m4_defn([VERSION_MICRO]),[unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues],[unbound])
 AC_SUBST(UNBOUND_VERSION_MAJOR, [VERSION_MAJOR])
 AC_SUBST(UNBOUND_VERSION_MINOR, [VERSION_MINOR])
 AC_SUBST(UNBOUND_VERSION_MICRO, [VERSION_MICRO])
 
 LIBUNBOUND_CURRENT=9
-LIBUNBOUND_REVISION=33
+LIBUNBOUND_REVISION=34
 LIBUNBOUND_AGE=1
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -119,7 +119,8 @@ LIBUNBOUND_AGE=1
 # 1.22.0 had 9:30:1
 # 1.23.0 had 9:31:1
 # 1.23.1 had 9:32:1
-# 1.23.2 had 9:33:1
+# 1.24.0 had 9:33:1
+# 1.24.1 had 9:34:1
 
 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -328,6 +329,7 @@ fi
 AC_C_INLINE
 ACX_CHECK_FORMAT_ATTRIBUTE
 ACX_CHECK_UNUSED_ATTRIBUTE
+ACX_CHECK_NONSTRING_ATTRIBUTE
 
 AC_DEFUN([CHECK_WEAK_ATTRIBUTE],
 [AC_REQUIRE([AC_PROG_CC])
@@ -633,19 +635,19 @@ AC_ARG_ENABLE(alloc-nonregional, AS_HELP_STRING([--enable-alloc-nonregional],[ e
 if test x_$enable_alloc_nonregional = x_yes; then
 	AC_DEFINE(UNBOUND_ALLOC_NONREGIONAL, 1, [use malloc not regions, for debug use])
 fi
-if test x_$enable_alloc_checks = x_yes; then
+AS_IF([test x_$enable_alloc_checks = x_yes],[
 	AC_DEFINE(UNBOUND_ALLOC_STATS, 1, [use statistics for allocs and frees, for debug use])
 	SLDNS_ALLOCCHECK_EXTRA_OBJ="alloc.lo log.lo"
 	AC_SUBST(SLDNS_ALLOCCHECK_EXTRA_OBJ)
 	ASYNCLOOK_ALLOCCHECK_EXTRA_OBJ="alloc.lo"
 	AC_SUBST(ASYNCLOOK_ALLOCCHECK_EXTRA_OBJ)
-else
-	if test x_$enable_alloc_lite = x_yes; then
+],[
+	AS_IF([test x_$enable_alloc_lite = x_yes],[
 		AC_DEFINE(UNBOUND_ALLOC_LITE, 1, [use to enable lightweight alloc assertions, for debug use])
-	else
+	],[
 		ACX_FUNC_MALLOC([unbound])
-	fi
-fi
+	])
+])
 
 # check windows threads (we use them, not pthreads, on windows).
 if test "$on_mingw" = "yes"; then
@@ -2291,6 +2293,7 @@ dnl includes
 
 AHX_CONFIG_FORMAT_ATTRIBUTE
 AHX_CONFIG_UNUSED_ATTRIBUTE
+AHX_CONFIG_NONSTRING_ATTRIBUTE
 AHX_CONFIG_FSEEKO
 AHX_CONFIG_MAXHOSTNAMELEN
 #if !defined(HAVE_SNPRINTF) || defined(SNPRINTF_RET_BROKEN)
diff --git a/contrib/aaaa-filter-iterator.patch b/contrib/aaaa-filter-iterator.patch
index b0c2b2198..4ada03073 100644
--- a/contrib/aaaa-filter-iterator.patch
+++ b/contrib/aaaa-filter-iterator.patch
@@ -1,10 +1,10 @@
 diff --git a/doc/unbound.conf.5.in b/doc/unbound.conf.5.in
-index 5a75e319..c6c6dbe2 100644
+index 172eb26c..2921c87f 100644
 --- a/doc/unbound.conf.5.in
 +++ b/doc/unbound.conf.5.in
-@@ -970,6 +970,13 @@ potentially broken nameservers. A lot of domains will not be resolvable when
- this option in enabled. Only use if you know what you are doing.
- This option only has effect when qname-minimisation is enabled. Default is no.
+@@ -2146,6 +2146,13 @@ Default: no
+ .UNINDENT
+ .INDENT 0.0
  .TP
 +.B aaaa\-filter: \fI<yes or no>
 +Activate behavior similar to BIND's AAAA-filter.
@@ -13,14 +13,14 @@ index 5a75e319..c6c6dbe2 100644
 +This also causes an additional A query to be sent for each AAAA query.
 +This breaks DNSSEC!
 +.TP
- .B aggressive\-nsec: \fI<yes or no>
- Aggressive NSEC uses the DNSSEC NSEC chain to synthesize NXDOMAIN
- and other denials, using information from previous NXDOMAINs answers.
+ .B aggressive\-nsec: \fI<yes or no>\fP 
+ Aggressive NSEC uses the DNSSEC NSEC chain to synthesize NXDOMAIN and other
+ denials, using information from previous NXDOMAINs answers.
 diff --git a/iterator/iter_scrub.c b/iterator/iter_scrub.c
-index f093c1bf..e55a2246 100644
+index 49a5f5da..fbe434fa 100644
 --- a/iterator/iter_scrub.c
 +++ b/iterator/iter_scrub.c
-@@ -679,6 +679,32 @@ static int sanitize_nsec_is_overreach(sldns_buffer* pkt,
+@@ -849,6 +849,32 @@ scrub_sanitize_rr_length(sldns_buffer* pkt, struct msg_parse* msg,
  	return 0;
  }
  
@@ -53,15 +53,15 @@ index f093c1bf..e55a2246 100644
  /**
   * Given a response event, remove suspect RRsets from the response.
   * "Suspect" rrsets are potentially poison. Note that this routine expects
-@@ -698,6 +724,7 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
+@@ -869,6 +895,7 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
  	struct query_info* qinfo, uint8_t* zonename, struct module_env* env,
- 	struct iter_env* ie)
+ 	struct iter_env* ie, struct module_qstate* qstate)
  {
 +	int found_a_record = 0; /* ASN: do we have a A record? */
  	int del_addi = 0; /* if additional-holding rrsets are deleted, we
  		do not trust the normalized additional-A-AAAA any more */
- 	struct rrset_parse* rrset, *prev;
-@@ -733,6 +760,13 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
+ 	uint8_t* ns_rrset_dname = NULL;
+@@ -906,6 +933,13 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
  		rrset = rrset->rrset_all_next;
  	}
  
@@ -75,9 +75,9 @@ index f093c1bf..e55a2246 100644
  	/* At this point, we brutally remove ALL rrsets that aren't 
  	 * children of the originating zone. The idea here is that, 
  	 * as far as we know, the server that we contacted is ONLY 
-@@ -744,6 +778,24 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
- 	rrset = msg->rrset_first;
- 	while(rrset) {
+@@ -925,6 +959,24 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
+ 				continue;
+ 		}
  
 +		/* ASN: For AAAA records only... */
 +		if((ie->aaaa_filter) && (rrset->type == LDNS_RR_TYPE_AAAA)) {
@@ -101,10 +101,10 @@ index f093c1bf..e55a2246 100644
  		if( (rrset->type == LDNS_RR_TYPE_A || 
  			rrset->type == LDNS_RR_TYPE_AAAA)) {
 diff --git a/iterator/iter_utils.c b/iterator/iter_utils.c
-index 2482a1f4..bd5ba243 100644
+index 1da21896..6583dd0e 100644
 --- a/iterator/iter_utils.c
 +++ b/iterator/iter_utils.c
-@@ -177,6 +177,7 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)
+@@ -250,6 +250,7 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)
  	iter_env->outbound_msg_retry = cfg->outbound_msg_retry;
  	iter_env->max_sent_count = cfg->max_sent_count;
  	iter_env->max_query_restarts = cfg->max_query_restarts;
@@ -113,12 +113,12 @@ index 2482a1f4..bd5ba243 100644
  }
  
 diff --git a/iterator/iterator.c b/iterator/iterator.c
-index 54006940..768fe202 100644
+index 71e64655..735f4ca0 100644
 --- a/iterator/iterator.c
 +++ b/iterator/iterator.c
-@@ -2155,6 +2155,53 @@ processDSNSFind(struct module_qstate* qstate, struct iter_qstate* iq, int id)
- 
- 	return 0;
+@@ -2412,6 +2412,53 @@ check_waiting_queries(struct iter_qstate* iq, struct module_qstate* qstate,
+ 		qstate->ext_state[id] = module_wait_reply;
+ 	}
  }
 +
 +/**
@@ -170,8 +170,8 @@ index 54006940..768fe202 100644
  	
  /** 
   * This is the request event state where the request will be sent to one of
-@@ -2216,6 +2263,13 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
- 		return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
+@@ -2554,6 +2601,13 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
+ 		}
  	}
  	
 +	/* ASN: If we have a AAAA query, then also query for A records */
@@ -184,7 +184,7 @@ index 54006940..768fe202 100644
  	/* Make sure we have a delegation point, otherwise priming failed
  	 * or another failure occurred */
  	if(!iq->dp) {
-@@ -3648,6 +3702,61 @@ processFinished(struct module_qstate* qstate, struct iter_qstate* iq,
+@@ -4178,6 +4232,61 @@ processFinished(struct module_qstate* qstate, struct iter_qstate* iq,
  	return 0;
  }
  
@@ -246,7 +246,7 @@ index 54006940..768fe202 100644
  /*
   * Return priming query results to interested super querystates.
   * 
-@@ -3667,6 +3776,9 @@ iter_inform_super(struct module_qstate* qstate, int id,
+@@ -4197,6 +4306,9 @@ iter_inform_super(struct module_qstate* qstate, int id,
  	else if(super->qinfo.qtype == LDNS_RR_TYPE_DS && ((struct iter_qstate*)
  		super->minfo[id])->state == DSNS_FIND_STATE)
  		processDSNSResponse(qstate, id, super);
@@ -256,7 +256,7 @@ index 54006940..768fe202 100644
  	else if(qstate->return_rcode != LDNS_RCODE_NOERROR)
  		error_supers(qstate, id, super);
  	else if(qstate->is_priming)
-@@ -3704,6 +3816,9 @@ iter_handle(struct module_qstate* qstate, struct iter_qstate* iq,
+@@ -4234,6 +4346,9 @@ iter_handle(struct module_qstate* qstate, struct iter_qstate* iq,
  			case INIT_REQUEST_3_STATE:
  				cont = processInitRequest3(qstate, iq, id);
  				break;
@@ -266,7 +266,7 @@ index 54006940..768fe202 100644
  			case QUERYTARGETS_STATE:
  				cont = processQueryTargets(qstate, iq, ie, id);
  				break;
-@@ -4040,6 +4155,8 @@ iter_state_to_string(enum iter_state state)
+@@ -4578,6 +4693,8 @@ iter_state_to_string(enum iter_state state)
  		return "INIT REQUEST STATE (stage 2)";
  	case INIT_REQUEST_3_STATE:
  		return "INIT REQUEST STATE (stage 3)";
@@ -275,7 +275,7 @@ index 54006940..768fe202 100644
  	case QUERYTARGETS_STATE :
  		return "QUERY TARGETS STATE";
  	case PRIME_RESP_STATE :
-@@ -4064,6 +4181,7 @@ iter_state_is_responsestate(enum iter_state s)
+@@ -4602,6 +4719,7 @@ iter_state_is_responsestate(enum iter_state s)
  		case INIT_REQUEST_STATE :
  		case INIT_REQUEST_2_STATE :
  		case INIT_REQUEST_3_STATE :
@@ -284,10 +284,10 @@ index 54006940..768fe202 100644
  		case COLLECT_CLASS_STATE :
  			return 0;
 diff --git a/iterator/iterator.h b/iterator/iterator.h
-index 8b840528..a61c4195 100644
+index ae4b4e45..a44f9d27 100644
 --- a/iterator/iterator.h
 +++ b/iterator/iterator.h
-@@ -133,6 +133,9 @@ struct iter_env {
+@@ -157,6 +157,9 @@ struct iter_env {
  	 */
  	int* target_fetch_policy;
  
@@ -297,7 +297,7 @@ index 8b840528..a61c4195 100644
  	/** lock on ratelimit counter */
  	lock_basic_type queries_ratelimit_lock;
  	/** number of queries that have been ratelimited */
-@@ -187,6 +190,14 @@ enum iter_state {
+@@ -217,6 +220,14 @@ enum iter_state {
  	 */
  	INIT_REQUEST_3_STATE,
  
@@ -312,9 +312,9 @@ index 8b840528..a61c4195 100644
  	/**
  	 * Each time a delegation point changes for a given query or a 
  	 * query times out and/or wakes up, this state is (re)visited. 
-@@ -376,6 +387,13 @@ struct iter_qstate {
- 	 */
- 	int refetch_glue;
+@@ -434,6 +445,13 @@ struct iter_qstate {
+ 	 * already so that it is accepted later. */
+ 	int empty_nodata_found;
  
 +	/**
 +	 * ASN: This is a flag that, if true, means that this query is
@@ -327,10 +327,10 @@ index 8b840528..a61c4195 100644
  	struct outbound_list outlist;
  
 diff --git a/pythonmod/interface.i b/pythonmod/interface.i
-index 1ca8686a..d91b19ec 100644
+index 2040fb9e..f073c3dc 100644
 --- a/pythonmod/interface.i
 +++ b/pythonmod/interface.i
-@@ -995,6 +995,7 @@ struct config_file {
+@@ -1013,6 +1013,7 @@ struct config_file {
     int harden_dnssec_stripped;
     int harden_referral_path;
     int use_caps_bits_for_id;
@@ -339,23 +339,23 @@ index 1ca8686a..d91b19ec 100644
     struct config_strlist* private_domain;
     size_t unwanted_threshold;
 diff --git a/util/config_file.c b/util/config_file.c
-index 969d664b..8d94b008 100644
+index b1e767b3..5eb3c099 100644
 --- a/util/config_file.c
 +++ b/util/config_file.c
-@@ -231,6 +231,7 @@ config_create(void)
- 	cfg->harden_referral_path = 0;
+@@ -247,6 +247,7 @@ config_create(void)
  	cfg->harden_algo_downgrade = 0;
+ 	cfg->harden_unknown_additional = 0;
  	cfg->use_caps_bits_for_id = 0;
 +	cfg->aaaa_filter = 0; /* ASN: default is disabled */
  	cfg->caps_whitelist = NULL;
  	cfg->private_address = NULL;
  	cfg->private_domain = NULL;
 diff --git a/util/config_file.h b/util/config_file.h
-index c7c9a0a4..e3aa15b0 100644
+index 44ac036b..1e59ab07 100644
 --- a/util/config_file.h
 +++ b/util/config_file.h
-@@ -285,6 +285,8 @@ struct config_file {
- 	int harden_algo_downgrade;
+@@ -311,6 +311,8 @@ struct config_file {
+ 	int harden_unknown_additional;
  	/** use 0x20 bits in query as random ID bits */
  	int use_caps_bits_for_id;
 +	/** ASN: enable AAAA filter? */
@@ -364,10 +364,10 @@ index c7c9a0a4..e3aa15b0 100644
  	struct config_strlist* caps_whitelist;
  	/** strip away these private addrs from answers, no DNS Rebinding */
 diff --git a/util/configlexer.lex b/util/configlexer.lex
-index 34a0e5dd..c890be2a 100644
+index bc258673..76aab170 100644
 --- a/util/configlexer.lex
 +++ b/util/configlexer.lex
-@@ -317,6 +317,7 @@ use-caps-for-id{COLON}		{ YDVAR(1, VAR_USE_CAPS_FOR_ID) }
+@@ -327,6 +327,7 @@ use-caps-for-id{COLON}		{ YDVAR(1, VAR_USE_CAPS_FOR_ID) }
  caps-whitelist{COLON}		{ YDVAR(1, VAR_CAPS_WHITELIST) }
  caps-exempt{COLON}		{ YDVAR(1, VAR_CAPS_WHITELIST) }
  unwanted-reply-threshold{COLON}	{ YDVAR(1, VAR_UNWANTED_REPLY_THRESHOLD) }
@@ -376,10 +376,10 @@ index 34a0e5dd..c890be2a 100644
  private-domain{COLON}		{ YDVAR(1, VAR_PRIVATE_DOMAIN) }
  prefetch-key{COLON}		{ YDVAR(1, VAR_PREFETCH_KEY) }
 diff --git a/util/configparser.y b/util/configparser.y
-index d4f965f9..8cc237c6 100644
+index 82e1d878..dc19bed5 100644
 --- a/util/configparser.y
 +++ b/util/configparser.y
-@@ -97,6 +97,7 @@ extern struct config_parser_state* cfg_parser;
+@@ -100,6 +100,7 @@ extern struct config_parser_state* cfg_parser;
  %token VAR_STATISTICS_CUMULATIVE VAR_OUTGOING_PORT_PERMIT
  %token VAR_OUTGOING_PORT_AVOID VAR_DLV_ANCHOR_FILE VAR_DLV_ANCHOR
  %token VAR_NEG_CACHE_SIZE VAR_HARDEN_REFERRAL_PATH VAR_PRIVATE_ADDRESS
@@ -387,7 +387,7 @@ index d4f965f9..8cc237c6 100644
  %token VAR_PRIVATE_DOMAIN VAR_REMOTE_CONTROL VAR_CONTROL_ENABLE
  %token VAR_CONTROL_INTERFACE VAR_CONTROL_PORT VAR_SERVER_KEY_FILE
  %token VAR_SERVER_CERT_FILE VAR_CONTROL_KEY_FILE VAR_CONTROL_CERT_FILE
-@@ -247,6 +248,7 @@ content_server: server_num_threads | server_verbosity | server_port |
+@@ -276,6 +277,7 @@ content_server: server_num_threads | server_verbosity | server_port |
  	server_dlv_anchor_file | server_dlv_anchor | server_neg_cache_size |
  	server_harden_referral_path | server_private_address |
  	server_private_domain | server_extended_statistics |
@@ -395,7 +395,7 @@ index d4f965f9..8cc237c6 100644
  	server_local_data_ptr | server_jostle_timeout |
  	server_unwanted_reply_threshold | server_log_time_ascii |
  	server_domain_insecure | server_val_sig_skew_min |
-@@ -1754,6 +1756,15 @@ server_caps_whitelist: VAR_CAPS_WHITELIST STRING_ARG
+@@ -1932,6 +1934,15 @@ server_caps_whitelist: VAR_CAPS_WHITELIST STRING_ARG
  			yyerror("out of memory");
  	}
  	;
diff --git a/contrib/unbound.service.in b/contrib/unbound.service.in
index 8a5d3b2b0..b05e2c959 100644
--- a/contrib/unbound.service.in
+++ b/contrib/unbound.service.in
@@ -38,11 +38,17 @@
 ;   - `LockPersonality=yes` locks down the personality system call so that the
 ;     kernel execution domain may not be changed from the default.
 ;
+;   - With /etc/systemd/network/*.network a setting to make sure the network
+;     is not considered online too early, can reduce network unreachable
+;     errors on server start:
+;     [Link]
+;     RequiredForOnline=routable
 ;
 [Unit]
 Description=Validating, recursive, and caching DNS resolver
 Documentation=man:unbound(8)
 After=network-online.target
+Wants=network-online.target
 Before=nss-lookup.target
 
 [Install]
@@ -53,7 +59,7 @@ ExecReload=+/bin/kill -HUP $MAINPID
 ExecStart=@UNBOUND_SBIN_DIR@/unbound -d -p
 NotifyAccess=main
 Type=notify
-CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_SYS_RESOURCE CAP_NET_RAW
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_SYS_RESOURCE CAP_NET_ADMIN
 MemoryDenyWriteExecute=true
 NoNewPrivileges=true
 PrivateDevices=true
diff --git a/contrib/unbound_portable.service.in b/contrib/unbound_portable.service.in
index 22cd44638..d03197d55 100644
--- a/contrib/unbound_portable.service.in
+++ b/contrib/unbound_portable.service.in
@@ -26,7 +26,7 @@ ExecReload=+/bin/kill -HUP $MAINPID
 ExecStart=@UNBOUND_SBIN_DIR@/unbound -d -p
 NotifyAccess=main
 Type=notify
-CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_SYS_RESOURCE CAP_NET_RAW
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_SYS_RESOURCE CAP_NET_ADMIN
 MemoryDenyWriteExecute=true
 NoNewPrivileges=true
 PrivateDevices=true
diff --git a/daemon/cachedump.c b/daemon/cachedump.c
index ba986c763..f0a693bf6 100644
--- a/daemon/cachedump.c
+++ b/daemon/cachedump.c
@@ -62,84 +62,231 @@
 #include "sldns/wire2str.h"
 #include "sldns/str2wire.h"
 
+static void spool_txt_printf(struct config_strlist_head* txt,
+	const char* format, ...) ATTR_FORMAT(printf, 2, 3);
+
+/** Append to strlist at end, and log error if out of memory. */
+static void
+spool_txt_string(struct config_strlist_head* txt, char* str)
+{
+	if(!cfg_strlist_append(txt, strdup(str))) {
+		log_err("out of memory in spool text");
+	}
+}
+
+/** Spool txt to spool list. */
+static void
+spool_txt_vmsg(struct config_strlist_head* txt, const char* format,
+	va_list args)
+{
+	char msg[65535];
+	vsnprintf(msg, sizeof(msg), format, args);
+	spool_txt_string(txt, msg);
+}
+
+/** Print item to spool list. On alloc failure the list is as before. */
+static void
+spool_txt_printf(struct config_strlist_head* txt, const char* format, ...)
+{
+	va_list args;
+	va_start(args, format);
+	spool_txt_vmsg(txt, format, args);
+	va_end(args);
+}
+
 /** dump one rrset zonefile line */
-static int
-dump_rrset_line(RES* ssl, struct ub_packed_rrset_key* k, time_t now, size_t i)
+static void
+dump_rrset_line(struct config_strlist_head* txt, struct ub_packed_rrset_key* k,
+	time_t now, size_t i)
 {
 	char s[65535];
 	if(!packed_rr_to_string(k, i, now, s, sizeof(s))) {
-		return ssl_printf(ssl, "BADRR\n");
+		spool_txt_string(txt, "BADRR\n");
+		return;
 	}
-	return ssl_printf(ssl, "%s", s);
+	spool_txt_string(txt, s);
 }
 
 /** dump rrset key and data info */
-static int
-dump_rrset(RES* ssl, struct ub_packed_rrset_key* k, 
+static void
+dump_rrset(struct config_strlist_head* txt, struct ub_packed_rrset_key* k,
 	struct packed_rrset_data* d, time_t now)
 {
 	size_t i;
 	/* rd lock held by caller */
-	if(!k || !d) return 1;
-	if(k->id == 0) return 1; /* deleted */
-	if(d->ttl < now) return 1; /* expired */
+	if(!k || !d) return;
+	if(k->id == 0) return; /* deleted */
+	if(d->ttl < now) return; /* expired */
 
 	/* meta line */
-	if(!ssl_printf(ssl, ";rrset%s " ARG_LL "d %u %u %d %d\n",
+	spool_txt_printf(txt, ";rrset%s " ARG_LL "d %u %u %d %d\n",
 		(k->rk.flags & PACKED_RRSET_NSEC_AT_APEX)?" nsec_apex":"",
 		(long long)(d->ttl - now),
 		(unsigned)d->count, (unsigned)d->rrsig_count,
 		(int)d->trust, (int)d->security
-		)) 
-		return 0;
+		);
 	for(i=0; i<d->count + d->rrsig_count; i++) {
-		if(!dump_rrset_line(ssl, k, now, i))
+		dump_rrset_line(txt, k, now, i);
+	}
+}
+
+/** Spool strlist to the output. */
+static int
+spool_strlist(RES* ssl, struct config_strlist* list)
+{
+	struct config_strlist* s;
+	for(s=list; s; s=s->next) {
+		if(!ssl_printf(ssl, "%s", s->str))
 			return 0;
 	}
 	return 1;
 }
 
-/** dump lruhash rrset cache */
+/** dump lruhash cache and call callback for every item. */
 static int
-dump_rrset_lruhash(RES* ssl, struct lruhash* h, time_t now)
+dump_lruhash(struct lruhash* table,
+	void (*func)(struct lruhash_entry*, struct config_strlist_head*, void*),
+	RES* ssl, void* arg)
 {
-	struct lruhash_entry* e;
-	/* lruhash already locked by caller */
-	/* walk in order of lru; best first */
-	for(e=h->lru_start; e; e = e->lru_next) {
-		lock_rw_rdlock(&e->lock);
-		if(!dump_rrset(ssl, (struct ub_packed_rrset_key*)e->key,
-			(struct packed_rrset_data*)e->data, now)) {
-			lock_rw_unlock(&e->lock);
+	int just_started = 1;
+	int not_done = 1;
+	hashvalue_type hash;
+	size_t num = 0; /* number of entries processed. */
+	size_t max = 2; /* number of entries after which it unlocks. */
+	struct config_strlist_head txt; /* Text strings spooled. */
+	memset(&txt, 0, sizeof(txt));
+
+	while(not_done) {
+		size_t i; /* hash bin. */
+		/* Process a number of items. */
+		num = 0;
+		lock_quick_lock(&table->lock);
+		if(just_started) {
+			i = 0;
+		} else {
+			i = hash&table->size_mask;
+		}
+		while(num < max) {
+			/* Process bin. */
+			int found = 0;
+			size_t num_bin = 0;
+			struct lruhash_bin* bin = &table->array[i];
+			struct lruhash_entry* e;
+			lock_quick_lock(&bin->lock);
+			for(e = bin->overflow_list; e; e = e->overflow_next) {
+				/* Entry e is locked by the func. */
+				func(e, &txt, arg);
+				num_bin++;
+			}
+			lock_quick_unlock(&bin->lock);
+			/* This addition of bin number of entries may take
+			 * it over the max. */
+			num += num_bin;
+
+			/* Move to next bin. */
+			/* Find one with an entry, with a  hash value, so we
+			 * can continue from the hash value. The hash value
+			 * can be indexed also if the array changes size. */
+			i++;
+			while(i < table->size) {
+				bin = &table->array[i];
+				lock_quick_lock(&bin->lock);
+				if(bin->overflow_list) {
+					hash = bin->overflow_list->hash;
+					lock_quick_unlock(&bin->lock);
+					found = 1;
+					just_started = 0;
+					break;
+				}
+				lock_quick_unlock(&bin->lock);
+				i++;
+			}
+			if(!found) {
+				not_done = 0;
+				break;
+			}
+		}
+		lock_quick_unlock(&table->lock);
+		/* Print the spooled items, that are collected while the
+		 * locks are locked. The print happens while they are not
+		 * locked. */
+		if(txt.first) {
+			if(!spool_strlist(ssl, txt.first)) {
+				config_delstrlist(txt.first);
+				return 0;
+			}
+			config_delstrlist(txt.first);
+			memset(&txt, 0, sizeof(txt));
+		}
+	}
+	/* Print the final spooled items. */
+	if(txt.first) {
+		if(!spool_strlist(ssl, txt.first)) {
+			config_delstrlist(txt.first);
 			return 0;
 		}
-		lock_rw_unlock(&e->lock);
+		config_delstrlist(txt.first);
 	}
 	return 1;
 }
 
+/** dump slabhash cache and call callback for every item. */
+static int
+dump_slabhash(struct slabhash* sh,
+	void (*func)(struct lruhash_entry*, struct config_strlist_head*, void*),
+	RES* ssl, void* arg)
+{
+	/* Process a number of items at a time, then unlock the cache,
+	 * so that ordinary processing can continue. Keep an iteration marker
+	 * to continue the loop. That means the cache can change, items
+	 * could be inserted and deleted. And, for example, the hash table
+	 * can grow. */
+	size_t slab;
+	for(slab=0; slab<sh->size; slab++) {
+		if(!dump_lruhash(sh->array[slab], func, ssl, arg))
+			return 0;
+	}
+	return 1;
+}
+
+/** Struct for dump information. */
+struct dump_info {
+	/** The worker. */
+	struct worker* worker;
+	/** The printout connection. */
+	RES* ssl;
+};
+
+/** Dump the rrset cache entry */
+static void
+dump_rrset_entry(struct lruhash_entry* e, struct config_strlist_head* txt,
+	void* arg)
+{
+	struct dump_info* dump_info = (struct dump_info*)arg;
+	lock_rw_rdlock(&e->lock);
+	dump_rrset(txt, (struct ub_packed_rrset_key*)e->key,
+		(struct packed_rrset_data*)e->data,
+		*dump_info->worker->env.now);
+	lock_rw_unlock(&e->lock);
+}
+
 /** dump rrset cache */
 static int
 dump_rrset_cache(RES* ssl, struct worker* worker)
 {
 	struct rrset_cache* r = worker->env.rrset_cache;
-	size_t slab;
+	struct dump_info dump_info;
+	dump_info.worker = worker;
+	dump_info.ssl = ssl;
 	if(!ssl_printf(ssl, "START_RRSET_CACHE\n")) return 0;
-	for(slab=0; slab<r->table.size; slab++) {
-		lock_quick_lock(&r->table.array[slab]->lock);
-		if(!dump_rrset_lruhash(ssl, r->table.array[slab],
-			*worker->env.now)) {
-			lock_quick_unlock(&r->table.array[slab]->lock);
-			return 0;
-		}
-		lock_quick_unlock(&r->table.array[slab]->lock);
-	}
+	if(!dump_slabhash(&r->table, &dump_rrset_entry, ssl, &dump_info))
+		return 0;
 	return ssl_printf(ssl, "END_RRSET_CACHE\n");
 }
 
 /** dump message to rrset reference */
-static int
-dump_msg_ref(RES* ssl, struct ub_packed_rrset_key* k)
+static void
+dump_msg_ref(struct config_strlist_head* txt, struct ub_packed_rrset_key* k)
 {
 	char* nm, *tp, *cl;
 	nm = sldns_wire2str_dname(k->rk.dname, k->rk.dname_len);
@@ -149,30 +296,25 @@ dump_msg_ref(RES* ssl, struct ub_packed_rrset_key* k)
 		free(nm);
 		free(tp);
 		free(cl);
-		return ssl_printf(ssl, "BADREF\n");
-	}
-	if(!ssl_printf(ssl, "%s %s %s %d\n", nm, cl, tp, (int)k->rk.flags)) {
-		free(nm);
-		free(tp);
-		free(cl);
-		return 0;
+		spool_txt_string(txt, "BADREF\n");
+		return;
 	}
+	spool_txt_printf(txt, "%s %s %s %d\n", nm, cl, tp, (int)k->rk.flags);
 	free(nm);
 	free(tp);
 	free(cl);
-
-	return 1;
 }
 
 /** dump message entry */
-static int
-dump_msg(RES* ssl, struct query_info* k, struct reply_info* d, time_t now)
+static void
+dump_msg(struct config_strlist_head* txt, struct query_info* k,
+	struct reply_info* d, time_t now)
 {
 	size_t i;
 	char* nm, *tp, *cl;
-	if(!k || !d) return 1;
-	if(d->ttl < now) return 1; /* expired */
-	
+	if(!k || !d) return;
+	if(d->ttl < now) return; /* expired */
+
 	nm = sldns_wire2str_dname(k->qname, k->qname_len);
 	tp = sldns_wire2str_type(k->qtype);
 	cl = sldns_wire2str_class(k->qclass);
@@ -180,45 +322,35 @@ dump_msg(RES* ssl, struct query_info* k, struct reply_info* d, time_t now)
 		free(nm);
 		free(tp);
 		free(cl);
-		return 1; /* skip this entry */
+		return; /* skip this entry */
 	}
 	if(!rrset_array_lock(d->ref, d->rrset_count, now)) {
 		/* rrsets have timed out or do not exist */
 		free(nm);
 		free(tp);
 		free(cl);
-		return 1; /* skip this entry */
+		return; /* skip this entry */
 	}
-	
+
 	/* meta line */
-	if(!ssl_printf(ssl, "msg %s %s %s %d %d " ARG_LL "d %d %u %u %u %d %s\n",
-			nm, cl, tp,
-			(int)d->flags, (int)d->qdcount, 
-			(long long)(d->ttl-now), (int)d->security,
-			(unsigned)d->an_numrrsets,
-			(unsigned)d->ns_numrrsets,
-			(unsigned)d->ar_numrrsets,
-			(int)d->reason_bogus,
-			d->reason_bogus_str?d->reason_bogus_str:"")) {
-		free(nm);
-		free(tp);
-		free(cl);
-		rrset_array_unlock(d->ref, d->rrset_count);
-		return 0;
-	}
+	spool_txt_printf(txt,
+		"msg %s %s %s %d %d " ARG_LL "d %d %u %u %u %d %s\n",
+		nm, cl, tp,
+		(int)d->flags, (int)d->qdcount,
+		(long long)(d->ttl-now), (int)d->security,
+		(unsigned)d->an_numrrsets,
+		(unsigned)d->ns_numrrsets,
+		(unsigned)d->ar_numrrsets,
+		(int)d->reason_bogus,
+		d->reason_bogus_str?d->reason_bogus_str:"");
 	free(nm);
 	free(tp);
 	free(cl);
 	
 	for(i=0; i<d->rrset_count; i++) {
-		if(!dump_msg_ref(ssl, d->rrsets[i])) {
-			rrset_array_unlock(d->ref, d->rrset_count);
-			return 0;
-		}
+		dump_msg_ref(txt, d->rrsets[i]);
 	}
 	rrset_array_unlock(d->ref, d->rrset_count);
-
-	return 1;
 }
 
 /** copy msg to worker pad */
@@ -247,49 +379,40 @@ copy_msg(struct regional* region, struct lruhash_entry* e,
 	return (*k)->qname != NULL;
 }
 
-/** dump lruhash msg cache */
-static int
-dump_msg_lruhash(RES* ssl, struct worker* worker, struct lruhash* h)
+/** Dump the msg entry. */
+static void
+dump_msg_entry(struct lruhash_entry* e, struct config_strlist_head* txt,
+	void* arg)
 {
-	struct lruhash_entry* e;
+	struct dump_info* dump_info = (struct dump_info*)arg;
 	struct query_info* k;
 	struct reply_info* d;
 
-	/* lruhash already locked by caller */
-	/* walk in order of lru; best first */
-	for(e=h->lru_start; e; e = e->lru_next) {
-		regional_free_all(worker->scratchpad);
-		lock_rw_rdlock(&e->lock);
-		/* make copy of rrset in worker buffer */
-		if(!copy_msg(worker->scratchpad, e, &k, &d)) {
-			lock_rw_unlock(&e->lock);
-			return 0;
-		}
+	regional_free_all(dump_info->worker->scratchpad);
+	/* Make copy of rrset in worker buffer. */
+	lock_rw_rdlock(&e->lock);
+	if(!copy_msg(dump_info->worker->scratchpad, e, &k, &d)) {
 		lock_rw_unlock(&e->lock);
-		/* release lock so we can lookup the rrset references 
-		 * in the rrset cache */
-		if(!dump_msg(ssl, k, d, *worker->env.now)) {
-			return 0;
-		}
+		log_err("out of memory in dump_msg_entry");
+		return;
 	}
-	return 1;
+	lock_rw_unlock(&e->lock);
+	/* Release lock so we can lookup the rrset references
+	 * in the rrset cache. */
+	dump_msg(txt, k, d, *dump_info->worker->env.now);
 }
 
 /** dump msg cache */
 static int
 dump_msg_cache(RES* ssl, struct worker* worker)
 {
-	struct slabhash* sh = worker->env.msg_cache;
-	size_t slab;
+	struct dump_info dump_info;
+	dump_info.worker = worker;
+	dump_info.ssl = ssl;
 	if(!ssl_printf(ssl, "START_MSG_CACHE\n")) return 0;
-	for(slab=0; slab<sh->size; slab++) {
-		lock_quick_lock(&sh->array[slab]->lock);
-		if(!dump_msg_lruhash(ssl, worker, sh->array[slab])) {
-			lock_quick_unlock(&sh->array[slab]->lock);
-			return 0;
-		}
-		lock_quick_unlock(&sh->array[slab]->lock);
-	}
+	if(!dump_slabhash(worker->env.msg_cache, &dump_msg_entry, ssl,
+		&dump_info))
+		return 0;
 	return ssl_printf(ssl, "END_MSG_CACHE\n");
 }
 
@@ -811,12 +934,18 @@ print_dp_main(RES* ssl, struct delegpt* dp, struct dns_msg* msg)
 		struct ub_packed_rrset_key* k = msg->rep->rrsets[i];
 		struct packed_rrset_data* d = 
 			(struct packed_rrset_data*)k->entry.data;
+		struct config_strlist_head txt;
+		memset(&txt, 0, sizeof(txt));
 		if(d->security == sec_status_bogus) {
 			if(!ssl_printf(ssl, "Address is BOGUS:\n"))
 				return;
 		}
-		if(!dump_rrset(ssl, k, d, 0))
+		dump_rrset(&txt, k, d, 0);
+		if(!spool_strlist(ssl, txt.first)) {
+			config_delstrlist(txt.first);
 			return;
+		}
+		config_delstrlist(txt.first);
 	    }
 	delegpt_count_ns(dp, &n_ns, &n_miss);
 	delegpt_count_addr(dp, &n_addr, &n_res, &n_avail);
diff --git a/daemon/daemon.c b/daemon/daemon.c
index 92d0d031b..11d81d048 100644
--- a/daemon/daemon.c
+++ b/daemon/daemon.c
@@ -792,7 +792,8 @@ daemon_fork(struct daemon* daemon)
 
 	/* read auth zonefiles */
 	if(!auth_zones_apply_cfg(daemon->env->auth_zones, daemon->cfg, 1,
-		&daemon->use_rpz, daemon->env, &daemon->mods))
+		&daemon->use_rpz, daemon->env, &daemon->mods,
+		daemon->env->tsig_key_table))
 		fatal_exit("auth_zones could not be setup");
 
 	/* Set-up EDNS strings */
diff --git a/daemon/remote.c b/daemon/remote.c
index 0489cedbf..7ce937e92 100644
--- a/daemon/remote.c
+++ b/daemon/remote.c
@@ -98,9 +98,14 @@
 #include "util/timeval_func.h"
 #include "util/tcp_conn_limit.h"
 #include "util/edns.h"
+#include "util/tsig.h"
 #ifdef USE_CACHEDB
 #include "cachedb/cachedb.h"
 #endif
+#ifdef CLIENT_SUBNET
+#include "edns-subnet/subnetmod.h"
+#include "edns-subnet/addrtree.h"
+#endif
 
 #ifdef HAVE_SYS_TYPES_H
 #  include <sys/types.h>
@@ -149,7 +154,7 @@ remote_setup_ctx(struct daemon_remote* rc, struct config_file* cfg)
 		log_crypto_err("could not SSL_CTX_new");
 		return 0;
 	}
-	if(!listen_sslctx_setup(rc->ctx)) {
+	if(!listen_sslctx_setup(rc->ctx, cfg->tls_use_system_policy_versions)) {
 		return 0;
 	}
 
@@ -1742,6 +1747,334 @@ do_view_datas_remove(struct daemon_remote* rc, RES* ssl, struct worker* worker,
 	(void)ssl_printf(ssl, "removed %d datas\n", num);
 }
 
+/** information for the domain search */
+struct cache_lookup_info {
+	/** The connection to print on. */
+	RES* ssl;
+	/** The worker. */
+	struct worker* worker;
+	/** The domain, in wireformat. */
+	uint8_t* nm;
+	/** The length of nm. */
+	size_t nmlen;
+};
+
+#ifdef CLIENT_SUBNET
+static void addrtree_traverse_visit_node(struct addrnode* n, addrkey_t* addr,
+	size_t addr_size, int is_ipv6, time_t now, struct query_info* q,
+	void (*func)(struct query_info*, struct reply_info*, addrkey_t*,
+		size_t, int, addrlen_t, int, time_t, void*), void* arg);
+
+/** Lookup in subnet addrtree */
+static void
+cache_lookup_subnet_addrnode(struct query_info* q, struct reply_info* d,
+	addrkey_t* addr, size_t addr_size, int is_ipv6, addrlen_t scope,
+	int only_match_scope_zero, time_t ttl, void* arg)
+{
+	size_t i;
+	char s[65535], tp[32], cl[32], rc[32], fg[32], astr[64];
+	struct cache_lookup_info* inf = (struct cache_lookup_info*)arg;
+	if(is_ipv6) {
+		if(addr_size < 16 || inet_ntop(AF_INET6, addr, astr,
+			sizeof(astr)) == NULL)
+			snprintf(astr, sizeof(astr), "(inet6ntoperror)");
+	} else {
+		if(addr_size < 4 || inet_ntop(AF_INET, addr, astr,
+			sizeof(astr)) == NULL)
+			snprintf(astr, sizeof(astr), "(inetntoperror)");
+	}
+	sldns_wire2str_dname_buf(q->qname, q->qname_len, s, sizeof(s));
+	sldns_wire2str_type_buf(q->qtype, tp, sizeof(tp));
+	sldns_wire2str_class_buf(q->qclass, cl, sizeof(cl));
+	sldns_wire2str_rcode_buf(FLAGS_GET_RCODE(d->flags),
+		rc, sizeof(rc));
+	snprintf(fg, sizeof(fg), "%s%s%s%s%s%s%s%s",
+		((d->flags&BIT_QR)?" QR":""),
+		((d->flags&BIT_AA)?" AA":""),
+		((d->flags&BIT_TC)?" TC":""),
+		((d->flags&BIT_RD)?" RD":""),
+		((d->flags&BIT_RA)?" RA":""),
+		((d->flags&BIT_Z)?" Z":""),
+		((d->flags&BIT_AD)?" AD":""),
+		((d->flags&BIT_CD)?" CD":""));
+	if(!rrset_array_lock(d->ref, d->rrset_count,
+		*inf->worker->env.now)) {
+		/* rrsets have timed out or do not exist */
+		return;
+	}
+	if(!ssl_printf(inf->ssl, "subnet %s/%d%s %s %s %s " ARG_LL "d\n", astr,
+		(int)scope, (only_match_scope_zero?" scope_zero":""),
+		s, cl, tp, (long long)(ttl-*inf->worker->env.now))) {
+		rrset_array_unlock(d->ref, d->rrset_count);
+		return;
+	}
+	ssl_printf(inf->ssl,
+		"subnet msg %s %s %s%s %s %d %d " ARG_LL "d %d %u %u %u %d %s\n",
+		s, cl, tp, fg, rc,
+		(int)d->flags, (int)d->qdcount,
+		(long long)(d->ttl-*inf->worker->env.now),
+		(int)d->security,
+		(unsigned)d->an_numrrsets,
+		(unsigned)d->ns_numrrsets,
+		(unsigned)d->ar_numrrsets,
+		(int)d->reason_bogus,
+		d->reason_bogus_str?d->reason_bogus_str:"");
+	for(i=0; i<d->rrset_count; i++) {
+		struct ub_packed_rrset_key* rk = d->rrsets[i];
+		struct packed_rrset_data* rd = (struct packed_rrset_data*)rk->entry.data;
+		size_t j;
+		for(j=0; j<rd->count + rd->rrsig_count; j++) {
+			if(!packed_rr_to_string(rk, j,
+				*inf->worker->env.now, s, sizeof(s))) {
+				ssl_printf(inf->ssl, "BADRR\n");
+			} else {
+				ssl_printf(inf->ssl, "%s", s);
+			}
+		}
+	}
+	rrset_array_unlock(d->ref, d->rrset_count);
+	ssl_printf(inf->ssl, "\n");
+}
+
+/** Visit an edge in subnet addrtree traverse */
+static void
+addrtree_traverse_visit_edge(struct addredge* edge, addrkey_t* addr,
+	size_t addr_size, int is_ipv6, time_t now, struct query_info* q,
+	void (*func)(struct query_info*, struct reply_info*, addrkey_t*,
+		size_t, int, addrlen_t, int, time_t, void*), void* arg)
+{
+	size_t n;
+	addrlen_t addrlen;
+	if(!edge || !edge->node)
+		return;
+	addrlen = edge->len;
+	/* ceil() */
+	n = (size_t)((addrlen / KEYWIDTH) + ((addrlen % KEYWIDTH != 0)?1:0));
+	if(n > addr_size)
+		n = addr_size;
+	memset(addr, 0, addr_size);
+	memcpy(addr, edge->str, n);
+	addrtree_traverse_visit_node(edge->node, addr, addr_size, is_ipv6,
+		now, q, func, arg);
+}
+
+/** Visit a node in subnet addrtree traverse */
+static void
+addrtree_traverse_visit_node(struct addrnode* n, addrkey_t* addr,
+	size_t addr_size, int is_ipv6, time_t now, struct query_info* q,
+	void (*func)(struct query_info*, struct reply_info*, addrkey_t*,
+		size_t, int, addrlen_t, int, time_t, void*), void* arg)
+{
+	/* If this node has data, and not expired. */
+	if(n->elem && n->ttl >= now) {
+		func(q, (struct reply_info*)n->elem, addr, addr_size, is_ipv6,
+			n->scope, n->only_match_scope_zero, n->ttl, arg);
+	}
+	/* Traverse edges. */
+	addrtree_traverse_visit_edge(n->edge[0], addr, addr_size, is_ipv6,
+		now, q, func, arg);
+	addrtree_traverse_visit_edge(n->edge[1], addr, addr_size, is_ipv6,
+		now, q, func, arg);
+}
+
+/** Traverse subnet addrtree */
+static void
+addrtree_traverse(struct addrtree* tree, int is_ipv6, time_t now,
+	struct query_info* q,
+	void (*func)(struct query_info*, struct reply_info*, addrkey_t*,
+		size_t, int, addrlen_t, int, time_t, void*), void* arg)
+{
+	uint8_t addr[16]; /* Large enough for IPv4 and IPv6. */
+	memset(addr, 0, sizeof(addr));
+	addrtree_traverse_visit_node(tree->root, (addrkey_t*)addr,
+		sizeof(addr), is_ipv6, now, q, func, arg);
+}
+
+/** Lookup cache_lookup for subnet content. */
+static void
+cache_lookup_subnet_msg(struct lruhash_entry* e, void* arg)
+{
+	struct cache_lookup_info* inf = (struct cache_lookup_info*)arg;
+	struct msgreply_entry *k = (struct msgreply_entry*)e->key;
+	struct subnet_msg_cache_data* d =
+		(struct subnet_msg_cache_data*)e->data;
+	if(!dname_subdomain_c(k->key.qname, inf->nm))
+		return;
+
+	if(d->tree4) {
+		addrtree_traverse(d->tree4, 0, *inf->worker->env.now, &k->key,
+			&cache_lookup_subnet_addrnode, inf);
+	}
+	if(d->tree6) {
+		addrtree_traverse(d->tree6, 1, *inf->worker->env.now, &k->key,
+			&cache_lookup_subnet_addrnode, inf);
+	}
+}
+#endif /* CLIENT_SUBNET */
+
+static void
+cache_lookup_rrset(struct lruhash_entry* e, void* arg)
+{
+	struct cache_lookup_info* inf = (struct cache_lookup_info*)arg;
+	struct ub_packed_rrset_key* k = (struct ub_packed_rrset_key*)e->key;
+	struct packed_rrset_data* d = (struct packed_rrset_data*)e->data;
+	if(*inf->worker->env.now < d->ttl &&
+		k->id != 0 && /* not deleted */
+		dname_subdomain_c(k->rk.dname, inf->nm)) {
+		size_t i;
+		for(i=0; i<d->count + d->rrsig_count; i++) {
+			char s[65535];
+			if(!packed_rr_to_string(k, i, *inf->worker->env.now,
+				s, sizeof(s))) {
+				ssl_printf(inf->ssl, "BADRR\n");
+				return;
+			}
+			ssl_printf(inf->ssl, "%s", s);
+		}
+		ssl_printf(inf->ssl, "\n");
+	}
+}
+
+static void
+cache_lookup_msg(struct lruhash_entry* e, void* arg)
+{
+	struct cache_lookup_info* inf = (struct cache_lookup_info*)arg;
+	struct msgreply_entry* k = (struct msgreply_entry*)e->key;
+	struct reply_info* d = (struct reply_info*)e->data;
+	if(*inf->worker->env.now < d->ttl &&
+		dname_subdomain_c(k->key.qname, inf->nm)) {
+		size_t i;
+		char s[65535], tp[32], cl[32], rc[32], fg[32];
+		sldns_wire2str_dname_buf(k->key.qname, k->key.qname_len,
+			s, sizeof(s));
+		sldns_wire2str_type_buf(k->key.qtype, tp, sizeof(tp));
+		sldns_wire2str_class_buf(k->key.qclass, cl, sizeof(cl));
+		sldns_wire2str_rcode_buf(FLAGS_GET_RCODE(d->flags),
+			rc, sizeof(rc));
+		snprintf(fg, sizeof(fg), "%s%s%s%s%s%s%s%s",
+			((d->flags&BIT_QR)?" QR":""),
+			((d->flags&BIT_AA)?" AA":""),
+			((d->flags&BIT_TC)?" TC":""),
+			((d->flags&BIT_RD)?" RD":""),
+			((d->flags&BIT_RA)?" RA":""),
+			((d->flags&BIT_Z)?" Z":""),
+			((d->flags&BIT_AD)?" AD":""),
+			((d->flags&BIT_CD)?" CD":""));
+		if(!rrset_array_lock(d->ref, d->rrset_count,
+			*inf->worker->env.now)) {
+			/* rrsets have timed out or do not exist */
+			return;
+		}
+		ssl_printf(inf->ssl,
+			"msg %s %s %s%s %s %d %d " ARG_LL "d %d %u %u %u %d %s\n",
+			s, cl, tp, fg, rc,
+			(int)d->flags, (int)d->qdcount,
+			(long long)(d->ttl-*inf->worker->env.now),
+			(int)d->security,
+			(unsigned)d->an_numrrsets,
+			(unsigned)d->ns_numrrsets,
+			(unsigned)d->ar_numrrsets,
+			(int)d->reason_bogus,
+			d->reason_bogus_str?d->reason_bogus_str:"");
+		for(i=0; i<d->rrset_count; i++) {
+			struct ub_packed_rrset_key* rk = d->rrsets[i];
+			struct packed_rrset_data* rd = (struct packed_rrset_data*)rk->entry.data;
+			size_t j;
+			for(j=0; j<rd->count + rd->rrsig_count; j++) {
+				if(!packed_rr_to_string(rk, j,
+					*inf->worker->env.now, s, sizeof(s))) {
+					rrset_array_unlock(d->ref, d->rrset_count);
+					ssl_printf(inf->ssl, "BADRR\n");
+					return;
+				}
+				ssl_printf(inf->ssl, "%s", s);
+			}
+		}
+		rrset_array_unlock(d->ref, d->rrset_count);
+		ssl_printf(inf->ssl, "\n");
+	}
+}
+
+/** perform cache search for domain */
+static void
+do_cache_lookup_domain(RES* ssl, struct worker* worker, uint8_t* nm,
+	size_t nmlen)
+{
+#ifdef CLIENT_SUBNET
+	int m;
+	struct subnet_env* sn_env = NULL;
+#endif /* CLIENT_SUBNET */
+	struct cache_lookup_info inf;
+	inf.ssl = ssl;
+	inf.worker = worker;
+	inf.nm = nm;
+	inf.nmlen = nmlen;
+
+#ifdef CLIENT_SUBNET
+	m = modstack_find(worker->env.modstack, "subnetcache");
+	if(m != -1) sn_env = (struct subnet_env*)worker->env.modinfo[m];
+	if(sn_env) {
+		lock_rw_rdlock(&sn_env->biglock);
+		slabhash_traverse(sn_env->subnet_msg_cache, 0,
+			&cache_lookup_subnet_msg, &inf);
+		lock_rw_unlock(&sn_env->biglock);
+	}
+#endif /* CLIENT_SUBNET */
+
+	slabhash_traverse(&worker->env.rrset_cache->table, 0,
+		&cache_lookup_rrset, &inf);
+	slabhash_traverse(worker->env.msg_cache, 0, &cache_lookup_msg, &inf);
+}
+
+/** cache lookup of domain */
+static void
+do_cache_lookup(RES* ssl, struct worker* worker, char* arg)
+{
+	uint8_t nm[LDNS_MAX_DOMAINLEN+1];
+	size_t nmlen;
+	int status;
+	char* s = arg, *next = NULL;
+	int allow_long = 0;
+
+	if(arg[0] == '+' && arg[1] == 't' && (arg[2]==' ' || arg[2]=='\t')) {
+		allow_long = 1;
+		s = arg+2;
+	}
+
+	/* Find the commandline arguments of domains. */
+	while(s && *s != 0) {
+		s = skipwhite(s);
+		if(*s == 0)
+			break;
+		if(strchr(s, ' ') || strchr(s, '\t')) {
+			char* sp = strchr(s, ' ');
+			if(strchr(s, '\t') != 0 && strchr(s, '\t') < sp)
+				sp = strchr(s, '\t');
+			*sp = 0;
+			next = sp+1;
+		} else {
+			next = NULL;
+		}
+
+		nmlen = sizeof(nm);
+		status = sldns_str2wire_dname_buf(s, nm, &nmlen);
+		if(status != 0) {
+			ssl_printf(ssl, "error cannot parse name %s at %d: %s\n", s,
+				LDNS_WIREPARSE_OFFSET(status),
+				sldns_get_errorstr_parse(status));
+			return;
+		}
+		if(!allow_long && dname_count_labels(nm) < 3) {
+			ssl_printf(ssl, "error name too short: '%s'. Need example.com. or longer, short names take very long, use +t to allow them.\n", s);
+			return;
+		}
+
+		do_cache_lookup_domain(ssl, worker, nm, nmlen);
+
+		s = next;
+	}
+}
+
 /** cache lookup of nameservers */
 static void
 do_lookup(RES* ssl, struct worker* worker, char* arg)
@@ -2889,10 +3222,13 @@ do_auth_zone_reload(RES* ssl, struct worker* worker, char* arg)
 			(void)ssl_printf(ssl, "error: no SOA in zone after read %s\n", arg);
 			return;
 		}
-		if(xfr->have_zone)
+		if(xfr->have_zone) {
 			xfr->lease_time = *worker->env.now;
+			xfr->soa_zone_acquired = *worker->env.now;
+		}
 		lock_basic_unlock(&xfr->lock);
 	}
+	z->soa_zone_acquired = *worker->env.now;
 
 	auth_zone_verify_zonemd(z, &worker->env, &worker->env.mesh->mods,
 		&reason, 0, 0);
@@ -3041,7 +3377,7 @@ static void
 do_list_auth_zones(RES* ssl, struct auth_zones* az)
 {
 	struct auth_zone* z;
-	char buf[LDNS_MAX_DOMAINLEN], buf2[256];
+	char buf[LDNS_MAX_DOMAINLEN], buf2[256], buf3[256];
 	lock_rw_rdlock(&az->lock);
 	RBTREE_FOR(z, struct auth_zone*, &az->ztree) {
 		lock_rw_rdlock(&z->lock);
@@ -3050,18 +3386,41 @@ do_list_auth_zones(RES* ssl, struct auth_zones* az)
 			snprintf(buf2, sizeof(buf2), "expired");
 		else {
 			uint32_t serial = 0;
-			if(auth_zone_get_serial(z, &serial))
+			if(auth_zone_get_serial(z, &serial)) {
 				snprintf(buf2, sizeof(buf2), "serial %u",
 					(unsigned)serial);
-			else	snprintf(buf2, sizeof(buf2), "no serial");
+				if(z->soa_zone_acquired != 0) {
+#if defined(HAVE_STRFTIME) && defined(HAVE_LOCALTIME_R)
+					char tmbuf[32];
+					struct tm tm;
+					struct tm *tm_p;
+					tm_p = localtime_r(
+						&z->soa_zone_acquired, &tm);
+					if(!strftime(tmbuf, sizeof(tmbuf), "%Y-%m-%dT%H:%M:%S", tm_p))
+						snprintf(tmbuf, sizeof(tmbuf), "strftime-err-%u", (unsigned)z->soa_zone_acquired);
+					snprintf(buf3, sizeof(buf3),
+						"\t since %u %s",
+						(unsigned)z->soa_zone_acquired,
+						tmbuf);
+#else
+					snprintf(buf3, sizeof(buf3),
+						"\t since %u",
+						(unsigned)z->soa_zone_acquired);
+#endif
+				} else {
+					buf3[0]=0;
+				}
+			} else	{
+				snprintf(buf2, sizeof(buf2), "no serial");
+				buf3[0]=0;
+			}
 		}
-		if(!ssl_printf(ssl, "%s\t%s\n", buf, buf2)) {
+		lock_rw_unlock(&z->lock);
+		if(!ssl_printf(ssl, "%s\t%s%s\n", buf, buf2, buf3)) {
 			/* failure to print */
-			lock_rw_unlock(&z->lock);
 			lock_rw_unlock(&az->lock);
 			return;
 		}
-		lock_rw_unlock(&z->lock);
 	}
 	lock_rw_unlock(&az->lock);
 }
@@ -3504,6 +3863,30 @@ do_print_cookie_secrets(RES* ssl, struct worker* worker) {
 	explicit_bzero(secret_hex, sizeof(secret_hex));
 }
 
+/** check that there is no argument after a command that takes no arguments. */
+static int
+cmd_no_args(RES* ssl, char* cmd, char* p)
+{
+	if(p && *p != 0) {
+		/* cmd contains the command that is called at the start,
+		 * with space or tab after it. */
+		char* c = cmd;
+		if(strchr(c, ' ') && strchr(c, '\t')) {
+			if(strchr(c, ' ') < strchr(c, '\t'))
+				*strchr(c, ' ')=0;
+			else	*strchr(c, '\t')=0;
+		} else if(strchr(c, ' ')) {
+			*strchr(c, ' ')=0;
+		} else if(strchr(c, '\t')) {
+			*strchr(c, '\t')=0;
+		}
+		(void)ssl_printf(ssl, "error command %s takes no arguments,"
+			" have '%s'\n", c, p);
+		return 1;
+	}
+	return 0;
+}
+
 /** check for name with end-of-string, space or tab after it */
 static int
 cmdcmp(char* p, const char* cmd, size_t len)
@@ -3519,27 +3902,41 @@ execute_cmd(struct daemon_remote* rc, struct rc_state* s, RES* ssl, char* cmd,
 	char* p = skipwhite(cmd);
 	/* compare command */
 	if(cmdcmp(p, "stop", 4)) {
+		if(cmd_no_args(ssl, p, skipwhite(p+4)))
+			return;
 		do_stop(ssl, worker);
 		return;
 	} else if(cmdcmp(p, "reload_keep_cache", 17)) {
+		if(cmd_no_args(ssl, p, skipwhite(p+17)))
+			return;
 		do_reload(ssl, worker, 1);
 		return;
 	} else if(cmdcmp(p, "reload", 6)) {
+		if(cmd_no_args(ssl, p, skipwhite(p+6)))
+			return;
 		do_reload(ssl, worker, 0);
 		return;
 	} else if(cmdcmp(p, "fast_reload", 11)) {
 		do_fast_reload(ssl, worker, s, skipwhite(p+11));
 		return;
 	} else if(cmdcmp(p, "stats_noreset", 13)) {
+		if(cmd_no_args(ssl, p, skipwhite(p+13)))
+			return;
 		do_stats(ssl, worker, 0);
 		return;
 	} else if(cmdcmp(p, "stats", 5)) {
+		if(cmd_no_args(ssl, p, skipwhite(p+5)))
+			return;
 		do_stats(ssl, worker, 1);
 		return;
 	} else if(cmdcmp(p, "status", 6)) {
+		if(cmd_no_args(ssl, p, skipwhite(p+6)))
+			return;
 		do_status(ssl, worker);
 		return;
 	} else if(cmdcmp(p, "dump_cache", 10)) {
+		if(cmd_no_args(ssl, p, skipwhite(p+10)))
+			return;
 #ifdef THREADS_DISABLED
 		if(worker->daemon->num > 1) {
 			(void)ssl_printf(ssl, "dump_cache/load_cache is not "
@@ -3550,6 +3947,8 @@ execute_cmd(struct daemon_remote* rc, struct rc_state* s, RES* ssl, char* cmd,
 		(void)dump_cache(ssl, worker);
 		return;
 	} else if(cmdcmp(p, "load_cache", 10)) {
+		if(cmd_no_args(ssl, p, skipwhite(p+10)))
+			return;
 #ifdef THREADS_DISABLED
 		if(worker->daemon->num > 1) {
 			/* The warning can't be printed when stdin is sending
@@ -3560,18 +3959,28 @@ execute_cmd(struct daemon_remote* rc, struct rc_state* s, RES* ssl, char* cmd,
 		if(load_cache(ssl, worker)) send_ok(ssl);
 		return;
 	} else if(cmdcmp(p, "list_forwards", 13)) {
+		if(cmd_no_args(ssl, p, skipwhite(p+13)))
+			return;
 		do_list_forwards(ssl, worker);
 		return;
 	} else if(cmdcmp(p, "list_stubs", 10)) {
+		if(cmd_no_args(ssl, p, skipwhite(p+10)))
+			return;
 		do_list_stubs(ssl, worker);
 		return;
 	} else if(cmdcmp(p, "list_insecure", 13)) {
+		if(cmd_no_args(ssl, p, skipwhite(p+13)))
+			return;
 		do_insecure_list(ssl, worker);
 		return;
 	} else if(cmdcmp(p, "list_local_zones", 16)) {
+		if(cmd_no_args(ssl, p, skipwhite(p+16)))
+			return;
 		do_list_local_zones(ssl, worker->daemon->local_zones);
 		return;
 	} else if(cmdcmp(p, "list_local_data", 15)) {
+		if(cmd_no_args(ssl, p, skipwhite(p+15)))
+			return;
 		do_list_local_data(ssl, worker, worker->daemon->local_zones);
 		return;
 	} else if(cmdcmp(p, "view_list_local_zones", 21)) {
@@ -3587,6 +3996,8 @@ execute_cmd(struct daemon_remote* rc, struct rc_state* s, RES* ssl, char* cmd,
 		do_ip_ratelimit_list(ssl, worker, p+17);
 		return;
 	} else if(cmdcmp(p, "list_auth_zones", 15)) {
+		if(cmd_no_args(ssl, p, skipwhite(p+15)))
+			return;
 		do_list_auth_zones(ssl, worker->env.auth_zones);
 		return;
 	} else if(cmdcmp(p, "auth_zone_reload", 16)) {
@@ -3607,14 +4018,21 @@ execute_cmd(struct daemon_remote* rc, struct rc_state* s, RES* ssl, char* cmd,
 		return;
 	} else if(cmdcmp(p, "flush_stats", 11)) {
 		/* must always distribute this cmd */
+		if(cmd_no_args(ssl, p, skipwhite(p+11)))
+			return;
 		if(rc) distribute_cmd(rc, ssl, cmd);
 		do_flush_stats(ssl, worker);
 		return;
 	} else if(cmdcmp(p, "flush_requestlist", 17)) {
 		/* must always distribute this cmd */
+		if(cmd_no_args(ssl, p, skipwhite(p+17)))
+			return;
 		if(rc) distribute_cmd(rc, ssl, cmd);
 		do_flush_requestlist(ssl, worker);
 		return;
+	} else if(cmdcmp(p, "cache_lookup", 12)) {
+		do_cache_lookup(ssl, worker, skipwhite(p+12));
+		return;
 	} else if(cmdcmp(p, "lookup", 6)) {
 		do_lookup(ssl, worker, skipwhite(p+6));
 		return;
@@ -3622,15 +4040,23 @@ execute_cmd(struct daemon_remote* rc, struct rc_state* s, RES* ssl, char* cmd,
 	 * Each line needs to be distributed if THREADS_DISABLED.
 	 */
 	} else if(cmdcmp(p, "local_zones_remove", 18)) {
+		if(cmd_no_args(ssl, p, skipwhite(p+18)))
+			return;
 		do_zones_remove(rc, ssl, worker);
 		return;
 	} else if(cmdcmp(p, "local_zones", 11)) {
+		if(cmd_no_args(ssl, p, skipwhite(p+11)))
+			return;
 		do_zones_add(rc, ssl, worker);
 		return;
 	} else if(cmdcmp(p, "local_datas_remove", 18)) {
+		if(cmd_no_args(ssl, p, skipwhite(p+18)))
+			return;
 		do_datas_remove(rc, ssl, worker);
 		return;
 	} else if(cmdcmp(p, "local_datas", 11)) {
+		if(cmd_no_args(ssl, p, skipwhite(p+11)))
+			return;
 		do_datas_add(rc, ssl, worker);
 		return;
 	} else if(cmdcmp(p, "view_local_datas_remove", 23)){
@@ -3640,6 +4066,8 @@ execute_cmd(struct daemon_remote* rc, struct rc_state* s, RES* ssl, char* cmd,
 		do_view_datas_add(rc, ssl, worker, skipwhite(p+16));
 		return;
 	} else if(cmdcmp(p, "print_cookie_secrets", 20)) {
+		if(cmd_no_args(ssl, p, skipwhite(p+20)))
+			return;
 		do_print_cookie_secrets(ssl, worker);
 		return;
 	}
@@ -3689,10 +4117,16 @@ execute_cmd(struct daemon_remote* rc, struct rc_state* s, RES* ssl, char* cmd,
 	} else if(cmdcmp(p, "flush", 5)) {
 		do_flush_name(ssl, worker, skipwhite(p+5));
 	} else if(cmdcmp(p, "dump_requestlist", 16)) {
+		if(cmd_no_args(ssl, p, skipwhite(p+16)))
+			return;
 		do_dump_requestlist(ssl, worker);
 	} else if(cmdcmp(p, "dump_infra", 10)) {
+		if(cmd_no_args(ssl, p, skipwhite(p+10)))
+			return;
 		do_dump_infra(ssl, worker);
 	} else if(cmdcmp(p, "log_reopen", 10)) {
+		if(cmd_no_args(ssl, p, skipwhite(p+10)))
+			return;
 		do_log_reopen(ssl, worker);
 	} else if(cmdcmp(p, "set_option", 10)) {
 		do_set_option(ssl, worker, skipwhite(p+10));
@@ -3709,8 +4143,12 @@ execute_cmd(struct daemon_remote* rc, struct rc_state* s, RES* ssl, char* cmd,
 	} else if(cmdcmp(p, "add_cookie_secret", 17)) {
 		do_add_cookie_secret(ssl, worker, skipwhite(p+17));
 	} else if(cmdcmp(p, "drop_cookie_secret", 18)) {
+		if(cmd_no_args(ssl, p, skipwhite(p+18)))
+			return;
 		do_drop_cookie_secret(ssl, worker);
 	} else if(cmdcmp(p, "activate_cookie_secret", 22)) {
+		if(cmd_no_args(ssl, p, skipwhite(p+22)))
+			return;
 		do_activate_cookie_secret(ssl, worker);
 	} else {
 		(void)ssl_printf(ssl, "error unknown command '%s'\n", p);
@@ -4208,6 +4646,8 @@ struct fast_reload_construct {
 	struct acl_list* acl_interface;
 	/** construct for tcp connection limit */
 	struct tcl_list* tcl;
+	/** tsig key table */
+	struct tsig_key_table* tsig_key_table;
 	/** construct for local zones */
 	struct local_zones* local_zones;
 	/** if there is response ip configuration in use */
@@ -4594,6 +5034,7 @@ fr_construct_clear(struct fast_reload_construct* ct)
 	acl_list_delete(ct->acl);
 	acl_list_delete(ct->acl_interface);
 	tcl_list_delete(ct->tcl);
+	tsig_key_table_delete(ct->tsig_key_table);
 	edns_strings_delete(ct->edns_strings);
 	anchors_delete(ct->anchors);
 	views_delete(ct->views);
@@ -4696,6 +5137,8 @@ getmem_config_auth(struct config_auth* p)
 			+ getmem_config_strlist(s->masters)
 			+ getmem_config_strlist(s->urls)
 			+ getmem_config_strlist(s->allow_notify)
+			+ getmem_config_str2list(s->masters_tsig)
+			+ getmem_config_str2list(s->allow_notify_tsig)
 			+ getmem_str(s->zonefile)
 			+ s->rpz_taglistlen
 			+ getmem_str(s->rpz_action_override)
@@ -4860,6 +5303,7 @@ fr_printmem(struct fast_reload_thread* fr,
 	mem += auth_zones_get_mem(ct->auth_zones);
 	mem += forwards_get_mem(ct->fwds);
 	mem += hints_get_mem(ct->hints);
+	mem += tsig_key_table_get_mem(ct->tsig_key_table);
 	mem += local_zones_get_mem(ct->local_zones);
 	mem += acl_list_get_mem(ct->acl);
 	mem += acl_list_get_mem(ct->acl_interface);
@@ -4948,6 +5392,12 @@ xfr_auth_master_equal(struct auth_master* m1, struct auth_master* m2)
 		return 0;
 	if(m1->port != m2->port)
 		return 0;
+
+	if((m1->tsig_key_name && !m2->tsig_key_name) || (!m1->tsig_key_name && m2->tsig_key_name))
+		return 0;
+	if(m1->tsig_key_name && m2->tsig_key_name && strcmp(m1->tsig_key_name, m2->tsig_key_name) != 0)
+		return 0;
+
 	return 1;
 }
 
@@ -5147,12 +5597,24 @@ fr_construct_from_config(struct fast_reload_thread* fr,
 	if(fr_poll_for_quit(fr))
 		return 1;
 
+	if(!(ct->tsig_key_table = tsig_key_table_create())) {
+		fr_construct_clear(ct);
+		return 0;
+	}
+	if(!tsig_key_table_apply_cfg(ct->tsig_key_table, newcfg)) {
+		fr_construct_clear(ct);
+		return 0;
+	}
+	if(fr_poll_for_quit(fr))
+		return 1;
+
 	if(!(ct->auth_zones = auth_zones_create())) {
 		fr_construct_clear(ct);
 		return 0;
 	}
 	if(!auth_zones_apply_cfg(ct->auth_zones, newcfg, 1, &ct->use_rpz,
-		fr->worker->daemon->env, &fr->worker->daemon->mods)) {
+		fr->worker->daemon->env, &fr->worker->daemon->mods,
+		ct->tsig_key_table)) {
 		fr_construct_clear(ct);
 		return 0;
 	}
@@ -5434,6 +5896,7 @@ fr_atomic_copy_cfg(struct config_file* oldcfg, struct config_file* cfg,
 	COPY_VAR_ptr(tls_ciphers);
 	COPY_VAR_ptr(tls_ciphersuites);
 	COPY_VAR_int(tls_use_sni);
+	COPY_VAR_int(tls_use_system_policy_versions);
 	COPY_VAR_int(https_port);
 	COPY_VAR_ptr(http_endpoint);
 	COPY_VAR_uint32_t(http_max_streams);
@@ -5481,6 +5944,7 @@ fr_atomic_copy_cfg(struct config_file* oldcfg, struct config_file* cfg,
 	COPY_VAR_ptr(forwards);
 	COPY_VAR_ptr(auths);
 	COPY_VAR_ptr(views);
+	COPY_VAR_ptr(tsig_keys);
 	COPY_VAR_ptr(donotqueryaddrs);
 #ifdef CLIENT_SUBNET
 	COPY_VAR_ptr(client_subnet);
@@ -5919,6 +6383,7 @@ fr_reload_config(struct fast_reload_thread* fr, struct config_file* newcfg,
 		lock_basic_lock(&ct->anchors->lock);
 		lock_basic_lock(&env->anchors->lock);
 	}
+	lock_rw_wrlock(&env->tsig_key_table->lock);
 
 #if defined(ATOMIC_POINTER_LOCK_FREE) && defined(HAVE_LINK_ATOMIC_STORE)
 	if(fr->fr_nopause) {
@@ -5955,6 +6420,8 @@ fr_reload_config(struct fast_reload_thread* fr, struct config_file* newcfg,
 	acl_list_swap_tree(daemon->acl, ct->acl);
 	acl_list_swap_tree(daemon->acl_interface, ct->acl_interface);
 	tcl_list_swap_tree(daemon->tcl, ct->tcl);
+	tsig_key_table_swap_tree(daemon->env->tsig_key_table,
+		ct->tsig_key_table);
 	local_zones_swap_tree(daemon->local_zones, ct->local_zones);
 	respip_set_swap_tree(env->respip_set, ct->respip_set);
 	daemon->use_response_ip = ct->use_response_ip;
@@ -6001,6 +6468,7 @@ fr_reload_config(struct fast_reload_thread* fr, struct config_file* newcfg,
 		lock_basic_unlock(&ct->anchors->lock);
 		lock_basic_unlock(&env->anchors->lock);
 	}
+	lock_rw_unlock(&env->tsig_key_table->lock);
 
 	return 1;
 }
@@ -7052,6 +7520,7 @@ fr_worker_auth_add(struct worker* worker, struct fast_reload_auth_change* item,
 			xfr->serial = 0;
 		}
 	}
+	auth_zone_pickup_initial_zone(item->new_z, &worker->env);
 	lock_rw_unlock(&item->new_z->lock);
 	lock_rw_unlock(&worker->env.auth_zones->lock);
 	lock_rw_unlock(&worker->daemon->fast_reload_thread->old_auth_zones->lock);
diff --git a/daemon/unbound.c b/daemon/unbound.c
index aa7cfc8e8..688804743 100644
--- a/daemon/unbound.c
+++ b/daemon/unbound.c
@@ -463,23 +463,21 @@ detach(void)
 #endif /* HAVE_DAEMON */
 }
 
+#ifdef HAVE_SSL
 /* setup a listening ssl context, fatal_exit() on any failure */
 static void
 setup_listen_sslctx(void** ctx, int is_dot, int is_doh, struct config_file* cfg)
 {
-#ifdef HAVE_SSL
 	if(!(*ctx = listen_sslctx_create(
 		cfg->ssl_service_key, cfg->ssl_service_pem, NULL,
 		cfg->tls_ciphers, cfg->tls_ciphersuites,
 		(cfg->tls_session_ticket_keys.first &&
 		cfg->tls_session_ticket_keys.first->str[0] != 0),
-		is_dot, is_doh))) {
+		is_dot, is_doh, cfg->tls_use_system_policy_versions))) {
 		fatal_exit("could not set up listen SSL_CTX");
 	}
-#else /* HAVE_SSL */
-	(void)ctx;(void)is_dot;(void)is_doh;(void)cfg;
-#endif /* HAVE_SSL */
 }
+#endif /* HAVE_SSL */
 
 /* setups the needed ssl contexts, fatal_exit() on any failure */
 static void
diff --git a/daemon/worker.c b/daemon/worker.c
index f7a2d21d2..cb010a6a6 100644
--- a/daemon/worker.c
+++ b/daemon/worker.c
@@ -68,6 +68,7 @@
 #include "util/data/dname.h"
 #include "util/fptr_wlist.h"
 #include "util/proxy_protocol.h"
+#include "util/tsig.h"
 #include "util/tube.h"
 #include "util/edns.h"
 #include "util/timeval_func.h"
@@ -785,7 +786,7 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
 	*partial_repp = NULL;  /* avoid accidental further pass */
 
 	/* Check TTL */
-	if(rep->ttl < timenow) {
+	if(TTL_IS_EXPIRED(rep->ttl, timenow)) {
 		/* Check if we need to serve expired now */
 		if(worker->env.cfg->serve_expired &&
 			/* if serve-expired-client-timeout is set, serve
@@ -1196,35 +1197,54 @@ answer_notify(struct worker* w, struct query_info* qinfo,
 	int rcode = LDNS_RCODE_NOERROR;
 	uint32_t serial = 0;
 	int has_serial;
+	struct tsig_data* tsig = NULL;
+	int tsig_rcode = 0;
 	if(!w->env.auth_zones) return;
 	has_serial = auth_zone_parse_notify_serial(pkt, &serial);
 	if(auth_zones_notify(w->env.auth_zones, &w->env, qinfo->qname,
-		qinfo->qname_len, qinfo->qclass, addr,
-		addrlen, has_serial, serial, &refused)) {
+		qinfo->qname_len, qinfo->qclass, addr, addrlen, has_serial,
+		serial, &refused, pkt, &tsig, &tsig_rcode, w->scratchpad)) {
 		rcode = LDNS_RCODE_NOERROR;
 	} else {
-		if(refused)
+		if(tsig_rcode != 0) {
+			rcode = tsig_rcode;
+		} else if(refused) {
 			rcode = LDNS_RCODE_REFUSED;
-		else	rcode = LDNS_RCODE_SERVFAIL;
+		} else {
+			rcode = LDNS_RCODE_SERVFAIL;
+		}
 	}
 
 	if(verbosity >= VERB_DETAIL) {
-		char buf[380];
-		char zname[LDNS_MAX_DOMAINLEN];
-		char sr[25];
+		char buf[380+LDNS_MAX_DOMAINLEN];
+		char zname[LDNS_MAX_DOMAINLEN], tsigkey[LDNS_MAX_DOMAINLEN];
+		char sr[25], rcode_str[32], tsigtxt[16];;
 		dname_str(qinfo->qname, zname);
+		tsigkey[0]=0;
+		tsigtxt[0]=0;
+		if(tsig && tsig->key_name) {
+			snprintf(tsigtxt, sizeof(tsigtxt), " with TSIG ");
+			dname_str(tsig->key_name, tsigkey);
+		}
 		sr[0]=0;
 		if(has_serial)
 			snprintf(sr, sizeof(sr), "serial %u ",
 				(unsigned)serial);
-		if(rcode == LDNS_RCODE_REFUSED)
+		if(rcode == LDNS_RCODE_REFUSED) {
 			snprintf(buf, sizeof(buf),
-				"refused NOTIFY %sfor %s from", sr, zname);
-		else if(rcode == LDNS_RCODE_SERVFAIL)
+				"refused NOTIFY %sfor %s%s%s from", sr, zname,
+				tsigtxt, tsigkey);
+		} else if(rcode != LDNS_RCODE_NOERROR) {
+			sldns_wire2str_rcode_buf(rcode, rcode_str,
+				sizeof(rcode_str));
 			snprintf(buf, sizeof(buf),
-				"servfail for NOTIFY %sfor %s from", sr, zname);
-		else	snprintf(buf, sizeof(buf),
-				"received NOTIFY %sfor %s from", sr, zname);
+				"%s for NOTIFY %sfor %s%s%s from",
+				rcode_str, sr, zname, tsigtxt, tsigkey);
+		} else {
+			snprintf(buf, sizeof(buf),
+				"received NOTIFY %sfor %s%s%s from", sr, zname,
+					tsigtxt, tsigkey);
+		}
 		log_addr(VERB_DETAIL, buf, addr, addrlen);
 	}
 	edns->edns_version = EDNS_ADVERTISED_VERSION;
@@ -1235,6 +1255,24 @@ answer_notify(struct worker* w, struct query_info* qinfo,
 		*(uint16_t*)(void *)sldns_buffer_begin(pkt),
 		sldns_buffer_read_u16_at(pkt, 2), edns);
 	LDNS_OPCODE_SET(sldns_buffer_begin(pkt), LDNS_PACKET_NOTIFY);
+	if(tsig) {
+		size_t pos = sldns_buffer_limit(pkt);
+		sldns_buffer_clear(pkt);
+		sldns_buffer_set_position(pkt, pos);
+		if(!tsig_sign_reply(tsig, pkt, w->env.tsig_key_table,
+			(uint64_t)*w->env.now)) {
+			/* Failed to TSIG sign the reply */
+			verbose(VERB_ALGO, "Failed to TSIG sign notify reply");
+			error_encode(pkt, LDNS_RCODE_SERVFAIL, qinfo,
+				*(uint16_t*)(void *)sldns_buffer_begin(pkt),
+				sldns_buffer_read_u16_at(pkt, 2), edns);
+			LDNS_OPCODE_SET(sldns_buffer_begin(pkt), LDNS_PACKET_NOTIFY);
+		} else {
+			/* Flip to delimit buffer after tsig_sign_reply. */
+			sldns_buffer_flip(pkt);
+		}
+		/* The tsig veriable is allocated in the scratch region. */
+	}
 }
 
 static int
@@ -1785,6 +1823,7 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 			repinfo->client_addrlen, edns.cookie_valid,
 			c->buffer)) {
 			worker->stats.num_queries_ip_ratelimited++;
+			regional_free_all(worker->scratchpad);
 			comm_point_drop_reply(repinfo);
 			return 0;
 		}
@@ -2006,11 +2045,11 @@ lookup_cache:
 				if((worker->env.cfg->prefetch &&
 					rep->prefetch_ttl <= *worker->env.now) ||
 					(worker->env.cfg->serve_expired &&
-					rep->ttl < *worker->env.now  &&
+					TTL_IS_EXPIRED(rep->ttl, *worker->env.now) &&
 					!(*worker->env.now < rep->serve_expired_norec_ttl))) {
-					time_t leeway = rep->ttl - *worker->env.now;
-					if(rep->ttl < *worker->env.now)
-						leeway = 0;
+					time_t leeway =
+						TTL_IS_EXPIRED(rep->ttl, *worker->env.now)
+						? 0 : rep->ttl - *worker->env.now;
 					lock_rw_unlock(&e->lock);
 
 					reply_and_prefetch(worker, lookup_qinfo,
diff --git a/dns64/dns64.c b/dns64/dns64.c
index fbdbd87b9..0de1ac422 100644
--- a/dns64/dns64.c
+++ b/dns64/dns64.c
@@ -496,8 +496,8 @@ handle_ipv6_ptr(struct module_qstate* qstate, int id)
 
     /* Create the new sub-query. */
     fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub));
-    if(!(*qstate->env->attach_sub)(qstate, &qinfo, qstate->query_flags, 0, 0,
-                &subq))
+    if(!(*qstate->env->attach_sub)(qstate, &qinfo, qstate->client_info,
+	    qstate->query_flags, 0, 0, &subq))
         return module_error;
     if (subq) {
         subq->curmod = id;
@@ -522,8 +522,8 @@ generate_type_A_query(struct module_qstate* qstate, int id)
 
 	/* Start the sub-query. */
 	fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub));
-	if(!(*qstate->env->attach_sub)(qstate, &qinfo, qstate->query_flags, 0,
-				       0, &subq))
+	if(!(*qstate->env->attach_sub)(qstate, &qinfo, qstate->client_info,
+		qstate->query_flags, 0, 0, &subq))
 	{
 		verbose(VERB_ALGO, "dns64: sub-query creation failed");
 		return module_error;
diff --git a/dnstap/unbound-dnstap-socket.c b/dnstap/unbound-dnstap-socket.c
index a01627de9..c0d344cbb 100644
--- a/dnstap/unbound-dnstap-socket.c
+++ b/dnstap/unbound-dnstap-socket.c
@@ -347,7 +347,7 @@ static struct tap_socket* tap_socket_new_tlsaccept(char* ip,
 	s->ev_cb = ev_cb;
 	s->data = data;
 	s->sslctx = listen_sslctx_create(server_key, server_cert, verifypem,
-		NULL, NULL, 0, 0, 0);
+		NULL, NULL, 0, 0, 0, 0);
 	if(!s->sslctx) {
 		log_err("could not create ssl context");
 		free(s->ip);
diff --git a/doc/Changelog b/doc/Changelog
index 75e8fab91..67f54b02e 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,179 @@
+30 September 2025: Wouter
+	- Fix for #1344: Fix that respip and dns64 can be enabled at the
+	  same time, the client info is copied for attach_sub and add_sub
+	  calls. That makes respip work on dns64 synthesized answers, and
+	  also makes RPZ work with DNS64. The order for the modules is
+	  module-config: "respip dns64 validator iterator".
+
+29 September 2025: Wouter
+	- Rebuild configure script from its sources.
+	- Fix modstack_call_init to use the original string when it has
+	  changed, to call modstack_config with. And skip the changed name
+	  in the string correctly. Thanks to Jan Komissar.
+	- Neaten up the change in acx_nlnetlabs.m4 to version 49.
+	- Fix fr_atomic_copy_cfg.
+	- Rebuild configure script from its sources.
+	- Fix #1353: auth-zone can not use empty label for $ORIGIN when
+	  http download.
+	- Fix #1344: module conf 'respip dns64 validator cachedb iterator'
+	  is not known to work.
+
+29 September 2025: Yorgos
+	- Merge #1349: Fix #1346: [FR] Please allow back TLS 1.2.
+	- Merge #1351: ac_cv_func_malloc_0_nonnull for malloc(0) check.
+
+26 September 2025: Yorgos
+	- Test for nonstring attribute in configure and add
+	  nonstring attribute annotations.
+
+24 September 2025: Yorgos
+	- Avoid calling mesh_detect_cycle_found() when there is no mesh state
+	  to begin with.
+
+23 September 2025: Yorgos
+	- Merge #1352 from Petr Vaganov: pythonmod: fix HANDLE_LEAK on
+	  pythonmod_init.
+	- For #1352, align with the current Python<3 code.
+	- Merge #1350 from Maryse47: unbound.service.in: allow CAP_NET_ADMIN.
+	- For #1350, same CAP_NET_ADMIN change for unbound_portable.service.in
+	  as well.
+
+19 September 2025: Wouter
+	- Fix to remove configure~ from release tarballs.
+
+19 September 2025: Yorgos
+	- Update README.man with clearer text.
+	- Merge #1337: 0 TTL cached replies and some TTL behavior changes.
+	- TTL change: Cached records that reach TTL 0 are expired.
+	- TTL change: TTL 0 upstream answers are no longer cached by
+	   cachedb, as they should.
+	- TTL change: 'serve-expired-reply-ttl' is now capped by the original
+	  TTL value of the record to try and make some sense when replying
+	  with expired records.
+	- TTL change: TTL decoding was updated to adhere to RFC8767 section 4
+	  where a 'set high-order bit' means the value is positive instead of
+	  0.
+	- unbound.conf manpage: explicitly mention RFC6891.
+
+18 September 2025: Wouter
+	- Tag for 1.24.0 release. Includes the fixes below after rc1.
+	  The repository continues with version 1.24.1.
+
+17 September 2025: Yorgos
+	- Too many quotes for the EDE message debug printout.
+
+15 September 2025: Yorgos
+	- Small debug output improvement when attaching an EDE.
+
+15 September 2025: Wouter
+	- Fix to print warning for when so-sndbuf setsockopt is not granted.
+
+11 September 2025: Wouter
+	- version set to 1.24.0 for release.
+	- tag for 1.24.0rc1.
+	- Update contrib/aaaa-filter-iterator.patch so it applies on 1.24.0.
+
+9 September 2025: Wouter
+	- Fix #1332: CNAME chains are sometimes not followed when RPZs add a
+	  local CNAME rewrite.
+
+8 September 2025: Yorgos
+	- Update documentation for using "SET ... EX" in Redis.
+	- Document max buffer sizes for Redis commands.
+	- Update man pages.
+
+3 September 2025: Wouter
+	- For #1328: make depend.
+
+2 September 2025: Wouter
+	- Fix #1235: Outdated Python2 code in
+	  unbound/pythonmod/examples/log.py.
+	- Fix #1324: Memory leak in 'msgparse.c' in
+	  'parse_edns_options_from_query(...)'.
+	- Fix indentation in tcp-mss option parsing.
+
+1 September 2025: Wouter
+	- Fix for #1324: Fix to free edns options scratch in ratelimit case.
+
+29 August 2025: Yorgos
+	- Limit the number of consecutive reads on an HTTP/2 session.
+	  Thanks to Gal Bar Nahum for exposing the possibility of infinite
+	  reads on the session.
+
+28 August 2025: Wouter
+	- Fix setup_listen_sslctx warning for nettle compile.
+
+27 August 2025: Wouter
+	- Fix unbound-control dump_cache for double unlock of lruhash table.
+
+26 August 2025: Wouter
+	- Fix ports workflow to install expat for macos.
+
+22 August 2025: Wouter
+	- For #1318: Fix compile warnings for DoH compile on windows.
+	- Fix sha1 enable environment variable in test code on windows.
+	- Fix #1319: [FR] zone status for Unbound auth-zones.
+	- Fix that the zone acquired timestamp is set after the
+	  zonefile is read.
+
+21 August 2025: Wouter
+	- Fix to check for extraneous command arguments for unbound-control,
+	  when the command takes no arguments but there are arguments present.
+	- Fix #1317: Unbound starts too early. Add
+	  Wants=network-online.target under [Unit] in unbound.service.
+	- Fix for #1317: Fix contrib/unbound.service comment path for
+	  systemd network configuration.
+
+15 August 2025: Wouter
+	- unbound-control cache_lookup +t allows tld and root names. And
+	  subnet cache contents are printed.
+	- Fix cache_lookup subnet printout to wipe zero part of the prefix.
+	- Fix cache_lookup subnet print to not print messages without rrsets
+	  and perform in-depth check on node in the addrtree.
+
+14 August 2025: Wouter
+	- Fix to increase responsiveness of dump_cache.
+	- Fix to decouple file descriptor activity and cache lookups in
+	  dump_cache.
+
+13 August 2025: Wouter
+	- unbound-control cache_lookup <domains> prints the cached rrsets
+	  and messages for those.
+	- Fix to remove debug from cache_lookup.
+	- Fix to unlock cache_lookup message for malformed records.
+
+12 August 2025: Wouter
+	- Fix that unbound-control dump_cache releases the cache locks
+	  every so often, so that the server stays responsive.
+
+7 August 2025: Wouter
+	- Fix dname_str for printout of long names. Thanks to Jan Komissar
+	  for the fix.
+	- Fix that edns-subnet failure to create a subquery errors as
+	  servfail, and not formerror.
+	- Fix to whitespace in dname_str.
+
+6 August 2025: Wouter
+	- Fix edns subnet, so that the subquery without subnet is stored in
+	  global cache if the querier used 0.0.0.0/0 and the name and address
+	  do not receive subnet treatment. If the name and address are
+	  configured for subnet, it is stored in the subnet cache.
+
+5 August 2025: Wouter
+	- Fix #1309: incorrectly reclaimed tcp handler can cause data
+	  corruption and segfault.
+	- Fix to use assertions for consistency checks in #1309 reclaimed
+	  tcp handlers.
+
+1 August 2025: Wouter
+	- Fix testbound test program to accurately output packets from hex.
+
+28 July 2025: Wouter
+	- Fix redis cachedb module gettimeofday init failure.
+
+24 July 2025: Wouter
+	- Redis checks for server down and throttles reconnects.
+
 17 July 2025: Wouter
 	- Fix to not set rlimits in the unit tests.
 	- Fix #1303: [FR] Disable TLSv1.2.
diff --git a/doc/README.man b/doc/README.man
index 8e7897f47..dae1bc94c 100644
--- a/doc/README.man
+++ b/doc/README.man
@@ -6,11 +6,16 @@ and makes it easier to maintain and contribute to the documentation.
 The templated man pages (*.in) are still part of the code repository as to not
 alter current procedures that could be in place by users/packagers.
 
+These man pages (*.in) are still the ones being used when
+configuring/installing Unbound.
+Packagers/users do not have to generate any man pages themselves, this is done
+by the core developers during development and upon releasing new versions.
+
 The templated man pages (*.in) are generated by Sphinx (used for the online
 documentation).
 The online documentation has its own repository at
 https://github.com/NLnetLabs/unbound-manual.
 
-In the README.md there (branch test-auto for now), there are further simple
-instructions on how to generate the templated man pages there and update them
-in this repository.
+In that README.md (https://github.com/NLnetLabs/unbound-manual/README.md)
+there are further simple instructions on how to generate the templated man
+pages there and update them in this repository.
diff --git a/doc/example.conf.in b/doc/example.conf.in
index bdfdc6450..4701ecb68 100644
--- a/doc/example.conf.in
+++ b/doc/example.conf.in
@@ -752,6 +752,7 @@ server:
 	# serve-expired-ttl-reset: no
 	#
 	# TTL value to use when replying with expired data.
+	# Capped by the original TTL of the record.
 	# serve-expired-reply-ttl: 30
 	#
 	# Time in milliseconds before replying to the client with expired data.
@@ -931,21 +932,26 @@ server:
 	# https-port: 443
 	# quic-port: 853
 
+	# Also serve tls on these port numbers (eg. 443, ...), by listing
+	# tls-additional-port: portno for each of the port numbers.
+
 	# cipher setting for TLSv1.2
 	# tls-ciphers: "DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256"
 	# cipher setting for TLSv1.3
 	# tls-ciphersuites: "TLS_AES_128_GCM_SHA256:TLS_AES_128_CCM_8_SHA256:TLS_AES_128_CCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256"
 
-	# Pad responses to padded queries received over TLS
-	# pad-responses: yes
-
-	# Padded responses will be padded to the closest multiple of this size.
-	# pad-responses-block-size: 468
-
 	# Use the SNI extension for TLS connections.  Default is yes.
 	# Changing the value requires a reload.
 	# tls-use-sni: yes
 
+	# Allow general-purpose version-flexible TLS server configuration that
+	# may be further restricted by the system's policy.
+	# Use only if you want to support legacy TLS client connections.
+	# Default is no and Unbound will only use the latest available TLS
+	# version.
+	# Changing the value requires a reload.
+	# tls-use-system-policy-versions: no
+
 	# Add the secret file for TLS Session Ticket.
 	# Secret file must be 80 bytes of random data.
 	# First key use to encrypt and decrypt TLS session tickets.
@@ -966,15 +972,18 @@ server:
 	# and on other systems, the default openssl certificates
 	# tls-system-cert: no
 
+	# Pad responses to padded queries received over TLS
+	# pad-responses: yes
+
+	# Padded responses will be padded to the closest multiple of this size.
+	# pad-responses-block-size: 468
+
 	# Pad queries over TLS upstreams
 	# pad-queries: yes
 
 	# Padded queries will be padded to the closest multiple of this size.
 	# pad-queries-block-size: 128
 
-	# Also serve tls on these port numbers (eg. 443, ...), by listing
-	# tls-additional-port: portno for each of the port numbers.
-
 	# HTTP endpoint to provide DNS-over-HTTPS service on.
 	# http-endpoint: "/dns-query"
 
@@ -1226,7 +1235,8 @@ remote-control:
 # authoritatively.  zonefile: reads from file (and writes to it if you also
 # download it), primary: fetches with AXFR and IXFR, or url to zonefile.
 # With allow-notify: you can give additional (apart from primaries and urls)
-# sources of notifies.
+# sources of notifies. primary-tsig: and allow-notify-tsig: use addr keyname,
+# with the name of the TSIG key to use, declared as a tsig-key:.
 # auth-zone:
 #	name: "."
 #	primary: 170.247.170.2        # b.root-servers.net
@@ -1405,6 +1415,7 @@ remote-control:
 # and drop.  Policies can be loaded from a file, or using zone
 # transfer, or using HTTP. The respip module needs to be added
 # to the module-config, e.g.: module-config: "respip validator iterator".
+# Can also use primary-tsig: and allow-notify-tsig:
 # rpz:
 #     name: "rpz.example.com"
 #     zonefile: "rpz.example.com"
diff --git a/doc/unbound-control.8.in b/doc/unbound-control.8.in
index 687c680e2..c05831e41 100644
--- a/doc/unbound-control.8.in
+++ b/doc/unbound-control.8.in
@@ -400,6 +400,19 @@ Not supported in remote Unbounds in multi\-process operation.
 .UNINDENT
 .INDENT 0.0
 .TP
+.B cache_lookup [\fB+t\fP] \fInames\fP 
+Print to stdout the RRsets and messages that are in the cache.
+For every name listed the content at or under the name is printed.
+Several names separated by spaces can be given, each is printed.
+When subnetcache is enabled, also matching entries from the subnet
+cache are printed.
+.sp
+The \fB+t\fP option allows tld and root names.
+With it names like \(aqcom\(aq and \(aq.\(aq can be used, but it takes a lot of
+effort to look up in the cache.
+.UNINDENT
+.INDENT 0.0
+.TP
 .B lookup \fIname\fP 
 Print to stdout the name servers that would be used to look up the name
 specified.
diff --git a/doc/unbound-control.rst b/doc/unbound-control.rst
index 1f3cc4a8e..b08bc6a24 100644
--- a/doc/unbound-control.rst
+++ b/doc/unbound-control.rst
@@ -150,6 +150,7 @@ There are several commands that the server understands.
     :ref:`trusted-keys-file<unbound.conf.trusted-keys-file>`,
     :ref:`auto-trust-anchor-file<unbound.conf.auto-trust-anchor-file>`,
     :ref:`edns-client-string<unbound.conf.edns-client-string>`,
+    :ref:`tsig-key<unbound.conf.tsig-key>`,
     ipset,
     :ref:`log-identity<unbound.conf.log-identity>`,
     :ref:`infra-cache-numhosts<unbound.conf.infra-cache-numhosts>`,
@@ -386,6 +387,18 @@ There are several commands that the server understands.
     Not supported in remote Unbounds in multi-process operation.
 
 
+@@UAHL@unbound-control.commands@cache_lookup@@ [``+t``] *names*
+    Print to stdout the RRsets and messages that are in the cache.
+    For every name listed the content at or under the name is printed.
+    Several names separated by spaces can be given, each is printed.
+    When subnetcache is enabled, also matching entries from the subnet
+    cache are printed.
+
+    The ``+t`` option allows tld and root names.
+    With it names like 'com' and '.' can be used, but it takes a lot of
+    effort to look up in the cache.
+
+
 @@UAHL@unbound-control.commands@lookup@@ *name*
     Print to stdout the name servers that would be used to look up the name
     specified.
diff --git a/doc/unbound.conf.5.in b/doc/unbound.conf.5.in
index 5cb497c97..08a926bd5 100644
--- a/doc/unbound.conf.5.in
+++ b/doc/unbound.conf.5.in
@@ -1218,6 +1218,47 @@ Default: \(dq\(dq
 .UNINDENT
 .INDENT 0.0
 .TP
+.B tls\-use\-sni: \fI<yes or no>\fP 
+Enable or disable sending the SNI extension on TLS connections.
+.sp
+\fBNOTE:\fP
+.INDENT 7.0
+.INDENT 3.5
+Changing the value requires a reload.
+.UNINDENT
+.UNINDENT
+.sp
+Default: yes
+.UNINDENT
+.INDENT 0.0
+.TP
+.B tls\-use\-system\-policy\-versions: \fI<yes or no>\fP 
+Enable or disable general\-puspose version\-flexible TLS server configuration
+when serving TLS.
+This will allow the whole list of available TLS versions provided by the
+crypto library, which may have been further restricted by the system\(aqs
+crypto policy.
+.sp
+By default Unbound only uses the latest available TLS version.
+.sp
+\fBCAUTION:\fP
+.INDENT 7.0
+.INDENT 3.5
+Use only if you want to support legacy TLS client connections.
+.UNINDENT
+.UNINDENT
+.sp
+\fBNOTE:\fP
+.INDENT 7.0
+.INDENT 3.5
+Changing the value requires a reload.
+.UNINDENT
+.UNINDENT
+.sp
+Default: no
+.UNINDENT
+.INDENT 0.0
+.TP
 .B pad\-responses: \fI<yes or no>\fP 
 If enabled, TLS serviced queries that contained an EDNS Padding option will
 cause responses padded to the closest multiple of the size specified in
@@ -1251,20 +1292,6 @@ Default: 128
 .UNINDENT
 .INDENT 0.0
 .TP
-.B tls\-use\-sni: \fI<yes or no>\fP 
-Enable or disable sending the SNI extension on TLS connections.
-.sp
-\fBNOTE:\fP
-.INDENT 7.0
-.INDENT 3.5
-Changing the value requires a reload.
-.UNINDENT
-.UNINDENT
-.sp
-Default: yes
-.UNINDENT
-.INDENT 0.0
-.TP
 .B https\-port: \fI<number>\fP 
 The port number on which to provide DNS\-over\-HTTPS service.
 Only interfaces configured with that port number as @number get the HTTPS
@@ -1969,7 +1996,7 @@ Default:  \(dq3 2 1 0 0\(dq
 .B harden\-short\-bufsize: \fI<yes or no>\fP 
 Very small EDNS buffer sizes from queries are ignored.
 .sp
-Default: yes (as described in the standard)
+Default: yes (per \fI\%RFC 6891\fP)
 .UNINDENT
 .INDENT 0.0
 .TP
@@ -2600,6 +2627,12 @@ If
 \fI\%serve\-expired\-client\-timeout\fP
 is also used then it is RECOMMENDED to use 30 as the value (\fI\%RFC 8767\fP).
 .sp
+This value is capped by the original TTL of the record.
+This means that records with higher original TTL than this value will use
+this value for expired replies.
+Records with lower original TTL than this value will use their original TTL
+for expired replies.
+.sp
 Default: 30
 .UNINDENT
 .INDENT 0.0
@@ -5146,7 +5179,7 @@ internally reverted to \(dqno\(dq.
 \fBNOTE:\fP
 .INDENT 7.0
 .INDENT 3.5
-Redis SETEX support is required for this option (Redis >= 2.0.0).
+Redis \(dqSET ... EX\(dq support is required for this option (Redis >= 2.6.12).
 .UNINDENT
 .UNINDENT
 .sp
diff --git a/doc/unbound.conf.rst b/doc/unbound.conf.rst
index c1a8406e5..3c2b1781e 100644
--- a/doc/unbound.conf.rst
+++ b/doc/unbound.conf.rst
@@ -1103,6 +1103,30 @@ These options are part of the **server:** clause.
     Default: ""
 
 
+@@UAHL@unbound.conf@tls-use-sni@@: *<yes or no>*
+    Enable or disable sending the SNI extension on TLS connections.
+
+    .. note:: Changing the value requires a reload.
+
+    Default: yes
+
+
+@@UAHL@unbound.conf@tls-use-system-policy-versions@@: *<yes or no>*
+    Enable or disable general-puspose version-flexible TLS server configuration
+    when serving TLS.
+    This will allow the whole list of available TLS versions provided by the
+    crypto library, which may have been further restricted by the system's
+    crypto policy.
+
+    By default Unbound only uses the latest available TLS version.
+
+    .. caution:: Use only if you want to support legacy TLS client connections.
+
+    .. note:: Changing the value requires a reload.
+
+    Default: no
+
+
 @@UAHL@unbound.conf@pad-responses@@: *<yes or no>*
     If enabled, TLS serviced queries that contained an EDNS Padding option will
     cause responses padded to the closest multiple of the size specified in
@@ -1132,14 +1156,6 @@ These options are part of the **server:** clause.
     Default: 128
 
 
-@@UAHL@unbound.conf@tls-use-sni@@: *<yes or no>*
-    Enable or disable sending the SNI extension on TLS connections.
-
-    .. note:: Changing the value requires a reload.
-
-    Default: yes
-
-
 @@UAHL@unbound.conf@https-port@@: *<number>*
     The port number on which to provide DNS-over-HTTPS service.
     Only interfaces configured with that port number as @number get the HTTPS
@@ -1744,7 +1760,7 @@ These options are part of the **server:** clause.
 @@UAHL@unbound.conf@harden-short-bufsize@@: *<yes or no>*
     Very small EDNS buffer sizes from queries are ignored.
 
-    Default: yes (as described in the standard)
+    Default: yes (per :rfc:`6891`)
 
 
 @@UAHL@unbound.conf@harden-large-queries@@: *<yes or no>*
@@ -2306,6 +2322,12 @@ These options are part of the **server:** clause.
     :ref:`serve-expired-client-timeout<unbound.conf.serve-expired-client-timeout>`
     is also used then it is RECOMMENDED to use 30 as the value (:rfc:`8767`).
 
+    This value is capped by the original TTL of the record.
+    This means that records with higher original TTL than this value will use
+    this value for expired replies.
+    Records with lower original TTL than this value will use their original TTL
+    for expired replies.
+
     Default: 30
 
 
@@ -3691,6 +3713,12 @@ fallback activates to fetch from the upstream instead of the SERVFAIL.
     Alternate syntax for :ref:`primary<unbound.conf.auth.primary>`.
 
 
+@@UAHL@unbound.conf.auth@primary-tsig@@: *<IP address or host name>* *<tsig key>*
+    Similar to :ref:`primary<unbound.conf.auth.primary>` and the tsig key
+    is used for TSIG.
+    The key name is from a :ref:`tsig-key<unbound.conf.tsig-key>` entry.
+
+
 @@UAHL@unbound.conf.auth@url@@: *<URL to zone file>*
     Where to download a zonefile for the zone.
     With HTTP or HTTPS.
@@ -3737,6 +3765,12 @@ fallback activates to fetch from the upstream instead of the SERVFAIL.
         default.
 
 
+@@UAHL@unbound.conf.auth@allow-notify-tsig@@: *<IP address or host name or netblockIP/prefix>* *<tsig key>*
+    Similar to :ref:`allow-notify<unbound.conf.auth.allow-notify>` and the
+    tsig key is used for TSIG.
+    The key name is from a :ref:`tsig-key<unbound.conf.tsig-key>` entry.
+
+
 @@UAHL@unbound.conf.auth@fallback-enabled@@: *<yes or no>*
     If enabled, Unbound falls back to querying the internet as a resolver for
     this zone when lookups fail.
@@ -4495,7 +4529,7 @@ The following **cachedb:** options are specific to the ``redis`` backend.
     internally reverted to "no".
 
     .. note::
-        Redis SETEX support is required for this option (Redis >= 2.0.0).
+        Redis "SET ... EX" support is required for this option (Redis >= 2.6.12).
 
     Default: no
 
@@ -4840,6 +4874,12 @@ The RPZ zones can be configured in the config file with these settings in the
     Alternate syntax for :ref:`primary<unbound.conf.rpz.primary>`.
 
 
+@@UAHL@unbound.conf.rpz@primary-tsig@@: *<IP address or host name>* *<tsig key>*
+    Similar to :ref:`primary<unbound.conf.rpz.primary>` and the tsig key
+    is used for TSIG.
+    The key name is from a :ref:`tsig-key<unbound.conf.tsig-key>` entry.
+
+
 @@UAHL@unbound.conf.rpz@url@@: *<url to zonefile>*
     Where to download a zonefile for the zone.
     With HTTP or HTTPS.
@@ -4877,6 +4917,12 @@ The RPZ zones can be configured in the config file with these settings in the
         default.
 
 
+@@UAHL@unbound.conf.rpz@allow-notify-tsig@@: *<IP address or host name or netblockIP/prefix>* *<tsig key>*
+    Similar to :ref:`allow-notify<unbound.conf.rpz.allow-notify>` and the
+    tsig key is used for TSIG.
+    The key name is from a :ref:`tsig-key<unbound.conf.tsig-key>` entry.
+
+
 @@UAHL@unbound.conf.rpz@zonefile@@: *<filename>*
     The filename where the zone is stored.
     If not given then no zonefile is used.
diff --git a/edns-subnet/subnetmod.c b/edns-subnet/subnetmod.c
index c763c5f1a..a2a3f1846 100644
--- a/edns-subnet/subnetmod.c
+++ b/edns-subnet/subnetmod.c
@@ -154,6 +154,21 @@ int ecs_whitelist_check(struct query_info* qinfo,
 		return 1;
 	sn_env = (struct subnet_env*)qstate->env->modinfo[id];
 
+	if(sq->is_subquery_nonsubnet) {
+		if(sq->is_subquery_scopezero) {
+			/* Check if the result can be stored in the global cache,
+			 * this is okay if the address and name are not configured
+			 * as subnet address and subnet zone. */
+			if(!ecs_is_whitelisted(sn_env->whitelist,
+				addr, addrlen, qinfo->qname, qinfo->qname_len,
+				qinfo->qclass)) {
+				verbose(VERB_ALGO, "subnet store subquery global, name and addr have no subnet treatment.");
+				qstate->no_cache_store = 0;
+			}
+		}
+		return 1;
+	}
+
 	/* Cache by default, might be disabled after parsing EDNS option
 	 * received from nameserver. */
 	if(!iter_stub_fwd_no_cache(qstate, &qstate->qinfo, NULL, NULL, NULL, 0)
@@ -527,11 +542,12 @@ common_prefix(uint8_t *a, uint8_t *b, uint8_t net)
 /**
  * Create sub request that looks up the query.
  * @param qstate: query state
+ * @param id: module id.
  * @param sq: subnet qstate
  * @return false on failure.
  */
 static int
-generate_sub_request(struct module_qstate *qstate, struct subnet_qstate* sq)
+generate_sub_request(struct module_qstate *qstate, int id, struct subnet_qstate* sq)
 {
 	struct module_qstate* subq = NULL;
 	uint16_t qflags = 0; /* OPCODE QUERY, no flags */
@@ -551,16 +567,28 @@ generate_sub_request(struct module_qstate *qstate, struct subnet_qstate* sq)
 	}
 
 	fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub));
-	if(!(*qstate->env->attach_sub)(qstate, &qinf, qflags, prime, valrec,
-		&subq)) {
+	if(!(*qstate->env->attach_sub)(qstate, &qinf, qstate->client_info,
+		qflags, prime, valrec, &subq)) {
 		return 0;
 	}
 	if(subq) {
 		/* It is possible to access the subquery module state. */
+		struct subnet_qstate* subsq;
+		if(!subnet_new_qstate(subq, id)) {
+			verbose(VERB_ALGO, "Could not allocate new subnet qstate");
+			return 0;
+		}
+		subsq = (struct subnet_qstate*)subq->minfo[id];
+		subsq->is_subquery_nonsubnet = 1;
+
+		/* When the client asks 0.0.0.0/0 and the name is not treated
+		 * as subnet, it is to be stored in the global cache.
+		 * Store that the client asked for that, if so. */
 		if(sq->ecs_client_in.subnet_source_mask == 0 &&
 			edns_opt_list_find(qstate->edns_opts_front_in,
 				qstate->env->cfg->client_subnet_opcode)) {
 			subq->no_cache_store = 1;
+			subsq->is_subquery_scopezero = 1;
 		}
 	}
 	return 1;
@@ -569,17 +597,18 @@ generate_sub_request(struct module_qstate *qstate, struct subnet_qstate* sq)
 /**
  * Perform the query without subnet
  * @param qstate: query state
+ * @param id: module id.
  * @param sq: subnet qstate
  * @return module state
  */
 static enum module_ext_state
-generate_lookup_without_subnet(struct module_qstate *qstate,
+generate_lookup_without_subnet(struct module_qstate *qstate, int id,
 	struct subnet_qstate* sq)
 {
 	verbose(VERB_ALGO, "subnetcache: make subquery to look up without subnet");
-	if(!generate_sub_request(qstate, sq)) {
+	if(!generate_sub_request(qstate, id, sq)) {
 		verbose(VERB_ALGO, "Could not generate sub query");
-		qstate->return_rcode = LDNS_RCODE_FORMERR;
+		qstate->return_rcode = LDNS_RCODE_SERVFAIL;
 		qstate->return_msg = NULL;
 		return module_finished;
 	}
@@ -622,7 +651,7 @@ eval_response(struct module_qstate *qstate, int id, struct subnet_qstate *sq)
 		 * is still useful to put it in the edns subnet cache for
 		 * when a client explicitly asks for subnet specific answer. */
 		verbose(VERB_QUERY, "subnetcache: Authority indicates no support");
-		return generate_lookup_without_subnet(qstate, sq);
+		return generate_lookup_without_subnet(qstate, id, sq);
 	}
 
 	/* Purposefully there was no sent subnet, and there is consequently
@@ -654,7 +683,7 @@ eval_response(struct module_qstate *qstate, int id, struct subnet_qstate *sq)
 			qstate->env->cfg->client_subnet_opcode);
 		sq->subnet_sent = 0;
 		sq->subnet_sent_no_subnet = 0;
-		return generate_lookup_without_subnet(qstate, sq);
+		return generate_lookup_without_subnet(qstate, id, sq);
 	}
 
 	lock_rw_wrlock(&sne->biglock);
@@ -945,7 +974,7 @@ subnetmod_operate(struct module_qstate *qstate, enum module_ev event,
 				/* aggregated this deaggregated state */
 				qstate->ext_state[id] =
 					generate_lookup_without_subnet(
-					qstate, sq);
+					qstate, id, sq);
 				return;
 			}
 			verbose(VERB_ALGO, "subnetcache: pass to next module");
@@ -993,7 +1022,7 @@ subnetmod_operate(struct module_qstate *qstate, enum module_ev event,
 				qstate->env->cfg->client_subnet_opcode)) {
 			/* client asked for resolution without edns subnet */
 			qstate->ext_state[id] = generate_lookup_without_subnet(
-				qstate, sq);
+				qstate, id, sq);
 			return;
 		}
 		
diff --git a/edns-subnet/subnetmod.h b/edns-subnet/subnetmod.h
index 3893820fa..d2d9e957f 100644
--- a/edns-subnet/subnetmod.h
+++ b/edns-subnet/subnetmod.h
@@ -106,6 +106,10 @@ struct subnet_qstate {
 	int wait_subquery;
 	/** The subquery waited for is done. */
 	int wait_subquery_done;
+	/** The subnet state is a subquery state for nonsubnet lookup. */
+	int is_subquery_nonsubnet;
+	/** This is a subquery, and it is made due to a scope zero request. */
+	int is_subquery_scopezero;
 };
 
 void subnet_data_delete(void* d, void* ATTR_UNUSED(arg));
diff --git a/ipsecmod/ipsecmod.c b/ipsecmod/ipsecmod.c
index 1c9e6e6a5..ce38b55cf 100644
--- a/ipsecmod/ipsecmod.c
+++ b/ipsecmod/ipsecmod.c
@@ -163,7 +163,7 @@ generate_request(struct module_qstate* qstate, int id, uint8_t* name,
 	}
 
 	fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub));
-	if(!(*qstate->env->attach_sub)(qstate, &ask,
+	if(!(*qstate->env->attach_sub)(qstate, &ask, NULL,
 		(uint16_t)(BIT_RD|flags), 0, 0, &newq)){
 		log_err("Could not generate request: out of memory");
 		return 0;
diff --git a/iterator/iterator.c b/iterator/iterator.c
index 71e64655f..071dd0827 100644
--- a/iterator/iterator.c
+++ b/iterator/iterator.c
@@ -829,7 +829,7 @@ generate_sub_request(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 		struct mesh_state* sub = NULL;
 		fptr_ok(fptr_whitelist_modenv_add_sub(
 			qstate->env->add_sub));
-		if(!(*qstate->env->add_sub)(qstate, &qinf,
+		if(!(*qstate->env->add_sub)(qstate, &qinf, NULL,
 			qflags, prime, valrec, &subq, &sub)){
 			return 0;
 		}
@@ -838,8 +838,8 @@ generate_sub_request(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 		/* attach subquery, lookup existing or make a new one */
 		fptr_ok(fptr_whitelist_modenv_attach_sub(
 			qstate->env->attach_sub));
-		if(!(*qstate->env->attach_sub)(qstate, &qinf, qflags, prime,
-			valrec, &subq)) {
+		if(!(*qstate->env->attach_sub)(qstate, &qinf, NULL, qflags,
+			prime, valrec, &subq)) {
 			return 0;
 		}
 	}
diff --git a/libunbound/context.c b/libunbound/context.c
index 38b5dbf00..02c279bc5 100644
--- a/libunbound/context.c
+++ b/libunbound/context.c
@@ -90,7 +90,7 @@ context_finalize(struct ub_ctx* ctx)
 	if(!local_zones_apply_cfg(ctx->local_zones, cfg))
 		return UB_INITFAIL;
 	if(!auth_zones_apply_cfg(ctx->env->auth_zones, cfg, 1, &is_rpz,
-		ctx->env, &ctx->mods))
+		ctx->env, &ctx->mods, ctx->env->tsig_key_table))
 		return UB_INITFAIL;
 	if(!(ctx->env->fwds = forwards_create()) ||
 		!forwards_apply_cfg(ctx->env->fwds, cfg))
diff --git a/makedist.sh b/makedist.sh
index b6b593431..008e2ce4c 100755
--- a/makedist.sh
+++ b/makedist.sh
@@ -440,6 +440,7 @@ if [ "$DOWIN" = "yes" ]; then
 	autoheader -f || error_cleanup "Autoheader failed."
     	rm -r autom4te* || echo "ignored"
 	rm -f config.h.in~ || echo "ignore absence of config.h.in~ file."
+	rm -f configure~ || echo "ignore absence of configure~ file."
     fi
 
     if test "`uname`" = "Linux"; then 
@@ -621,6 +622,7 @@ autoreconf -f || error_cleanup "Autoconf failed."
 
 rm -r autom4te* || error_cleanup "Failed to remove autoconf cache directory."
 rm -f config.h.in~ || echo "ignore absence of config.h.in~ file."
+rm -f configure~ || echo "ignore absence of configure~ file."
 
 info "Building lexer and parser."
 echo "#include \"config.h\"" > util/configlexer.c || error_cleanup "Failed to create configlexer"
@@ -666,6 +668,7 @@ if [ "$RECONFIGURE" = "yes" ]; then
     autoreconf -f || error_cleanup "Autoconf failed."
     rm -r autom4te* || error_cleanup "Failed to remove autoconf cache directory."
     rm -f config.h.in~ || echo "ignore absence of config.h.in~ file."
+    rm -f configure~ || echo "ignore absence of configure~ file."
 fi
 
 replace_all doc/README
diff --git a/pythonmod/examples/log.py b/pythonmod/examples/log.py
index 03f741962..eb520d14c 100644
--- a/pythonmod/examples/log.py
+++ b/pythonmod/examples/log.py
@@ -38,12 +38,14 @@ import os
 def dataHex(data, prefix=""):
     """Converts binary string data to display representation form"""
     res = ""
-    for i in range(0, (len(data)+15)/16):
+    for i in range(0, int((len(data)+15)/16)):
         res += "%s0x%02X | " % (prefix, i*16)
-        d = map(lambda x:ord(x), data[i*16:i*16+17])
+        d = map(lambda x:x, data[i*16:i*16+17])
+        count=0
         for ch in d:
             res += "%02X " % ch
-        for i in range(0,17-len(d)):
+            count+=1
+        for i in range(0,17-count):
             res += "   "
         res += "| "
         for ch in d:
@@ -60,31 +62,31 @@ def logDnsMsg(qstate):
     r  = qstate.return_msg.rep
     q  = qstate.return_msg.qinfo
 
-    print "-"*100
+    print("-"*100)
     print("Query: %s, type: %s (%d), class: %s (%d) " % (
             qstate.qinfo.qname_str, qstate.qinfo.qtype_str, qstate.qinfo.qtype,
             qstate.qinfo.qclass_str, qstate.qinfo.qclass))
-    print "-"*100
-    print "Return    reply :: flags: %04X, QDcount: %d, Security:%d, TTL=%d" % (r.flags, r.qdcount, r.security, r.ttl)
-    print "          qinfo :: qname: %s %s, qtype: %s, qclass: %s" % (str(q.qname_list), q.qname_str, q.qtype_str, q.qclass_str)
+    print("-"*100)
+    print("Return    reply :: flags: %04X, QDcount: %d, Security:%d, TTL=%d" % (r.flags, r.qdcount, r.security, r.ttl))
+    print("          qinfo :: qname: %s %s, qtype: %s, qclass: %s" % (str(q.qname_list), q.qname_str, q.qtype_str, q.qclass_str))
 
     if (r):
-        print "Reply:"
+        print("Reply:")
         for i in range(0, r.rrset_count):
             rr = r.rrsets[i]
 
             rk = rr.rk
-            print i,":",rk.dname_list, rk.dname_str, "flags: %04X" % rk.flags,
-            print "type:",rk.type_str,"(%d)" % ntohs(rk.type), "class:",rk.rrset_class_str,"(%d)" % ntohs(rk.rrset_class)
+            print(i,":",rk.dname_list, rk.dname_str, "flags: %04X" % rk.flags,)
+            print("type:",rk.type_str,"(%d)" % ntohs(rk.type), "class:",rk.rrset_class_str,"(%d)" % ntohs(rk.rrset_class))
 
             d = rr.entry.data
             for j in range(0,d.count+d.rrsig_count):
-                print "  ",j,":","TTL=",d.rr_ttl[j],
-                if (j >= d.count): print "rrsig",
-                print 
-                print dataHex(d.rr_data[j],"       ")
+                print("  ",j,":","TTL=",d.rr_ttl[j],)
+                if (j >= d.count): print("rrsig",)
+                print()
+                print(dataHex(d.rr_data[j],"       "))
 
-    print "-"*100
+    print("-"*100)
 
 def init(id, cfg):
    log_info("pythonmod: init called, module id is %d port: %d script: %s" % (id, cfg.port, mod_env['script']))
diff --git a/pythonmod/interface.i b/pythonmod/interface.i
index 2040fb9e8..7ac868df5 100644
--- a/pythonmod/interface.i
+++ b/pythonmod/interface.i
@@ -732,8 +732,8 @@ struct module_env {
         char* tls_auth_name, struct module_qstate* q, int* was_ratelimited);
     void (*detach_subs)(struct module_qstate* qstate);
     int (*attach_sub)(struct module_qstate* qstate,
-        struct query_info* qinfo, uint16_t qflags, int prime,
-        int valrec, struct module_qstate** newq);
+        struct query_info* qinfo, struct respip_client_info* cinfo,
+        uint16_t qflags, int prime, int valrec, struct module_qstate** newq);
     void (*kill_sub)(struct module_qstate* newq);
     int (*detect_cycle)(struct module_qstate* qstate,
         struct query_info* qinfo, uint16_t flags, int prime,
diff --git a/pythonmod/pythonmod.c b/pythonmod/pythonmod.c
index e231ad079..7cd9a7543 100644
--- a/pythonmod/pythonmod.c
+++ b/pythonmod/pythonmod.c
@@ -454,7 +454,7 @@ int pythonmod_init(struct module_env* env, int id)
    if(PyDict_SetItemString(pe->data, "script", fname) < 0) {
 	log_err("pythonmod: could not add item to dictionary");
 	Py_XDECREF(fname);
-	goto python_init_fail;
+	goto fail_close_file;
    }
    Py_XDECREF(fname);
    Py_XINCREF(pe->data);  /* reference will be stolen below */
@@ -462,7 +462,7 @@ int pythonmod_init(struct module_env* env, int id)
 	log_err("pythonmod: could not add mod_env object");
 	Py_XDECREF(pe->data);  /* 2 times, here and on python_init_fail; */
 	                       /* on failure the reference is not stolen */
-	goto python_init_fail;
+	goto fail_close_file;
    }
 
    if (PyRun_SimpleFile(script_py, pe->fname) < 0) {
@@ -493,31 +493,15 @@ int pythonmod_init(struct module_env* env, int id)
       flen = (size_t)ftell(script_py);
       fstr = malloc(flen+1);
       if(!fstr) {
-	      log_err("malloc failure to print parse error");
-
-/* close the file */
-#if PY_MAJOR_VERSION < 3
-	      Py_XDECREF(PyFileObject);
-#else
-	      fclose(script_py);
-#endif
-
-	      goto python_init_fail;
+		log_err("malloc failure to print parse error");
+		goto fail_close_file;
       }
       fseek(script_py, 0, SEEK_SET);
       if(fread(fstr, flen, 1, script_py) < 1) {
-	      log_err("file read failed to print parse error: %s: %s",
+		log_err("file read failed to print parse error: %s: %s",
 		pe->fname, strerror(errno));
-	      free(fstr);
-
-/* close the file */
-#if PY_MAJOR_VERSION < 3
-	      Py_XDECREF(PyFileObject);
-#else
-	      fclose(script_py);
-#endif
-
-	      goto python_init_fail;
+		free(fstr);
+		goto fail_close_file;
       }
       fstr[flen] = 0;
       /* we compile the string, but do not run it, to stop side-effects */
@@ -527,21 +511,13 @@ int pythonmod_init(struct module_env* env, int id)
 #endif
 
       log_py_err();
-
-/* close the file */
-#if PY_MAJOR_VERSION < 3
-      Py_XDECREF(PyFileObject);
-#else
-      fclose(script_py);
-#endif
-
 #if PY_MAJOR_VERSION <= 2 || (PY_MAJOR_VERSION == 3 && PY_MINOR_VERSION < 9)
       /* no cleanup needed for python before 3.9 */
 #else
       /* cleanup for python 3.9 and newer */
       free(fstr);
 #endif
-      goto python_init_fail;
+      goto fail_close_file;
    }
 
 /* close the file */
@@ -602,6 +578,13 @@ int pythonmod_init(struct module_env* env, int id)
    PyGILState_Release(gil);
    return 1;
 
+fail_close_file:
+#if PY_MAJOR_VERSION < 3
+   Py_XDECREF(PyFileObject);
+#else
+   fclose(script_py);
+#endif
+
 python_init_fail:
    Py_XDECREF(pe->module);
    Py_XDECREF(pe->dict);
diff --git a/respip/respip.c b/respip/respip.c
index 353a0fd78..f39ce5805 100644
--- a/respip/respip.c
+++ b/respip/respip.c
@@ -1074,7 +1074,8 @@ generate_cname_request(struct module_qstate* qstate,
 	subqi.qtype = qstate->qinfo.qtype;
 	subqi.qclass = qstate->qinfo.qclass;
 	fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub));
-	return (*qstate->env->attach_sub)(qstate, &subqi, BIT_RD, 0, 0, &subq);
+	return (*qstate->env->attach_sub)(qstate, &subqi,
+		qstate->client_info, BIT_RD, 0, 0, &subq);
 }
 
 void
@@ -1233,7 +1234,8 @@ respip_inform_super(struct module_qstate* qstate, int id,
 	struct respip_qstate* rq = (struct respip_qstate*)super->minfo[id];
 	struct reply_info* new_rep = NULL;
 
-	rq->state = RESPIP_SUBQUERY_FINISHED;
+	if(rq)
+		rq->state = RESPIP_SUBQUERY_FINISHED;
 
 	/* respip subquery should have always been created with a valid reply
 	 * in super. */
diff --git a/services/authzone.c b/services/authzone.c
index 591a76cd9..ebe4fc670 100644
--- a/services/authzone.c
+++ b/services/authzone.c
@@ -55,6 +55,7 @@
 #include "util/log.h"
 #include "util/module.h"
 #include "util/random.h"
+#include "util/tsig.h"
 #include "services/cache/dns.h"
 #include "services/outside_network.h"
 #include "services/listen_dnsport.h"
@@ -171,7 +172,7 @@ get_rrset_ttl(struct ub_packed_rrset_key* k)
 /** Copy rrset into region from domain-datanode and packet rrset */
 static struct ub_packed_rrset_key*
 auth_packed_rrset_copy_region(struct auth_zone* z, struct auth_data* node,
-	struct auth_rrset* rrset, struct regional* region, time_t adjust)
+	struct auth_rrset* rrset, struct regional* region)
 {
 	struct ub_packed_rrset_key key;
 	memset(&key, 0, sizeof(key));
@@ -182,7 +183,7 @@ auth_packed_rrset_copy_region(struct auth_zone* z, struct auth_data* node,
 	key.rk.type = htons(rrset->type);
 	key.rk.rrset_class = htons(z->dclass);
 	key.entry.hash = rrset_key_hash(&key.rk);
-	return packed_rrset_copy_region(&key, region, adjust);
+	return packed_rrset_copy_region(&key, region, 0);
 }
 
 /** fix up msg->rep TTL and prefetch ttl */
@@ -236,7 +237,7 @@ msg_add_rrset_an(struct auth_zone* z, struct regional* region,
 		return 0;
 	/* copy it */
 	if(!(msg->rep->rrsets[msg->rep->rrset_count] =
-		auth_packed_rrset_copy_region(z, node, rrset, region, 0)))
+		auth_packed_rrset_copy_region(z, node, rrset, region)))
 		return 0;
 	msg->rep->rrset_count++;
 	msg->rep->an_numrrsets++;
@@ -260,7 +261,7 @@ msg_add_rrset_ns(struct auth_zone* z, struct regional* region,
 		return 0;
 	/* copy it */
 	if(!(msg->rep->rrsets[msg->rep->rrset_count] =
-		auth_packed_rrset_copy_region(z, node, rrset, region, 0)))
+		auth_packed_rrset_copy_region(z, node, rrset, region)))
 		return 0;
 	msg->rep->rrset_count++;
 	msg->rep->ns_numrrsets++;
@@ -283,7 +284,7 @@ msg_add_rrset_ar(struct auth_zone* z, struct regional* region,
 		return 0;
 	/* copy it */
 	if(!(msg->rep->rrsets[msg->rep->rrset_count] =
-		auth_packed_rrset_copy_region(z, node, rrset, region, 0)))
+		auth_packed_rrset_copy_region(z, node, rrset, region)))
 		return 0;
 	msg->rep->rrset_count++;
 	msg->rep->ar_numrrsets++;
@@ -2091,7 +2092,8 @@ auth_zones_setup_zones(struct auth_zones* az)
 
 /** set config items and create zones */
 static int
-auth_zones_cfg(struct auth_zones* az, struct config_auth* c)
+auth_zones_cfg(struct auth_zones* az, struct config_auth* c,
+	struct tsig_key_table* tsig_key_table)
 {
 	struct auth_zone* z;
 	struct auth_xfer* x = NULL;
@@ -2110,7 +2112,7 @@ auth_zones_cfg(struct auth_zones* az, struct config_auth* c)
 		}
 		return 0;
 	}
-	if(c->masters || c->urls) {
+	if(c->masters || c->masters_tsig || c->urls) {
 		if(!(x=auth_zones_find_or_add_xfer(az, z))) {
 			lock_rw_unlock(&az->lock);
 			lock_rw_unlock(&z->lock);
@@ -2171,12 +2173,14 @@ auth_zones_cfg(struct auth_zones* az, struct config_auth* c)
 	if(x) {
 		z->zone_is_slave = 1;
 		/* set options on xfer zone */
-		if(!xfer_set_masters(&x->task_probe->masters, c, 0)) {
+		if(!xfer_set_masters(&x->task_probe->masters, c, 0,
+			tsig_key_table)) {
 			lock_basic_unlock(&x->lock);
 			lock_rw_unlock(&z->lock);
 			return 0;
 		}
-		if(!xfer_set_masters(&x->task_transfer->masters, c, 1)) {
+		if(!xfer_set_masters(&x->task_transfer->masters, c, 1,
+			tsig_key_table)) {
 			lock_basic_unlock(&x->lock);
 			lock_rw_unlock(&z->lock);
 			return 0;
@@ -2244,7 +2248,7 @@ az_delete_deleted_zones(struct auth_zones* az)
 
 int auth_zones_apply_cfg(struct auth_zones* az, struct config_file* cfg,
 	int setup, int* is_rpz, struct module_env* env,
-	struct module_stack* mods)
+	struct module_stack* mods, struct tsig_key_table* tsig_key_table)
 {
 	struct config_auth* p;
 	az_setall_deleted(az);
@@ -2254,7 +2258,7 @@ int auth_zones_apply_cfg(struct auth_zones* az, struct config_file* cfg,
 			continue;
 		}
 		*is_rpz = (*is_rpz || p->isrpz);
-		if(!auth_zones_cfg(az, p)) {
+		if(!auth_zones_cfg(az, p, tsig_key_table)) {
 			log_err("cannot config auth zone %s", p->name);
 			return 0;
 		}
@@ -2312,6 +2316,7 @@ auth_free_masters(struct auth_master* list)
 		auth_free_master_addrs(list->list);
 		free(list->host);
 		free(list->file);
+		free(list->tsig_key_name);
 		free(list);
 		list = n;
 	}
@@ -2331,12 +2336,14 @@ auth_xfer_delete(struct auth_xfer* xfr)
 		auth_free_masters(xfr->task_probe->masters);
 		comm_point_delete(xfr->task_probe->cp);
 		comm_timer_delete(xfr->task_probe->timer);
+		tsig_delete(xfr->task_probe->tsig);
 		free(xfr->task_probe);
 	}
 	if(xfr->task_transfer) {
 		auth_free_masters(xfr->task_transfer->masters);
 		comm_point_delete(xfr->task_transfer->cp);
 		comm_timer_delete(xfr->task_transfer->timer);
+		tsig_delete(xfr->task_transfer->tsig);
 		if(xfr->task_transfer->chunks_first) {
 			auth_chunks_delete(xfr->task_transfer);
 		}
@@ -3718,11 +3725,30 @@ addr_in_list(struct auth_addr* list, struct sockaddr_storage* addr,
  * addresses in the addr list) */
 static int
 addr_matches_master(struct auth_master* master, struct sockaddr_storage* addr,
-	socklen_t addrlen, struct auth_master** fromhost)
+	socklen_t addrlen, struct auth_master** fromhost,
+	struct tsig_data* tsig)
 {
 	struct sockaddr_storage a;
 	socklen_t alen = 0;
 	int net = 0;
+	if(master->tsig_key_name && master->tsig_key_name[0]) {
+		uint8_t keyname[LDNS_MAX_DOMAINLEN+1];
+		size_t keynamelen = sizeof(keyname);
+		if(!tsig) {
+			/* This needs a TSIG key, but no TSIG present. */
+			return 0;
+		}
+		if(sldns_str2wire_dname_buf(master->tsig_key_name, keyname,
+			&keynamelen) != 0) {
+			verbose(VERB_ALGO, "could not parse allow-notify-tsig '%s'",
+				master->tsig_key_name);
+			return 0;
+		}
+		if(query_dname_compare(keyname, tsig->key_name) != 0) {
+			/* The TSIG is a different key name, not matched. */
+			return 0;
+		}
+	}
 	if(addr_in_list(master->list, addr, addrlen)) {
 		*fromhost = master;
 		return 1;	
@@ -3755,11 +3781,12 @@ addr_matches_master(struct auth_master* master, struct sockaddr_storage* addr,
 /** check access list for notifies */
 static int
 az_xfr_allowed_notify(struct auth_xfer* xfr, struct sockaddr_storage* addr,
-	socklen_t addrlen, struct auth_master** fromhost)
+	socklen_t addrlen, struct auth_master** fromhost,
+	struct tsig_data* tsig)
 {
 	struct auth_master* p;
 	for(p=xfr->allow_notify_list; p; p=p->next) {
-		if(addr_matches_master(p, addr, addrlen, fromhost)) {
+		if(addr_matches_master(p, addr, addrlen, fromhost, tsig)) {
 			return 1;
 		}
 	}
@@ -3829,7 +3856,8 @@ xfr_process_notify(struct auth_xfer* xfr, struct module_env* env,
 int auth_zones_notify(struct auth_zones* az, struct module_env* env,
 	uint8_t* nm, size_t nmlen, uint16_t dclass,
 	struct sockaddr_storage* addr, socklen_t addrlen, int has_serial,
-	uint32_t serial, int* refused)
+	uint32_t serial, int* refused, struct sldns_buffer* pkt,
+	struct tsig_data** tsig, int* tsig_rcode, struct regional* scratchpad)
 {
 	struct auth_xfer* xfr;
 	struct auth_master* fromhost = NULL;
@@ -3844,9 +3872,20 @@ int auth_zones_notify(struct auth_zones* az, struct module_env* env,
 	}
 	lock_basic_lock(&xfr->lock);
 	lock_rw_unlock(&az->lock);
-	
+
+	/* check tsig */
+	if(tsig_in_packet(pkt)) {
+		*tsig_rcode = tsig_parse_verify_query(env->tsig_key_table,
+			pkt, tsig, scratchpad, (uint64_t)*env->now);
+		if(*tsig_rcode != 0) {
+			/* The tsig failed to verify. */
+			lock_basic_unlock(&xfr->lock);
+			return 0;
+		}
+	}
+
 	/* check access list for notifies */
-	if(!az_xfr_allowed_notify(xfr, addr, addrlen, &fromhost)) {
+	if(!az_xfr_allowed_notify(xfr, addr, addrlen, &fromhost, *tsig)) {
 		lock_basic_unlock(&xfr->lock);
 		/* notify not allowed, refuse the notify */
 		*refused = 1;
@@ -3978,9 +4017,20 @@ auth_master_copy(struct auth_master* o)
 			return NULL;
 		}
 	}
+	if(m->tsig_key_name) {
+		m->tsig_key_name = strdup(m->tsig_key_name);
+		if(!m->tsig_key_name) {
+			free(m->file);
+			free(m->host);
+			free(m);
+			log_err("malloc failure");
+			return NULL;
+		}
+	}
 	if(m->list) {
 		m->list = auth_addr_list_copy(m->list);
 		if(!m->list) {
+			free(m->tsig_key_name);
 			free(m->file);
 			free(m->host);
 			free(m);
@@ -4240,6 +4290,37 @@ xfr_create_soa_probe_packet(struct auth_xfer* xfr, sldns_buffer* buf,
 	sldns_buffer_write_u16_at(buf, 0, id);
 }
 
+/** sign a query for xfr. */
+static int
+xfr_sign_query(struct tsig_data** tsig, sldns_buffer* pkt,
+	struct module_env* env, char* tsig_key_name)
+{
+	size_t pos;
+	if(*tsig) {
+		tsig_delete(*tsig);
+		*tsig = NULL;
+	}
+	*tsig = tsig_create_fromstr(env->tsig_key_table, tsig_key_name);
+	if(!*tsig) {
+		log_err("tsig key '%s' not found or out of memory",
+			tsig_key_name);
+		return 0;
+	}
+
+	/* Position the buffer after the packet contents. */
+	pos = sldns_buffer_limit(pkt);
+	sldns_buffer_clear(pkt);
+	sldns_buffer_set_position(pkt, pos);
+	if(!tsig_sign_query(*tsig, pkt, env->tsig_key_table,
+		(uint64_t)*env->now)) {
+		sldns_buffer_flip(pkt);
+		log_err("tsig key '%s': could not sign query", tsig_key_name);
+		return 0;
+	}
+	sldns_buffer_flip(pkt);
+	return 1;
+}
+
 /** create IXFR/AXFR packet for xfr */
 static void
 xfr_create_ixfr_packet(struct auth_xfer* xfr, sldns_buffer* buf, uint16_t id,
@@ -4298,7 +4379,7 @@ xfr_create_ixfr_packet(struct auth_xfer* xfr, sldns_buffer* buf, uint16_t id,
 /** check if returned packet is OK */
 static int
 check_packet_ok(sldns_buffer* pkt, uint16_t qtype, struct auth_xfer* xfr,
-	uint32_t* serial)
+	uint32_t* serial, struct module_env* env)
 {
 	/* parse to see if packet worked, valid reply */
 
@@ -4372,6 +4453,20 @@ check_packet_ok(sldns_buffer* pkt, uint16_t qtype, struct auth_xfer* xfr,
 			return 0;
 		*serial = sldns_buffer_read_u32(pkt);
 	}
+
+	if(xfr->task_probe->tsig) {
+		/* There could be authority or additional RRs in the reply for the
+		 * SOA query, if so skip them by tsig_find_rr. */
+		if(!tsig_find_rr(pkt)) {
+			verbose(VERB_ALGO, "TSIG expected, but not found in reply");
+			return 0;
+		}
+		if(!tsig_parse_verify_reply(xfr->task_probe->tsig, pkt,
+			env->tsig_key_table, (uint64_t)*env->now)) {
+			verbose(VERB_ALGO, "valid TSIG expected in SOA probe reply, but it was not valid");
+			return 0;
+		}
+	}
 	return 1;
 }
 
@@ -4556,6 +4651,23 @@ http_parse_ttl(sldns_buffer* buf, struct sldns_file_parse_state* pstate)
 	return 0;
 }
 
+/** remove newlines from collated line */
+static void
+chunkline_newline_removal(sldns_buffer* buf)
+{
+	size_t i, end=sldns_buffer_limit(buf);
+	for(i=0; i<end; i++) {
+		char c = (char)sldns_buffer_read_u8_at(buf, i);
+		if(c == '\n' && i==end-1) {
+			sldns_buffer_write_u8_at(buf, i, 0);
+			sldns_buffer_set_limit(buf, end-1);
+			return;
+		}
+		if(c == '\n')
+			sldns_buffer_write_u8_at(buf, i, (uint8_t)' ');
+	}
+}
+
 /** find noncomment RR line in chunks, collates lines if ( ) format */
 static int
 chunkline_non_comment_RR(struct auth_chunk** chunk, size_t* chunk_pos,
@@ -4563,6 +4675,7 @@ chunkline_non_comment_RR(struct auth_chunk** chunk, size_t* chunk_pos,
 {
 	int ret;
 	while(chunkline_get_line_collated(chunk, chunk_pos, buf)) {
+		chunkline_newline_removal(buf);
 		if(chunkline_is_comment_line_or_empty(buf)) {
 			/* a comment, go to next line */
 			continue;
@@ -4638,23 +4751,6 @@ chunklist_sum(struct auth_chunk* list)
 	return s;
 }
 
-/** remove newlines from collated line */
-static void
-chunkline_newline_removal(sldns_buffer* buf)
-{
-	size_t i, end=sldns_buffer_limit(buf);
-	for(i=0; i<end; i++) {
-		char c = (char)sldns_buffer_read_u8_at(buf, i);
-		if(c == '\n' && i==end-1) {
-			sldns_buffer_write_u8_at(buf, i, 0);
-			sldns_buffer_set_limit(buf, end-1);
-			return;
-		}
-		if(c == '\n')
-			sldns_buffer_write_u8_at(buf, i, (uint8_t)' ');
-	}
-}
-
 /** for http download, parse and add RR to zone */
 static int
 http_parse_add_rr(struct auth_xfer* xfr, struct auth_zone* z,
@@ -5024,6 +5120,7 @@ apply_axfr(struct auth_xfer* xfr, struct auth_zone* z,
 
 	xfr->have_zone = 0;
 	xfr->serial = 0;
+	xfr->soa_zone_acquired = 0;
 
 	/* insert all RRs in to the zone */
 	/* insert the SOA only once, skip the last one */
@@ -5125,6 +5222,7 @@ apply_http(struct auth_xfer* xfr, struct auth_zone* z,
 
 	xfr->have_zone = 0;
 	xfr->serial = 0;
+	xfr->soa_zone_acquired = 0;
 
 	chunk = xfr->task_transfer->chunks_first;
 	chunk_pos = 0;
@@ -5335,6 +5433,8 @@ xfr_process_chunk_list(struct auth_xfer* xfr, struct module_env* env,
 			" (or malformed RR)", xfr->task_transfer->master->host);
 		return 0;
 	}
+	z->soa_zone_acquired = *env->now;
+	xfr->soa_zone_acquired = *env->now;
 
 	/* release xfr lock while verifying zonemd because it may have
 	 * to spawn lookups in the state machines */
@@ -5374,10 +5474,18 @@ xfr_process_chunk_list(struct auth_xfer* xfr, struct module_env* env,
 	lock_rw_unlock(&z->lock);
 
 	if(verbosity >= VERB_QUERY && xfr->have_zone) {
-		char zname[LDNS_MAX_DOMAINLEN];
+		char zname[LDNS_MAX_DOMAINLEN], tsigtxt[16],
+			tsigkey[LDNS_MAX_DOMAINLEN];
+		tsigkey[0]=0;
+		tsigtxt[0]=0;
+		if(xfr->task_transfer->tsig &&
+			xfr->task_transfer->tsig->key_name) {
+			snprintf(tsigtxt, sizeof(tsigtxt), " with TSIG ");
+			dname_str(xfr->task_transfer->tsig->key_name, tsigkey);
+		}
 		dname_str(xfr->name, zname);
-		verbose(VERB_QUERY, "auth zone %s updated to serial %u", zname,
-			(unsigned)xfr->serial);
+		verbose(VERB_QUERY, "auth zone %s updated%s%s to serial %u",
+			zname, tsigtxt, tsigkey, (unsigned)xfr->serial);
 	}
 	/* see if we need to write to a zonefile */
 	xfr_write_after_update(xfr, env);
@@ -5394,6 +5502,9 @@ xfr_transfer_disown(struct auth_xfer* xfr)
 	/* remove the commpoint */
 	comm_point_delete(xfr->task_transfer->cp);
 	xfr->task_transfer->cp = NULL;
+	/* remove the tsig data */
+	tsig_delete(xfr->task_transfer->tsig);
+	xfr->task_transfer->tsig = NULL;
 	/* we don't own this item anymore */
 	xfr->task_transfer->worker = NULL;
 	xfr->task_transfer->env = NULL;
@@ -5482,6 +5593,10 @@ xfr_transfer_init_fetch(struct auth_xfer* xfr, struct module_env* env)
 	int timeout;
 	if(!master) return 0;
 	if(master->allow_notify) return 0; /* only for notify */
+	if(xfr->task_transfer->tsig) {
+		tsig_delete(xfr->task_transfer->tsig);
+		xfr->task_transfer->tsig = NULL;
+	}
 
 	/* get master addr */
 	if(xfr->task_transfer->scan_addr) {
@@ -5556,6 +5671,17 @@ xfr_transfer_init_fetch(struct auth_xfer* xfr, struct module_env* env)
 	xfr->task_transfer->id = GET_RANDOM_ID(env->rnd);
 	xfr_create_ixfr_packet(xfr, env->scratch_buffer,
 		xfr->task_transfer->id, master);
+	if(master->tsig_key_name) {
+		if(!xfr_sign_query(&xfr->task_transfer->tsig,
+			env->scratch_buffer, env, master->tsig_key_name)) {
+			char zname[LDNS_MAX_DOMAINLEN], as[256];
+			dname_str(xfr->name, zname);
+			addr_port_to_str(&addr, addrlen, as, sizeof(as));
+			verbose(VERB_ALGO, "failed to TSIG sign xfr "
+				"for %s to %s", zname, as);
+			return 0;
+		}
+	}
 
 	/* connect on fd */
 	xfr->task_transfer->cp = outnet_comm_point_for_tcp(env->outnet,
@@ -5572,11 +5698,20 @@ xfr_transfer_init_fetch(struct auth_xfer* xfr, struct module_env* env)
 	}
 	comm_timer_set(xfr->task_transfer->timer, &t);
 	if(verbosity >= VERB_ALGO) {
-		char zname[LDNS_MAX_DOMAINLEN], as[256];
+		char zname[LDNS_MAX_DOMAINLEN], as[256], tsigtxt[16],
+			tsigkey[LDNS_MAX_DOMAINLEN];
+		tsigkey[0]=0;
+		tsigtxt[0]=0;
+		if(xfr->task_transfer->tsig &&
+			xfr->task_transfer->tsig->key_name) {
+			snprintf(tsigtxt, sizeof(tsigtxt), " with TSIG ");
+			dname_str(xfr->task_transfer->tsig->key_name, tsigkey);
+		}
  		dname_str(xfr->name, zname);
 		addr_port_to_str(&addr, addrlen, as, sizeof(as));
-		verbose(VERB_ALGO, "auth zone %s transfer next %s fetch from %s started", zname, 
-			(xfr->task_transfer->on_ixfr?"IXFR":"AXFR"), as);
+		verbose(VERB_ALGO, "auth zone %s transfer next %s fetch%s%s from %s started",
+			zname, (xfr->task_transfer->on_ixfr?"IXFR":"AXFR"),
+			tsigtxt, tsigkey, as);
 	}
 	return 1;
 }
@@ -5761,9 +5896,10 @@ void auth_xfer_transfer_lookup_callback(void* arg, int rcode, sldns_buffer* buf,
  */
 static int
 check_xfer_packet(sldns_buffer* pkt, struct auth_xfer* xfr,
-	int* gonextonfail, int* transferdone)
+	struct module_env* env, int* gonextonfail, int* transferdone)
 {
 	uint8_t* wire = sldns_buffer_begin(pkt);
+	size_t initial_rr_scan_num = xfr->task_transfer->rr_scan_num;
 	int i;
 	if(sldns_buffer_limit(pkt) < LDNS_HEADER_SIZE) {
 		verbose(VERB_ALGO, "xfr to %s failed, packet too small",
@@ -6047,6 +6183,28 @@ check_xfer_packet(sldns_buffer* pkt, struct auth_xfer* xfr,
 		sldns_buffer_skip(pkt, (ssize_t)rdlen);
 	}
 
+	/* check tsig */
+	if(xfr->task_transfer->tsig) {
+		sldns_buffer_rewind(pkt);
+		if(!tsig_find_rr(pkt)) {
+			/* Check TSIG reply on first packet. */
+			if(initial_rr_scan_num == 0) {
+				verbose(VERB_ALGO, "TSIG expected, but not found in reply for xfr to %s",
+					xfr->task_transfer->master->host);
+				return 0;
+			}
+			/* No TSIG could be for sign every NTH packet. */
+			sldns_buffer_set_position(pkt, sldns_buffer_limit(pkt));
+		}
+		if(!tsig_parse_verify_reply_xfr(xfr->task_transfer->tsig,
+			pkt, env->tsig_key_table, (uint64_t)*env->now,
+			*transferdone)) {
+			verbose(VERB_ALGO, "valid TSIG expected in xfr reply to %s, but it was not valid",
+				xfr->task_transfer->master->host);
+			return 0;
+		}
+	}
+
 	return 1;
 }
 
@@ -6223,7 +6381,8 @@ auth_xfer_transfer_tcp_callback(struct comm_point* c, void* arg, int err,
 	/* handle returned packet */
 	/* if it fails, cleanup and end this transfer */
 	/* if it needs to fallback from IXFR to AXFR, do that */
-	if(!check_xfer_packet(c->buffer, xfr, &gonextonfail, &transferdone)) {
+	if(!check_xfer_packet(c->buffer, xfr, env, &gonextonfail,
+		&transferdone)) {
 		goto failed;
 	}
 	/* if it is good, link it into the list of data */
@@ -6349,6 +6508,9 @@ xfr_probe_disown(struct auth_xfer* xfr)
 	/* remove the commpoint */
 	comm_point_delete(xfr->task_probe->cp);
 	xfr->task_probe->cp = NULL;
+	/* remove the tsig data */
+	tsig_delete(xfr->task_probe->tsig);
+	xfr->task_probe->tsig = NULL;
 	/* we don't own this item anymore */
 	xfr->task_probe->worker = NULL;
 	xfr->task_probe->env = NULL;
@@ -6369,6 +6531,10 @@ xfr_probe_send_probe(struct auth_xfer* xfr, struct module_env* env,
 	if(master->allow_notify) return 0; /* only for notify */
 	if(master->http) return 0; /* only masters get SOA UDP probe,
 		not urls, if those are in this list */
+	if(xfr->task_probe->tsig) {
+		tsig_delete(xfr->task_probe->tsig);
+		xfr->task_probe->tsig = NULL;
+	}
 
 	/* get master addr */
 	if(xfr->task_probe->scan_addr) {
@@ -6406,6 +6572,17 @@ xfr_probe_send_probe(struct auth_xfer* xfr, struct module_env* env,
 		xfr->task_probe->id = GET_RANDOM_ID(env->rnd);
 	xfr_create_soa_probe_packet(xfr, env->scratch_buffer, 
 		xfr->task_probe->id);
+	if(master->tsig_key_name) {
+		if(!xfr_sign_query(&xfr->task_probe->tsig, env->scratch_buffer,
+			env, master->tsig_key_name)) {
+			char zname[LDNS_MAX_DOMAINLEN], as[256];
+			dname_str(xfr->name, zname);
+			addr_port_to_str(&addr, addrlen, as, sizeof(as));
+			verbose(VERB_ALGO, "failed to TSIG sign soa probe "
+				"for %s to %s", zname, as);
+			return 0;
+		}
+	}
 	/* we need to remove the cp if we have a different ip4/ip6 type now */
 	if(xfr->task_probe->cp &&
 		((xfr->task_probe->cp_is_ip6 && !addr_is_ip6(&addr, addrlen)) ||
@@ -6449,11 +6626,19 @@ xfr_probe_send_probe(struct auth_xfer* xfr, struct module_env* env,
 		return 0;
 	}
 	if(verbosity >= VERB_ALGO) {
-		char zname[LDNS_MAX_DOMAINLEN], as[256];
+		char zname[LDNS_MAX_DOMAINLEN], as[256], tsigtxt[16],
+			tsigkey[LDNS_MAX_DOMAINLEN];
+		tsigkey[0]=0;
+		tsigtxt[0]=0;
+		if(xfr->task_probe->tsig &&
+			xfr->task_probe->tsig->key_name) {
+			snprintf(tsigtxt, sizeof(tsigtxt), " with TSIG ");
+			dname_str(xfr->task_probe->tsig->key_name, tsigkey);
+		}
 		dname_str(xfr->name, zname);
 		addr_port_to_str(&addr, addrlen, as, sizeof(as));
-		verbose(VERB_ALGO, "auth zone %s soa probe sent to %s", zname,
-			as);
+		verbose(VERB_ALGO, "auth zone %s soa probe%s%s sent to %s",
+			zname, tsigtxt, tsigkey, as);
 	}
 	xfr->task_probe->timeout = timeout;
 #ifndef S_SPLINT_S
@@ -6525,13 +6710,24 @@ auth_xfer_probe_udp_callback(struct comm_point* c, void* arg, int err,
 	if(err == NETEVENT_NOERROR) {
 		uint32_t serial = 0;
 		if(check_packet_ok(c->buffer, LDNS_RR_TYPE_SOA, xfr,
-			&serial)) {
+			&serial, env)) {
 			/* successful lookup */
 			if(verbosity >= VERB_ALGO) {
-				char buf[LDNS_MAX_DOMAINLEN];
+				char buf[LDNS_MAX_DOMAINLEN], tsigtxt[16],
+					tsigkey[LDNS_MAX_DOMAINLEN];
+				tsigkey[0]=0;
+				tsigtxt[0]=0;
+				if(xfr->task_probe->tsig &&
+					xfr->task_probe->tsig->key_name) {
+					snprintf(tsigtxt, sizeof(tsigtxt),
+						" with TSIG ");
+					dname_str(xfr->task_probe->tsig->
+						key_name, tsigkey);
+				}
 				dname_str(xfr->name, buf);
-				verbose(VERB_ALGO, "auth zone %s: soa probe "
-					"serial is %u", buf, (unsigned)serial);
+				verbose(VERB_ALGO, "auth zone %s: soa probe"
+					"%s%s serial is %u", buf, tsigtxt,
+					tsigkey, (unsigned)serial);
 			}
 			/* see if this serial indicates that the zone has
 			 * to be updated */
@@ -6584,6 +6780,9 @@ auth_xfer_probe_udp_callback(struct comm_point* c, void* arg, int err,
 	/* delete commpoint so a new one is created, with a fresh port nr */
 	comm_point_delete(xfr->task_probe->cp);
 	xfr->task_probe->cp = NULL;
+	/* remove the tsig data */
+	tsig_delete(xfr->task_probe->tsig);
+	xfr->task_probe->tsig = NULL;
 
 	/* if the result was not a successful probe, we need
 	 * to send the next one */
@@ -7004,13 +7203,23 @@ xfr_set_timeout(struct auth_xfer* xfr, struct module_env* env,
 	comm_timer_set(xfr->task_nextprobe->timer, &tv);
 }
 
+void auth_zone_pickup_initial_zone(struct auth_zone* z, struct module_env* env)
+{
+	/* Set the time, because we now have timestamp in env,
+	 * (not earlier during startup and apply_cfg), and this
+	 * notes the start time when the data was acquired. */
+	z->soa_zone_acquired = *env->now;
+}
+
 void auth_xfer_pickup_initial_zone(struct auth_xfer* x, struct module_env* env)
 {
 	/* set lease_time, because we now have timestamp in env,
 	 * (not earlier during startup and apply_cfg), and this
 	 * notes the start time when the data was acquired */
-	if(x->have_zone)
+	if(x->have_zone) {
 		x->lease_time = *env->now;
+		x->soa_zone_acquired = *env->now;
+	}
 	if(x->task_nextprobe && x->task_nextprobe->worker == NULL) {
 		xfr_set_timeout(x, env, 0, 1);
 	}
@@ -7021,7 +7230,13 @@ void
 auth_xfer_pickup_initial(struct auth_zones* az, struct module_env* env)
 {
 	struct auth_xfer* x;
+	struct auth_zone* z;
 	lock_rw_wrlock(&az->lock);
+	RBTREE_FOR(z, struct auth_zone*, &az->ztree) {
+		lock_rw_wrlock(&z->lock);
+		auth_zone_pickup_initial_zone(z, env);
+		lock_rw_unlock(&z->lock);
+	}
 	RBTREE_FOR(x, struct auth_xfer*, &az->xtree) {
 		lock_basic_lock(&x->lock);
 		auth_xfer_pickup_initial_zone(x, env);
@@ -7106,6 +7321,7 @@ auth_xfer_new(struct auth_zone* z)
 	lock_protect(&xfr->lock, &xfr->notify_serial, sizeof(xfr->notify_serial));
 	lock_protect(&xfr->lock, &xfr->zone_expired, sizeof(xfr->zone_expired));
 	lock_protect(&xfr->lock, &xfr->have_zone, sizeof(xfr->have_zone));
+	lock_protect(&xfr->lock, &xfr->soa_zone_acquired, sizeof(xfr->soa_zone_acquired));
 	lock_protect(&xfr->lock, &xfr->serial, sizeof(xfr->serial));
 	lock_protect(&xfr->lock, &xfr->retry, sizeof(xfr->retry));
 	lock_protect(&xfr->lock, &xfr->refresh, sizeof(xfr->refresh));
@@ -7272,12 +7488,34 @@ parse_url(char* url, char** host, char** file, int* port, int* ssl)
 	return 1;
 }
 
+/** Check the tsig key exists */
+static int
+check_tsig_key_exists(struct tsig_key_table* tsig_key_table,
+	const char* optname, char* str, char* str2)
+{
+	struct tsig_key* key;
+	if(!tsig_key_table)
+		return 1;
+
+	lock_rw_rdlock(&tsig_key_table->lock);
+	key = tsig_key_table_search_fromstr(tsig_key_table, str2);
+	lock_rw_unlock(&tsig_key_table->lock);
+
+	if(!key) {
+		log_err("could not find tsig-key for %s: %s %s",
+			optname, str, str2);
+		return 0;
+	}
+	return 1;
+}
+
 int
 xfer_set_masters(struct auth_master** list, struct config_auth* c,
-	int with_http)
+	int with_http, struct tsig_key_table* tsig_key_table)
 {
 	struct auth_master* m;
 	struct config_strlist* p;
+	struct config_str2list* p2;
 	/* list points to the first, or next pointer for the new element */
 	while(*list) {
 		list = &( (*list)->next );
@@ -7300,6 +7538,24 @@ xfer_set_masters(struct auth_master** list, struct config_auth* c,
 			return 0;
 		}
 	}
+	for(p2 = c->masters_tsig; p2; p2 = p2->next) {
+		m = auth_master_new(&list);
+		if(!m) return 0;
+		m->ixfr = 1; /* this flag is not configurable */
+		m->host = strdup(p2->str);
+		if(!m->host) {
+			log_err("malloc failure");
+			return 0;
+		}
+		if(!check_tsig_key_exists(tsig_key_table, "primary-tsig",
+			p2->str, p2->str2))
+			return 0;
+		m->tsig_key_name = strdup(p2->str2);
+		if(!m->tsig_key_name) {
+			log_err("malloc failure");
+			return 0;
+		}
+	}
 	for(p = c->allow_notify; p; p = p->next) {
 		m = auth_master_new(&list);
 		if(!m) return 0;
@@ -7310,6 +7566,24 @@ xfer_set_masters(struct auth_master** list, struct config_auth* c,
 			return 0;
 		}
 	}
+	for(p2 = c->allow_notify_tsig; p2; p2 = p2->next) {
+		m = auth_master_new(&list);
+		if(!m) return 0;
+		m->allow_notify = 1;
+		m->host = strdup(p2->str);
+		if(!m->host) {
+			log_err("malloc failure");
+			return 0;
+		}
+		if(!check_tsig_key_exists(tsig_key_table, "allow-notify-tsig",
+			p2->str, p2->str2))
+			return 0;
+		m->tsig_key_name = strdup(p2->str2);
+		if(!m->tsig_key_name) {
+			log_err("malloc failure");
+			return 0;
+		}
+	}
 	return 1;
 }
 
@@ -8645,6 +8919,8 @@ auth_primaries_get_mem(struct auth_master* list)
 			m += strlen(n->host)+1;
 		if(n->file)
 			m += strlen(n->file)+1;
+		if(n->tsig_key_name)
+			m += strlen(n->tsig_key_name)+1;
 	}
 	return m;
 }
@@ -8674,12 +8950,14 @@ auth_xfer_get_mem(struct auth_xfer* xfr)
 	m += auth_primaries_get_mem(xfr->task_probe->masters);
 	m += comm_point_get_mem(xfr->task_probe->cp);
 	m += comm_timer_get_mem(xfr->task_probe->timer);
+	m += tsig_get_mem(xfr->task_probe->tsig);
 
 	/* auth_transfer */
 	m += auth_chunks_get_mem(xfr->task_transfer->chunks_first);
 	m += auth_primaries_get_mem(xfr->task_transfer->masters);
 	m += comm_point_get_mem(xfr->task_transfer->cp);
 	m += comm_timer_get_mem(xfr->task_transfer->timer);
+	m += tsig_get_mem(xfr->task_transfer->tsig);
 
 	/* allow_notify_list */
 	m += auth_primaries_get_mem(xfr->allow_notify_list);
diff --git a/services/authzone.h b/services/authzone.h
index b11e7f144..5e41b1f6c 100644
--- a/services/authzone.h
+++ b/services/authzone.h
@@ -55,6 +55,8 @@ struct query_info;
 struct dns_msg;
 struct edns_data;
 struct module_env;
+struct tsig_data;
+struct tsig_key_table;
 struct worker;
 struct comm_point;
 struct comm_timer;
@@ -118,6 +120,8 @@ struct auth_zone {
 	char* zonefile;
 	/** fallback to the internet on failure or ttl-expiry of auth zone */
 	int fallback_enabled;
+	/** the time when zone was transferred from upstream */
+	time_t soa_zone_acquired;
 	/** the zone has expired (enabled by the xfer worker), fallback
 	 * happens if that option is enabled. */
 	int zone_expired;
@@ -261,6 +265,8 @@ struct auth_xfer {
 	int zone_expired;
 	/** do we have a zone (if 0, no zone data at all) */
 	int have_zone;
+	/** the time when zone was transferred from upstream */
+	time_t soa_zone_acquired;
 
 	/** current serial (from SOA), if we have no zone, 0 */
 	uint32_t serial;
@@ -357,6 +363,8 @@ struct auth_probe {
 	struct comm_timer* timer;
 	/** timeout in msec */
 	int timeout;
+	/** the tsig data for the packet */
+	struct tsig_data* tsig;
 };
 
 /**
@@ -426,6 +434,8 @@ struct auth_transfer {
 	/** timeout for the transfer.
 	 * on the workers event base. */
 	struct comm_timer* timer;
+	/** the tsig data for the transfer */
+	struct tsig_data* tsig;
 };
 
 /** list of addresses */
@@ -457,6 +467,8 @@ struct auth_master {
 	int ssl;
 	/** the port number (for urls) */
 	int port;
+	/** the tsig key name (if any, or NULL) */
+	char* tsig_key_name;
 	/** if the host is a hostname, the list of resolved addrs, if any*/
 	struct auth_addr* list;
 };
@@ -486,11 +498,13 @@ struct auth_zones* auth_zones_create(void);
  * @param is_rpz: set to 1 if at least one RPZ zone is configured.
  * @param env: environment for offline verification.
  * @param mods: modules in environment.
+ * @param tsig_key_table: tsig key table to check if tsig keys exist.
+ *	If NULL, no check is performed.
  * @return false on failure.
  */
 int auth_zones_apply_cfg(struct auth_zones* az, struct config_file* cfg,
 	int setup, int* is_rpz, struct module_env* env,
-	struct module_stack* mods);
+	struct module_stack* mods, struct tsig_key_table* tsig_key_table);
 
 /** initial pick up of worker timeouts, ties events to worker event loop
  * @param az: auth zones structure
@@ -615,13 +629,19 @@ int auth_zones_can_fallback(struct auth_zones* az, uint8_t* nm, size_t nmlen,
  * @param has_serial: if true, the notify has a serial attached.
  * @param serial: the serial number, if has_serial is true.
  * @param refused: is set to true on failure to note refused access.
+ * @param pkt: the packet for TSIG verify.
+ * @param tsig: if TSIG, the structure is returned here, allocated in
+ *	the worker scratch region.
+ * @param tsig_rcode: if not NOERROR it is the TSIG error code, TSIG failed.
+ * @param scratchpad: region to allocate tsig in.
  * @return fail on failures (refused is false) and when access is
  * 	denied (refused is true).  True when processed.
  */
 int auth_zones_notify(struct auth_zones* az, struct module_env* env,
 	uint8_t* nm, size_t nmlen, uint16_t dclass,
 	struct sockaddr_storage* addr, socklen_t addrlen, int has_serial,
-	uint32_t serial, int* refused);
+	uint32_t serial, int* refused, struct sldns_buffer* pkt,
+	struct tsig_data** tsig, int* tsig_rcode, struct regional* scratchpad);
 
 /** process notify packet and read serial number from SOA.
  * returns 0 if no soa record in the notify */
@@ -667,10 +687,12 @@ struct auth_xfer* auth_xfer_create(struct auth_zones* az, struct auth_zone* z);
  * @param list: pointer to start of list.  The malloced list is returned here.
  * @param c: the config items to copy over.
  * @param with_http: if true, http urls are also included, before the masters.
+ * @param tsig_key_table: if nonNULL, used to check that tsig keys exist in
+ *	the key table.
  * @return false on failure.
  */
 int xfer_set_masters(struct auth_master** list, struct config_auth* c,
-	int with_http);
+	int with_http, struct tsig_key_table* tsig_key_table);
 
 /** xfer nextprobe timeout callback, this is part of task_nextprobe */
 void auth_xfer_timer(void* arg);
@@ -800,6 +822,14 @@ size_t auth_zones_get_mem(struct auth_zones* zones);
 void auth_xfer_pickup_initial_zone(struct auth_xfer* x,
 	struct module_env* env);
 
+/**
+ * Initial pick up of the auth zone, it sets the acquired time.
+ * @param z: the zone, write locked by caller.
+ * @param env: environment of the worker, with current time.
+ */
+void auth_zone_pickup_initial_zone(struct auth_zone* z,
+	struct module_env* env);
+
 /**
  * Delete auth xfer structure
  * @param xfr: delete this xfer and its tasks.
diff --git a/services/cache/dns.c b/services/cache/dns.c
index 351b3568c..325faa0b2 100644
--- a/services/cache/dns.c
+++ b/services/cache/dns.c
@@ -60,10 +60,10 @@
  * @param rep: contains list of rrsets to store.
  * @param now: current time.
  * @param leeway: during prefetch how much leeway to update TTLs.
- * 	This makes rrsets (other than type NS) timeout sooner so they get
- * 	updated with a new full TTL.
- * 	Type NS does not get this, because it must not be refreshed from the
- * 	child domain, but keep counting down properly.
+ * 	This makes rrsets expire sooner so they get updated with a new full
+ * 	TTL.
+ * 	Child side type NS does get this but TTL checks are done using the time
+ * 	the query was created rather than the time the answer was received.
  * @param pside: if from parentside discovered NS, so that its NS is okay
  * 	in a prefetch situation to be updated (without becoming sticky).
  * @param qrep: update rrsets here if cache is better
@@ -100,11 +100,20 @@ store_rrsets(struct module_env* env, struct reply_info* rep, time_t now,
 					rep->ref[i].id != rep->ref[i].key->id)
 					ck = NULL;
 				else 	ck = packed_rrset_copy_region(
-					rep->ref[i].key, region, now);
+					rep->ref[i].key, region,
+					((ntohs(rep->ref[i].key->rk.type)==
+					LDNS_RR_TYPE_NS && !pside)?qstarttime:now));
 				lock_rw_unlock(&rep->ref[i].key->entry.lock);
 				if(ck) {
 					/* use cached copy if memory allows */
 					qrep->rrsets[i] = ck;
+					ttl = ((struct packed_rrset_data*)
+					    ck->entry.data)->ttl;
+					if(ttl < qrep->ttl) {
+						qrep->ttl = ttl;
+						qrep->prefetch_ttl = PREFETCH_TTL_CALC(qrep->ttl);
+						qrep->serve_expired_ttl = qrep->ttl + SERVE_EXPIRED_TTL;
+					}
 				}
 			}
 			/* no break: also copy key item */
@@ -169,10 +178,12 @@ dns_cache_store_msg(struct module_env* env, struct query_info* qinfo,
 
 	/* there was a reply_info_sortref(rep) here but it seems to be
 	 * unnecessary, because the cache gets locked per rrset. */
-	reply_info_set_ttls(rep, *env->now);
+	if((flags & DNSCACHE_STORE_EXPIRED_MSG_CACHEDB)) {
+		reply_info_absolute_ttls(rep, *env->now, *env->now - ttl);
+	} else	reply_info_set_ttls(rep, *env->now);
 	store_rrsets(env, rep, *env->now, leeway, pside, qrep, region,
 		qstarttime);
-	if(ttl == 0 && !(flags & DNSCACHE_STORE_ZEROTTL)) {
+	if(ttl == 0) {
 		/* we do not store the message, but we did store the RRs,
 		 * which could be useful for delegation information */
 		verbose(VERB_ALGO, "TTL 0: dropped msg from cache");
@@ -272,8 +283,10 @@ addr_to_additional(struct ub_packed_rrset_key* rrset, struct regional* region,
 {
 	if((msg->rep->rrsets[msg->rep->rrset_count] = 
 		packed_rrset_copy_region(rrset, region, now))) {
+		struct packed_rrset_data* d = rrset->entry.data;
 		msg->rep->ar_numrrsets++;
 		msg->rep->rrset_count++;
+		UPDATE_TTL_FROM_RRSET(msg->rep->ttl, d->ttl);
 	}
 }
 
@@ -456,8 +469,10 @@ find_add_ds(struct module_env* env, struct regional* region,
 		/* add it to auth section. This is the second rrset. */
 		if((msg->rep->rrsets[msg->rep->rrset_count] = 
 			packed_rrset_copy_region(rrset, region, now))) {
+			struct packed_rrset_data* d = rrset->entry.data;
 			msg->rep->ns_numrrsets++;
 			msg->rep->rrset_count++;
+			UPDATE_TTL_FROM_RRSET(msg->rep->ttl, d->ttl);
 		}
 		lock_rw_unlock(&rrset->entry.lock);
 	}
@@ -487,6 +502,8 @@ dns_msg_create(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 		return NULL; /* integer overflow protection */
 	msg->rep->flags = BIT_QR; /* with QR, no AA */
 	msg->rep->qdcount = 1;
+	msg->rep->ttl = MAX_TTL; /* will be updated (brought down) while we add
+				  * rrsets to the message */
 	msg->rep->reason_bogus = LDNS_EDE_NONE;
 	msg->rep->rrsets = (struct ub_packed_rrset_key**)
 		regional_alloc(region, 
@@ -497,24 +514,28 @@ dns_msg_create(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 }
 
 int
-dns_msg_authadd(struct dns_msg* msg, struct regional* region, 
+dns_msg_authadd(struct dns_msg* msg, struct regional* region,
 	struct ub_packed_rrset_key* rrset, time_t now)
 {
-	if(!(msg->rep->rrsets[msg->rep->rrset_count++] = 
+	struct packed_rrset_data* d = rrset->entry.data;
+	if(!(msg->rep->rrsets[msg->rep->rrset_count++] =
 		packed_rrset_copy_region(rrset, region, now)))
 		return 0;
 	msg->rep->ns_numrrsets++;
+	UPDATE_TTL_FROM_RRSET(msg->rep->ttl, d->ttl);
 	return 1;
 }
 
 int
-dns_msg_ansadd(struct dns_msg* msg, struct regional* region, 
+dns_msg_ansadd(struct dns_msg* msg, struct regional* region,
 	struct ub_packed_rrset_key* rrset, time_t now)
 {
-	if(!(msg->rep->rrsets[msg->rep->rrset_count++] = 
+	struct packed_rrset_data* d = rrset->entry.data;
+	if(!(msg->rep->rrsets[msg->rep->rrset_count++] =
 		packed_rrset_copy_region(rrset, region, now)))
 		return 0;
 	msg->rep->an_numrrsets++;
+	UPDATE_TTL_FROM_RRSET(msg->rep->ttl, d->ttl);
 	return 1;
 }
 
@@ -585,6 +606,7 @@ gen_dns_msg(struct regional* region, struct query_info* q, size_t num)
 		sizeof(struct reply_info) - sizeof(struct rrset_ref));
 	if(!msg->rep)
 		return NULL;
+	msg->rep->ttl = MAX_TTL;
 	msg->rep->reason_bogus = LDNS_EDE_NONE;
 	msg->rep->reason_bogus_str = NULL;
 	if(num > RR_COUNT_MAX)
@@ -606,13 +628,13 @@ tomsg(struct module_env* env, struct query_info* q, struct reply_info* r,
 	size_t i;
 	int is_expired = 0;
 	time_t now_control = now;
-	if(now > r->ttl) {
+	if(TTL_IS_EXPIRED(r->ttl, now)) {
 		/* Check if we are allowed to serve expired */
 		if(!allow_expired || !reply_info_can_answer_expired(r, now))
 			return NULL;
-		/* Change the current time so we can pass the below TTL checks when
-		 * serving expired data. */
-		now_control = r->ttl - env->cfg->serve_expired_reply_ttl;
+		/* Change the current time so we can pass the below TTL checks
+		 * when serving expired data. */
+		now_control = 0;
 		is_expired = 1;
 	}
 
@@ -620,15 +642,6 @@ tomsg(struct module_env* env, struct query_info* q, struct reply_info* r,
 	if(!msg) return NULL;
 	msg->rep->flags = r->flags;
 	msg->rep->qdcount = r->qdcount;
-	msg->rep->ttl = is_expired
-		?SERVE_EXPIRED_REPLY_TTL
-		:r->ttl - now;
-	if(r->prefetch_ttl > now)
-		msg->rep->prefetch_ttl = r->prefetch_ttl - now;
-	else
-		msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
-	msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL;
-	msg->rep->serve_expired_norec_ttl = 0;
 	msg->rep->security = r->security;
 	msg->rep->an_numrrsets = r->an_numrrsets;
 	msg->rep->ns_numrrsets = r->ns_numrrsets;
@@ -656,13 +669,30 @@ tomsg(struct module_env* env, struct query_info* q, struct reply_info* r,
 		return NULL;
 	}
 	for(i=0; i<msg->rep->rrset_count; i++) {
+		struct packed_rrset_data* d;
 		msg->rep->rrsets[i] = packed_rrset_copy_region(r->rrsets[i],
 			region, now);
 		if(!msg->rep->rrsets[i]) {
 			rrset_array_unlock(r->ref, r->rrset_count);
 			return NULL;
 		}
+		d = msg->rep->rrsets[i]->entry.data;
+		UPDATE_TTL_FROM_RRSET(msg->rep->ttl, d->ttl);
 	}
+	if(msg->rep->rrset_count < 1) {
+		msg->rep->ttl = is_expired
+			?SERVE_EXPIRED_REPLY_TTL
+			:r->ttl - now;
+		if(r->prefetch_ttl > now)
+			msg->rep->prefetch_ttl = r->prefetch_ttl - now;
+		else
+			msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
+	} else {
+		/* msg->rep->ttl has been updated through the RRSets above */
+		msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
+	}
+	msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL;
+	msg->rep->serve_expired_norec_ttl = 0;
 	if(env)
 		rrset_array_unlock_touch(env->rrset_cache, scratch, r->ref, 
 		r->rrset_count);
@@ -701,7 +731,7 @@ rrset_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
 	struct dns_msg* msg;
 	struct packed_rrset_data* d = (struct packed_rrset_data*)
 		rrset->entry.data;
-	if(now > d->ttl)
+	if(TTL_IS_EXPIRED(d->ttl, now))
 		return NULL;
 	msg = gen_dns_msg(region, q, 1); /* only the CNAME (or other) RRset */
 	if(!msg)
@@ -736,7 +766,7 @@ synth_dname_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
 		rrset->entry.data;
 	uint8_t* newname, *dtarg = NULL;
 	size_t newlen, dtarglen;
-	if(now > d->ttl)
+	if(TTL_IS_EXPIRED(d->ttl, now))
 		return NULL;
 	/* only allow validated (with DNSSEC) DNAMEs used from cache 
 	 * for insecure DNAMEs, query again. */
@@ -844,6 +874,8 @@ fill_any(struct module_env* env,
 		/* set NOTIMPL for RFC 8482 */
 		msg->rep->flags |= LDNS_RCODE_NOTIMPL;
 		msg->rep->security = sec_status_indeterminate;
+		msg->rep->ttl = 1; /* empty NOTIMPL response will never be
+				    * updated with rrsets, set TTL to 1 */
 		return msg;
 	}
 
@@ -1069,7 +1101,7 @@ dns_cache_store(struct module_env* env, struct query_info* msgqinf,
 			msgqinf->qclass, flags, 0, 1);
 		if(e) {
 			struct reply_info* cached = e->entry.data;
-			if(cached->ttl < *env->now
+			if(TTL_IS_EXPIRED(cached->ttl, *env->now)
 				&& reply_info_could_use_expired(cached, *env->now)
 				/* If we are validating make sure only
 				 * validating modules can update such messages.
diff --git a/services/cache/dns.h b/services/cache/dns.h
index 8aa6b44bc..41d42e60d 100644
--- a/services/cache/dns.h
+++ b/services/cache/dns.h
@@ -53,7 +53,7 @@ struct delegpt;
  *  Must be an unsigned 32-bit value larger than 0xffff */
 
 /** Allow caching a DNS message with a zero TTL. */
-#define DNSCACHE_STORE_ZEROTTL 0x100000
+#define DNSCACHE_STORE_EXPIRED_MSG_CACHEDB 0x100000
 
 /**
  * Region allocated message reply
diff --git a/services/cache/rrset.c b/services/cache/rrset.c
index 6d5c24f80..200e3c701 100644
--- a/services/cache/rrset.c
+++ b/services/cache/rrset.c
@@ -131,7 +131,7 @@ need_to_update_rrset(void* nd, void* cd, time_t timenow, int equal, int ns)
 	struct packed_rrset_data* newd = (struct packed_rrset_data*)nd;
 	struct packed_rrset_data* cached = (struct packed_rrset_data*)cd;
 	/*	o if new data is expired, cached data is better */
-	if( newd->ttl < timenow && timenow <= cached->ttl)
+	if( TTL_IS_EXPIRED(newd->ttl, timenow) && !TTL_IS_EXPIRED(cached->ttl, timenow))
 		return 0;
 	/* 	o store if rrset has been validated 
 	 *  		everything better than bogus data 
@@ -146,13 +146,13 @@ need_to_update_rrset(void* nd, void* cd, time_t timenow, int equal, int ns)
         if( newd->trust > cached->trust ) {
 		/* if the cached rrset is bogus, and new is equal,
 		 * do not update the TTL - let it expire. */
-		if(equal && cached->ttl >= timenow && 
+		if(equal && !TTL_IS_EXPIRED(cached->ttl, timenow) &&
 			cached->security == sec_status_bogus)
 			return 0;
                 return 1;
 	}
 	/*	o item in cache has expired */
-	if( cached->ttl < timenow )
+	if( TTL_IS_EXPIRED(cached->ttl, timenow) )
 		return 1;
 	/*  o same trust, but different in data - insert it */
 	if( newd->trust == cached->trust && !equal ) {
@@ -300,7 +300,7 @@ rrset_cache_lookup(struct rrset_cache* r, uint8_t* qname, size_t qnamelen,
 		/* check TTL */
 		struct packed_rrset_data* data = 
 			(struct packed_rrset_data*)e->data;
-		if(timenow > data->ttl) {
+		if(TTL_IS_EXPIRED(data->ttl, timenow)) {
 			lock_rw_unlock(&e->lock);
 			return NULL;
 		}
@@ -310,17 +310,18 @@ rrset_cache_lookup(struct rrset_cache* r, uint8_t* qname, size_t qnamelen,
 	return NULL;
 }
 
-int 
+int
 rrset_array_lock(struct rrset_ref* ref, size_t count, time_t timenow)
 {
 	size_t i;
+	struct packed_rrset_data* d;
 	for(i=0; i<count; i++) {
 		if(i>0 && ref[i].key == ref[i-1].key)
 			continue; /* only lock items once */
 		lock_rw_rdlock(&ref[i].key->entry.lock);
-		if(ref[i].id != ref[i].key->id || timenow >
-			((struct packed_rrset_data*)(ref[i].key->entry.data))
-			->ttl) {
+		d = ref[i].key->entry.data;
+		if(ref[i].id != ref[i].key->id ||
+			TTL_IS_EXPIRED(d->ttl, timenow)) {
 			/* failure! rollback our readlocks */
 			rrset_array_unlock(ref, i+1);
 			return 0;
@@ -511,7 +512,7 @@ rrset_cache_expired_above(struct rrset_cache* r, uint8_t** qname, size_t*
 			*qnamelen, searchtype, qclass, 0, 0, 0))) {
 			struct packed_rrset_data* data =
 				(struct packed_rrset_data*)rrset->entry.data;
-			if(now > data->ttl) {
+			if(TTL_IS_EXPIRED(data->ttl, now)) {
 				/* it is expired, this is not wanted */
 				lock_rw_unlock(&rrset->entry.lock);
 				log_nametypeclass(VERB_ALGO, "this rrset is expired", *qname, searchtype, qclass);
diff --git a/services/listen_dnsport.c b/services/listen_dnsport.c
index b7d3d747c..f7fcca194 100644
--- a/services/listen_dnsport.c
+++ b/services/listen_dnsport.c
@@ -450,7 +450,7 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 		 * /proc/sys/net/core/wmem_max or sysctl net.core.wmem_max */
 		if(setsockopt(s, SOL_SOCKET, SO_SNDBUFFORCE, (void*)&snd,
 			(socklen_t)sizeof(snd)) < 0) {
-			if(errno != EPERM) {
+			if(errno != EPERM && errno != ENOBUFS) {
 				log_err("setsockopt(..., SO_SNDBUFFORCE, "
 					"...) failed: %s", sock_strerror(errno));
 				sock_close(s);
@@ -458,15 +458,23 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 				*inuse = 0;
 				return -1;
 			}
+			if(errno != EPERM) {
+				verbose(VERB_ALGO, "setsockopt(..., SO_SNDBUFFORCE, "
+					"...) was not granted: %s", sock_strerror(errno));
+			}
 #  endif /* SO_SNDBUFFORCE */
 			if(setsockopt(s, SOL_SOCKET, SO_SNDBUF, (void*)&snd,
 				(socklen_t)sizeof(snd)) < 0) {
-				log_err("setsockopt(..., SO_SNDBUF, "
-					"...) failed: %s", sock_strerror(errno));
-				sock_close(s);
-				*noproto = 0;
-				*inuse = 0;
-				return -1;
+				if(errno != ENOSYS && errno != ENOBUFS) {
+					log_err("setsockopt(..., SO_SNDBUF, "
+						"...) failed: %s", sock_strerror(errno));
+					sock_close(s);
+					*noproto = 0;
+					*inuse = 0;
+					return -1;
+				}
+				log_warn("setsockopt(..., SO_SNDBUF, "
+					"...) was not granted: %s", sock_strerror(errno));
 			}
 			/* check if we got the right thing or if system
 			 * reduced to some system max.  Warn if so */
diff --git a/services/mesh.c b/services/mesh.c
index a3122c233..a092915d5 100644
--- a/services/mesh.c
+++ b/services/mesh.c
@@ -349,7 +349,7 @@ mesh_serve_expired_lookup(struct module_qstate* qstate,
 
 	key = (struct msgreply_entry*)e->key;
 	data = (struct reply_info*)e->data;
-	if(data->ttl < timenow) *is_expired = 1;
+	if(TTL_IS_EXPIRED(data->ttl, timenow)) *is_expired = 1;
 	msg = tomsg(qstate->env, &key->key, data, qstate->region, timenow,
 		qstate->env->cfg->serve_expired, qstate->env->scratch);
 	if(!msg)
@@ -1153,8 +1153,7 @@ mesh_detect_cycle_found(struct module_qstate* qstate, struct mesh_state* dep_m)
 {
 	struct mesh_state* cyc_m = qstate->mesh_info;
 	size_t counter = 0;
-	if(!dep_m)
-		return 0;
+	log_assert(dep_m);
 	if(dep_m == cyc_m || find_in_subsub(dep_m, cyc_m, &counter)) {
 		if(counter > MESH_MAX_SUBSUB)
 			return 2;
@@ -1191,24 +1190,19 @@ void mesh_detach_subs(struct module_qstate* qstate)
 }
 
 int mesh_add_sub(struct module_qstate* qstate, struct query_info* qinfo,
-        uint16_t qflags, int prime, int valrec, struct module_qstate** newq,
-	struct mesh_state** sub)
+	struct respip_client_info* cinfo, uint16_t qflags, int prime,
+	int valrec, struct module_qstate** newq, struct mesh_state** sub)
 {
 	/* find it, if not, create it */
 	struct mesh_area* mesh = qstate->env->mesh;
-	*sub = mesh_area_find(mesh, NULL, qinfo, qflags,
-		prime, valrec);
-	if(mesh_detect_cycle_found(qstate, *sub)) {
-		verbose(VERB_ALGO, "attach failed, cycle detected");
-		return 0;
-	}
+	*sub = mesh_area_find(mesh, cinfo, qinfo, qflags, prime, valrec);
 	if(!*sub) {
 #ifdef UNBOUND_DEBUG
 		struct rbnode_type* n;
 #endif
 		/* create a new one */
-		*sub = mesh_state_create(qstate->env, qinfo, NULL, qflags, prime,
-			valrec);
+		*sub = mesh_state_create(qstate->env, qinfo, cinfo, qflags,
+			prime, valrec);
 		if(!*sub) {
 			log_err("mesh_attach_sub: out of memory");
 			return 0;
@@ -1231,18 +1225,25 @@ int mesh_add_sub(struct module_qstate* qstate, struct query_info* qinfo,
 		rbtree_insert(&mesh->run, &(*sub)->run_node);
 		log_assert(n != NULL);
 		*newq = &(*sub)->s;
-	} else
+	} else {
 		*newq = NULL;
+		if(mesh_detect_cycle_found(qstate, *sub)) {
+			verbose(VERB_ALGO, "attach failed, cycle detected");
+			return 0;
+		}
+	}
 	return 1;
 }
 
 int mesh_attach_sub(struct module_qstate* qstate, struct query_info* qinfo,
-        uint16_t qflags, int prime, int valrec, struct module_qstate** newq)
+	struct respip_client_info* cinfo, uint16_t qflags, int prime,
+	int valrec, struct module_qstate** newq)
 {
 	struct mesh_area* mesh = qstate->env->mesh;
 	struct mesh_state* sub = NULL;
 	int was_detached;
-	if(!mesh_add_sub(qstate, qinfo, qflags, prime, valrec, newq, &sub))
+	if(!mesh_add_sub(qstate, qinfo, cinfo, qflags, prime, valrec, newq,
+		&sub))
 		return 0;
 	was_detached = (sub->super_set.count == 0);
 	if(!mesh_state_attachment(qstate->mesh_info, sub))
@@ -1685,7 +1686,7 @@ static void dns_error_reporting(struct module_qstate* qstate,
 
 	log_query_info(VERB_ALGO, "DNS Error Reporting: generating report "
 		"query for", &qinfo);
-	if(mesh_add_sub(qstate, &qinfo, BIT_RD, 0, 0, &newq, &sub)) {
+	if(mesh_add_sub(qstate, &qinfo, NULL, BIT_RD, 0, 0, &newq, &sub)) {
 		qstate->env->mesh->num_dns_error_reports++;
 	}
 	return;
@@ -2319,7 +2320,7 @@ mesh_detect_cycle(struct module_qstate* qstate, struct query_info* qinfo,
 	struct mesh_area* mesh = qstate->env->mesh;
 	struct mesh_state* dep_m = NULL;
 	dep_m = mesh_area_find(mesh, NULL, qinfo, flags, prime, valrec);
-	return mesh_detect_cycle_found(qstate, dep_m);
+	return dep_m?mesh_detect_cycle_found(qstate, dep_m):0;
 }
 
 void mesh_list_insert(struct mesh_state* m, struct mesh_state** fp,
diff --git a/services/mesh.h b/services/mesh.h
index f19f423a8..53a05b443 100644
--- a/services/mesh.h
+++ b/services/mesh.h
@@ -399,6 +399,8 @@ void mesh_detach_subs(struct module_qstate* qstate);
  * @param qstate: the state to find mesh state, and that wants to receive
  * 	the results from the new subquery.
  * @param qinfo: what to query for (copied).
+ * @param cinfo: if non-NULL client specific info that may affect IP-based
+ * 	actions that apply to the query result. It is copied.
  * @param qflags: what flags to use (RD / CD flag or not).
  * @param prime: if it is a (stub) priming query.
  * @param valrec: if it is a validation recursion query (lookup of key, DS).
@@ -407,7 +409,8 @@ void mesh_detach_subs(struct module_qstate* qstate);
  * @return: false on error, true if success (and init may be needed).
  */
 int mesh_attach_sub(struct module_qstate* qstate, struct query_info* qinfo,
-	uint16_t qflags, int prime, int valrec, struct module_qstate** newq);
+	struct respip_client_info* cinfo, uint16_t qflags, int prime,
+	int valrec, struct module_qstate** newq);
 
 /**
  * Add detached query.
@@ -426,6 +429,8 @@ int mesh_attach_sub(struct module_qstate* qstate, struct query_info* qinfo,
  * @param qstate: the state to find mesh state, and that wants to receive
  * 	the results from the new subquery.
  * @param qinfo: what to query for (copied).
+ * @param cinfo: if non-NULL client specific info that may affect IP-based
+ * 	actions that apply to the query result. It is copied.
  * @param qflags: what flags to use (RD / CD flag or not).
  * @param prime: if it is a (stub) priming query.
  * @param valrec: if it is a validation recursion query (lookup of key, DS).
@@ -435,8 +440,8 @@ int mesh_attach_sub(struct module_qstate* qstate, struct query_info* qinfo,
  * @return: false on error, true if success (and init may be needed).
  */
 int mesh_add_sub(struct module_qstate* qstate, struct query_info* qinfo,
-        uint16_t qflags, int prime, int valrec, struct module_qstate** newq,
-	struct mesh_state** sub);
+	struct respip_client_info* cinfo, uint16_t qflags, int prime,
+	int valrec, struct module_qstate** newq, struct mesh_state** sub);
 
 /**
  * Query state is done, send messages to reply entries.
diff --git a/services/modstack.c b/services/modstack.c
index 2bc79c4ad..f5913dc38 100644
--- a/services/modstack.c
+++ b/services/modstack.c
@@ -262,6 +262,7 @@ int
 modstack_call_init(struct module_stack* stack, const char* module_conf,
 	struct module_env* env)
 {
+	const char* orig_module_conf = module_conf;
         int i, changed = 0;
         env->need_to_validate = 0; /* set by module init below */
         for(i=0; i<stack->num; i++) {
@@ -276,11 +277,13 @@ modstack_call_init(struct module_stack* stack, const char* module_conf,
 				changed = 1;
 			}
 		}
-		module_conf += strlen(stack->mod[i]->name);
+		/* Skip this module name in module_conf. */
+		while(*module_conf && !isspace((unsigned char)*module_conf))
+			module_conf++;
 	}
 	if(changed) {
 		modstack_free(stack);
-		if(!modstack_config(stack, module_conf)) {
+		if(!modstack_config(stack, orig_module_conf)) {
 			return 0;
 		}
 	}
diff --git a/services/rpz.c b/services/rpz.c
index df39e75b0..f45cf6542 100644
--- a/services/rpz.c
+++ b/services/rpz.c
@@ -2121,8 +2121,17 @@ rpz_synthesize_nsdname_localdata(struct rpz* r, struct module_qstate* ms,
 	rpz_log_dname("nsdname local data", key.name, key.namelen);
 
 	ld = (struct local_data*)rbtree_search(&z->data, &key.node);
+	if(ld == NULL && dname_is_wild(z->name)) {
+		key.name = z->name;
+		key.namelen = z->namelen;
+		key.namelabs = z->namelabs;
+		ld = (struct local_data*)rbtree_search(&z->data, &key.node);
+		/* rpz_synthesize_localdata_from_rrset is going to make
+		 * the rrset source name equal to the query name. So no need
+		 * to make the wildcard rrset here. */
+	}
 	if(ld == NULL) {
-		verbose(VERB_ALGO, "rpz: nsdname: impossible: qname not found");
+		verbose(VERB_ALGO, "rpz: nsdname: qname not found");
 		return NULL;
 	}
 
@@ -2148,6 +2157,15 @@ rpz_synthesize_qname_localdata_msg(struct rpz* r, struct module_qstate* ms,
 	key.namelen = qinfo->qname_len;
 	key.namelabs = dname_count_labels(qinfo->qname);
 	ld = (struct local_data*)rbtree_search(&z->data, &key.node);
+	if(ld == NULL && dname_is_wild(z->name)) {
+		key.name = z->name;
+		key.namelen = z->namelen;
+		key.namelabs = z->namelabs;
+		ld = (struct local_data*)rbtree_search(&z->data, &key.node);
+		/* rpz_synthesize_localdata_from_rrset is going to make
+		 * the rrset source name equal to the query name. So no need
+		 * to make the wildcard rrset here. */
+	}
 	if(ld == NULL) {
 		verbose(VERB_ALGO, "rpz: qname: name not found");
 		return NULL;
diff --git a/smallapp/unbound-checkconf.c b/smallapp/unbound-checkconf.c
index 2ca69e9e6..fd3f8ff9a 100644
--- a/smallapp/unbound-checkconf.c
+++ b/smallapp/unbound-checkconf.c
@@ -49,6 +49,7 @@
 #include "util/module.h"
 #include "util/net_help.h"
 #include "util/regional.h"
+#include "util/tsig.h"
 #include "iterator/iterator.h"
 #include "iterator/iter_fwd.h"
 #include "iterator/iter_hints.h"
@@ -783,7 +784,6 @@ morechecks(struct config_file* cfg)
 	/* check that the modules listed in module_conf exist */
 	check_modules_exist(cfg->module_conf);
 
-	/* Respip is known to *not* work with dns64. */
 	if(strcmp(cfg->module_conf, "iterator") != 0
 		&& strcmp(cfg->module_conf, "validator iterator") != 0
 		&& strcmp(cfg->module_conf, "dns64 validator iterator") != 0
@@ -869,6 +869,7 @@ morechecks(struct config_file* cfg)
 		&& strcmp(cfg->module_conf, "respip cachedb iterator") != 0
 		&& strcmp(cfg->module_conf, "dns64 validator cachedb iterator") != 0
 		&& strcmp(cfg->module_conf, "dns64 cachedb iterator") != 0
+		&& strcmp(cfg->module_conf, "respip dns64 validator cachedb iterator") != 0
 #endif
 #if defined(WITH_PYTHONMODULE) && defined(USE_CACHEDB)
 		&& strcmp(cfg->module_conf, "python dns64 cachedb iterator") != 0
@@ -1003,13 +1004,23 @@ static void
 check_auth(struct config_file* cfg)
 {
 	int is_rpz = 0;
+	struct tsig_key_table* tsig_key_table;
 	struct auth_zones* az = auth_zones_create();
-	if(!az || !auth_zones_apply_cfg(az, cfg, 0, &is_rpz, NULL, NULL)) {
+
+	/* construct tsig key table for tsig key name checks, and it
+	 * also checks the TSIG key name and algorithm and base64 syntax. */
+	tsig_key_table = tsig_key_table_create();
+	if(!tsig_key_table || !tsig_key_table_apply_cfg(tsig_key_table, cfg))
+		fatal_exit("Could not set up TSIG keys");
+
+	if(!az || !auth_zones_apply_cfg(az, cfg, 0, &is_rpz, NULL, NULL,
+		tsig_key_table)) {
 		fatal_exit("Could not setup authority zones");
 	}
 	if(is_rpz && !strstr(cfg->module_conf, "respip"))
 		fatal_exit("RPZ requires the respip module");
 	auth_zones_delete(az);
+	tsig_key_table_delete(tsig_key_table);
 }
 
 /** check config file */
diff --git a/smallapp/unbound-control.c b/smallapp/unbound-control.c
index 994a42870..696750c19 100644
--- a/smallapp/unbound-control.c
+++ b/smallapp/unbound-control.c
@@ -143,6 +143,8 @@ usage(void)
 	printf("  load_cache			load cache from stdin\n");
 	printf("				(not supported in remote unbounds in\n");
 	printf("				multi-process operation)\n");
+	printf("  cache_lookup [+t] <names>	print rrsets and msgs at or under the names\n");
+	printf("		+t		allow tld and root names.\n");
 	printf("  lookup <name>			print nameservers for name\n");
 	printf("  flush [+c] <name>			flushes common types for name from cache\n");
 	printf("  				types:  A, AAAA, MX, PTR, NS,\n");
diff --git a/testcode/fake_event.c b/testcode/fake_event.c
index 3a751acd9..2e25f9b4c 100644
--- a/testcode/fake_event.c
+++ b/testcode/fake_event.c
@@ -188,6 +188,22 @@ delete_replay_answer(struct replay_answer* a)
 	free(a);
 }
 
+/** Log the packet for a reply_packet from testpkts. */
+static void
+log_testpkt_reply_pkt(const char* txt, struct reply_packet* reppkt)
+{
+	if(!reppkt) {
+		log_info("%s <null>", txt);
+		return;
+	}
+	if(reppkt->reply_from_hex) {
+		log_pkt(txt, sldns_buffer_begin(reppkt->reply_from_hex),
+			sldns_buffer_limit(reppkt->reply_from_hex));
+		return;
+	}
+	log_pkt(txt, reppkt->reply_pkt, reppkt->reply_len);
+}
+
 /**
  * return: true if pending query matches the now event.
  */
@@ -240,9 +256,8 @@ pending_find_match(struct replay_runtime* runtime, struct entry** entry,
 				p->start_step, p->end_step, (*entry)->lineno);
 			if(p->addrlen != 0)
 				log_addr(0, "matched ip", &p->addr, p->addrlen);
-			log_pkt("matched pkt: ",
-				(*entry)->reply_list->reply_pkt,
-				(*entry)->reply_list->reply_len);
+			log_testpkt_reply_pkt("matched pkt: ",
+				(*entry)->reply_list);
 			return 1;
 		}
 		p = p->next_range;
@@ -330,7 +345,7 @@ fill_buffer_with_reply(sldns_buffer* buffer, struct entry* entry, uint8_t* q,
 		while(reppkt && i--)
 			reppkt = reppkt->next;
 		if(!reppkt) fatal_exit("extra packet read from TCP stream but none is available");
-		log_pkt("extra_packet ", reppkt->reply_pkt, reppkt->reply_len);
+		log_testpkt_reply_pkt("extra packet ", reppkt);
 	}
 	if(reppkt->reply_from_hex) {
 		c = sldns_buffer_begin(reppkt->reply_from_hex);
@@ -462,8 +477,7 @@ fake_front_query(struct replay_runtime* runtime, struct replay_moment *todo)
 		repinfo.c->type = comm_udp;
 	fill_buffer_with_reply(repinfo.c->buffer, todo->match, NULL, 0, 0);
 	log_info("testbound: incoming QUERY");
-	log_pkt("query pkt", todo->match->reply_list->reply_pkt,
-		todo->match->reply_list->reply_len);
+	log_testpkt_reply_pkt("query pkt ", todo->match->reply_list);
 	/* call the callback for incoming queries */
 	if((*runtime->callback_query)(repinfo.c, runtime->cb_arg,
 		NETEVENT_NOERROR, &repinfo)) {
diff --git a/testcode/testbound.c b/testcode/testbound.c
index 410ec165c..063037df4 100644
--- a/testcode/testbound.c
+++ b/testcode/testbound.c
@@ -297,7 +297,11 @@ setup_config(FILE* in, int* lineno, int* pass_argc, char* pass_argv[])
 			/* Allow the use of SHA1 signatures for the test,
 			 * in case that OpenSSL disallows use of RSASHA1
 			 * with rh-allow-sha1-signatures disabled. */
+#ifndef UB_ON_WINDOWS
 			setenv("OPENSSL_ENABLE_SHA1_SIGNATURES", "1", 0);
+#else
+			_putenv("OPENSSL_ENABLE_SHA1_SIGNATURES=1");
+#endif
 		}
 		fputs(line, cfg);
 	}
diff --git a/testcode/unitdname.c b/testcode/unitdname.c
index 32a9a5fdc..95c6e1fda 100644
--- a/testcode/unitdname.c
+++ b/testcode/unitdname.c
@@ -45,6 +45,7 @@
 #include "util/data/dname.h"
 #include "sldns/sbuffer.h"
 #include "sldns/str2wire.h"
+#include "sldns/wire2str.h"
 
 /** put dname into buffer */
 static sldns_buffer*
@@ -876,6 +877,262 @@ dname_setup_bufs(sldns_buffer* loopbuf, sldns_buffer* boundbuf)
 	sldns_buffer_flip(boundbuf);
 }
 
+/* Test strings for the test_long_names test. */
+/* Each label begins with the length of the label including the length octet. */
+
+char desc_1[] = "Domain is 1 octet too long.";
+
+uint8_t wire_dom_1[] = { /* Bad: Domain: (8x)0031abcdefghijklmnopqrstuvwxyz.0007ab. */
+			    0x1e, 0x30, 0x30, 0x33, 0x31, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b,
+			    0x6c, 0x6d, 0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e,
+			    0x30, 0x30, 0x33, 0x31, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c,
+			    0x6d, 0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e, 0x30,
+			    0x30, 0x33, 0x31, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d,
+			    0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e, 0x30, 0x30,
+			    0x33, 0x31, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e,
+			    0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e, 0x30, 0x30, 0x33,
+			    0x31, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f,
+			    0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e, 0x30, 0x30, 0x33, 0x31,
+			    0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f, 0x70,
+			    0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e, 0x30, 0x30, 0x33, 0x31, 0x61,
+			    0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f, 0x70, 0x71,
+			    0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e, 0x30, 0x30, 0x33, 0x31, 0x61, 0x62,
+			    0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f, 0x70, 0x71, 0x72,
+			    0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, /* Bad: */ 0x06, 0x30, 0x30, 0x30, 0x37, 0x61, 0x62, 0x00
+};
+
+char desc_2[] = "Domain has the maximum allowed length (255).";
+
+uint8_t wire_dom_2[] = { /* Good: Domain: (8x)0031abcdefghijklmnopqrstuvwxyz.00076a. */
+			    0x1e, 0x30, 0x30, 0x33, 0x31, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b,
+			    0x6c, 0x6d, 0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e,
+			    0x30, 0x30, 0x33, 0x31, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c,
+			    0x6d, 0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e, 0x30,
+			    0x30, 0x33, 0x31, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d,
+			    0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e, 0x30, 0x30,
+			    0x33, 0x31, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e,
+			    0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e, 0x30, 0x30, 0x33,
+			    0x31, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f,
+			    0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e, 0x30, 0x30, 0x33, 0x31,
+			    0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f, 0x70,
+			    0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e, 0x30, 0x30, 0x33, 0x31, 0x61,
+			    0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f, 0x70, 0x71,
+			    0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e, 0x30, 0x30, 0x33, 0x31, 0x61, 0x62,
+			    0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f, 0x70, 0x71, 0x72,
+			    0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, /* Good: */ 0x05, 0x30, 0x30, 0x30, 0x36, 0x61, 0x00
+};
+
+char desc_3[] = "Domain has a length one label in the 255th position for a total of 257.";
+
+uint8_t wire_dom_3[] = { /* Bad: Domain: (8x(0031abcdefghijklmnopqrstuvwxyz.0006ab.1. */
+			    0x1e, 0x30, 0x30, 0x33, 0x31, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b,
+			    0x6c, 0x6d, 0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e,
+			    0x30, 0x30, 0x33, 0x31, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c,
+			    0x6d, 0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e, 0x30,
+			    0x30, 0x33, 0x31, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d,
+			    0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e, 0x30, 0x30,
+			    0x33, 0x31, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e,
+			    0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e, 0x30, 0x30, 0x33,
+			    0x31, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f,
+			    0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e, 0x30, 0x30, 0x33, 0x31,
+			    0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f, 0x70,
+			    0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e, 0x30, 0x30, 0x33, 0x31, 0x61,
+			    0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f, 0x70, 0x71,
+			    0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e, 0x30, 0x30, 0x33, 0x31, 0x61, 0x62,
+			    0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f, 0x70, 0x71, 0x72,
+			    0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, /* Bad: */ 0x05, 0x30, 0x30, 0x30, 0x36, 0x61, 0x01, 0x32, 0x00
+};
+
+char desc_4[] = "Domain has the maximum allowed length (255).";
+
+uint8_t wire_dom_4[] = { /* Good: Domain: (8x)0031abcdefghijklmnopqrstuvwxyz.03.03. */
+			    0x1e, 0x30, 0x30, 0x33, 0x31, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b,
+			    0x6c, 0x6d, 0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e,
+			    0x30, 0x30, 0x33, 0x31, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c,
+			    0x6d, 0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e, 0x30,
+			    0x30, 0x33, 0x31, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d,
+			    0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e, 0x30, 0x30,
+			    0x33, 0x31, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e,
+			    0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e, 0x30, 0x30, 0x33,
+			    0x31, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f,
+			    0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e, 0x30, 0x30, 0x33, 0x31,
+			    0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f, 0x70,
+			    0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e, 0x30, 0x30, 0x33, 0x31, 0x61,
+			    0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f, 0x70, 0x71,
+			    0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e, 0x30, 0x30, 0x33, 0x31, 0x61, 0x62,
+			    0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f, 0x70, 0x71, 0x72,
+			    0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, /* Good: */ 0x02, 0x30, 0x33, 0x02, 0x30, 0x33, 0x00
+};
+
+char desc_5[] = "Domain has a maximum length label (63) in the 255th position.";
+
+uint8_t wire_dom_5[] = { /* Bad: Domain: (8x)0031abcdefghijklmnopqrstuvwxyz.03.03.65abc...zab...zab...ghi. */
+			    0x1e, 0x30, 0x30, 0x33, 0x31, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b,
+			    0x6c, 0x6d, 0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e,
+			    0x30, 0x30, 0x33, 0x31, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c,
+			    0x6d, 0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e, 0x30,
+			    0x30, 0x33, 0x31, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d,
+			    0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e, 0x30, 0x30,
+			    0x33, 0x31, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e,
+			    0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e, 0x30, 0x30, 0x33,
+			    0x31, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f,
+			    0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e, 0x30, 0x30, 0x33, 0x31,
+			    0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f, 0x70,
+			    0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e, 0x30, 0x30, 0x33, 0x31, 0x61,
+			    0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f, 0x70, 0x71,
+			    0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e, 0x30, 0x30, 0x33, 0x31, 0x61, 0x62,
+			    0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f, 0x70, 0x71, 0x72,
+			    0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, /* Bad: */ 0x02, 0x30, 0x33, 0x02, 0x30, 0x33, 0x3f, 0x36,
+			    0x33, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f,
+			    0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x61, 0x62, 0x63, 0x64, 0x65,
+			    0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75,
+			    0x76, 0x77, 0x78, 0x79, 0x7a, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x00
+};
+
+char desc_6[] = "Domain has a too long label (65) in the 255th position.";
+
+uint8_t wire_dom_6[] = { /* Bad: Domain: (8x)0031abcdefghijklmnopqrstuvwxyz.03.03.66abc...zab...zab...ijk. */
+			    0x1e, 0x30, 0x30, 0x33, 0x31, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b,
+			    0x6c, 0x6d, 0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e,
+			    0x30, 0x30, 0x33, 0x31, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c,
+			    0x6d, 0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e, 0x30,
+			    0x30, 0x33, 0x31, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d,
+			    0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e, 0x30, 0x30,
+			    0x33, 0x31, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e,
+			    0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e, 0x30, 0x30, 0x33,
+			    0x31, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f,
+			    0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e, 0x30, 0x30, 0x33, 0x31,
+			    0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f, 0x70,
+			    0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e, 0x30, 0x30, 0x33, 0x31, 0x61,
+			    0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f, 0x70, 0x71,
+			    0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e, 0x30, 0x30, 0x33, 0x31, 0x61, 0x62,
+			    0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f, 0x70, 0x71, 0x72,
+			    0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, /* Bad: */ 0x02, 0x30, 0x33, 0x02, 0x30, 0x33, 0x41, 0x36,
+			    0x36, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f,
+			    0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x61, 0x62, 0x63, 0x64, 0x65,
+			    0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75,
+			    0x76, 0x77, 0x78, 0x79, 0x7a, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b,
+			    0x00
+};
+
+char desc_7[] = "Domain has a too long label (65) in the 187th position.";
+
+uint8_t wire_dom_7[] = { /* Bad: Domain: (6x)0031abcdefghijklmnopqrstuvwxyz.65abc..zab...zab...ijk. */
+			    0x1e, 0x30, 0x30, 0x33, 0x31, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b,
+			    0x6c, 0x6d, 0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e,
+			    0x30, 0x30, 0x33, 0x31, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c,
+			    0x6d, 0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e, 0x30,
+			    0x30, 0x33, 0x31, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d,
+			    0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e, 0x30, 0x30,
+			    0x33, 0x31, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e,
+			    0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e, 0x30, 0x30, 0x33,
+			    0x31, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f,
+			    0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e, 0x30, 0x30, 0x33, 0x31,
+			    0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f, 0x70,
+			    0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a,
+			    /* Bad: */  0x41, 0x36,
+			    0x36, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f,
+			    0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x61, 0x62, 0x63, 0x64, 0x65,
+			    0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75,
+			    0x76, 0x77, 0x78, 0x79, 0x7a, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b,
+			    0x00
+};
+
+char desc_8[] = "Domains has the maximum allowed length and ends with a maximum length label.";
+
+uint8_t wire_dom_8[] = { /* Good: Domain: (6x)0031abcdefghijklmnopqrstuvwxyz.0004.0064abc..zab...zabcdefg. */
+			    0x1e, 0x30, 0x30, 0x33, 0x31, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b,
+			    0x6c, 0x6d, 0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e,
+			    0x30, 0x30, 0x33, 0x31, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c,
+			    0x6d, 0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e, 0x30,
+			    0x30, 0x33, 0x31, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d,
+			    0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e, 0x30, 0x30,
+			    0x33, 0x31, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e,
+			    0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e, 0x30, 0x30, 0x33,
+			    0x31, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f,
+			    0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e, 0x30, 0x30, 0x33, 0x31,
+			    0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f, 0x70,
+			    0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x03, 0x30, 0x30, 0x34 ,/* Good: */ 0x3f, 0x30,
+			    0x30, 0x36, 0x34, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d,
+			    0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x61, 0x62, 0x63,
+			    0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73,
+			    0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x00
+};
+
+char desc_9[] = "Domains has 254 octets, one less than the maximum allowed length.";
+
+uint8_t wire_dom_9[] = { /* Good: Domain: (6x)0031abcdefghijklmnopqrstuvwxyz.0004.0064abc..zab...zabcdef. */
+			    0x1e, 0x30, 0x30, 0x33, 0x31, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b,
+			    0x6c, 0x6d, 0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e,
+			    0x30, 0x30, 0x33, 0x31, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c,
+			    0x6d, 0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e, 0x30,
+			    0x30, 0x33, 0x31, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d,
+			    0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e, 0x30, 0x30,
+			    0x33, 0x31, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e,
+			    0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e, 0x30, 0x30, 0x33,
+			    0x31, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f,
+			    0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x1e, 0x30, 0x30, 0x33, 0x31,
+			    0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f, 0x70,
+			    0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x03, 0x30, 0x30, 0x34 ,/* Good: */ 0x3e, 0x30,
+			    0x30, 0x35, 0x34, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d,
+			    0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x61, 0x62, 0x63,
+			    0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73,
+			    0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x00
+};
+
+ /** Test dname to string with long domain names. */
+static void
+test_long_names(void)
+{
+	/* Set to 1 for verbose output, 0 turns it off. */
+	int verbtest = 0;
+
+	uint8_t* wire_doms[] = {wire_dom_1, wire_dom_2, wire_dom_3,
+		wire_dom_4, wire_dom_5, wire_dom_6, wire_dom_7, wire_dom_8,
+		wire_dom_9, 0};
+	char* descs[] = {desc_1, desc_2, desc_3, desc_4, desc_5, desc_6,
+		desc_7, desc_8, desc_9, 0};
+
+	int n;
+	char string_domain[260];
+	uint8_t** wd = wire_doms;
+	int di = 0;
+	int skip = 5; /* 0..6 */
+
+	while (*wd) {
+
+		if(verbtest)
+			printf("Test: %s\n", descs[di++]);
+
+		memset(string_domain, 0xff, sizeof(string_domain));
+		dname_str(*wd, string_domain);
+		for (n = 0 ; n < (int)sizeof(string_domain); ++n) {
+			if ((uint8_t)string_domain[n] == 0xff)
+			break;
+		}
+		if(verbtest)
+			printf("dname_str: L=%d, S=Skipping %d labels...%s\n",
+				n, skip, string_domain + skip*31);
+		unit_assert(n <= 255);
+
+		memset(string_domain, 0xff, sizeof(string_domain));
+		sldns_wire2str_dname_buf(*wd,
+			strlen((char*)*wd)+1 /* strlen works with these test strings */,
+			string_domain,
+			255 /* for comparable result to dname_str */ );
+		for (n = 0 ; n < (int)sizeof(string_domain); ++n) {
+			if ((uint8_t)string_domain[n] == 0xff)
+			break;
+		}
+		if(verbtest)
+			printf("sldns_wire2str_dname_buf: L=%d, S=Skipping %d labels...%s\n",
+				n, skip, string_domain + skip*31);
+		unit_assert(n <= 255);
+
+		++wd;
+	}
+}
+
 static void
 dname_test_str(sldns_buffer* buff)
 {
@@ -1019,6 +1276,8 @@ dname_test_str(sldns_buffer* buff)
 			unit_assert(0);
 		}
 	}
+
+	test_long_names();
 }
 
 void dname_test(void)
diff --git a/testcode/unittsig.c b/testcode/unittsig.c
index dda0c2aff..a67787d1e 100644
--- a/testcode/unittsig.c
+++ b/testcode/unittsig.c
@@ -118,6 +118,46 @@ static int vtest = 0;
  *	buffer. The expected rcode is the result of the verify,
  *	the expected result2 is the result of the sign. If that differs
  *	the test fails.
+ * tsig-verify-reply <key> <time> <expected result> <expected result2>
+ * <hex>
+ * endpacket
+ *	The data from previous packet in the buffer is used with
+ *	tsig-sign-query. Then the hex data is the reply, it is used
+ *	with tsig-verify-reply. It TSIG signs with key name, at timestamp
+ *	in secs. The result of the sign call is compared with the
+ *	expected result, the result of the verify call is compared with
+ *	the expected result2, and the test fails if not equal.
+ *
+ * tsig-sign-reply-xfr <num> <time> <expected rcode> <nth>
+ * packet
+ * <hex>
+ * endpacket
+ * call <time> <expected>
+ * check-packet
+ * <check hex>
+ * endpacket
+ * ..
+ * 	The data from the previous packet in the buffer is used with
+ * 	tsig-verify-query. Then a number of times, the hex data is
+ * 	used with tsig-sign-reply-xfr and the output is checked with
+ * 	the checkhex.
+ * 	The expected rcode is from tsig_verify_query. The expected from
+ * 	call is from tsig_sign_reply_xfr. The nth value 0 or 1 means
+ * 	sign every packet, but >= 2 signs after a series of unsigned
+ * 	packets.
+ * tsig-verify-reply-xfr <num> <key> <time> <result>
+ * packet
+ * <hex>
+ * endpacket
+ * call <time> <last> <result2>
+ * ..
+ *	The data from previous packet in the buffer is used with
+ *	tsig-sign-query. Then a number of times, the hex data is used
+ *	with tsig-verify-reply-xfr, and the result is checked.
+ *	The TSIG signes with key name, at timestamp in secs. The result
+ *	of the tsig-sign-query function is compared with result.
+ *	The last is the last_packet argument. The function result is
+ *	compared with result2.
  *
  */
 
@@ -880,6 +920,428 @@ handle_tsig_sign_reply(char* line, FILE* in, const char* fname,
 	sldns_buffer_copy(pkt, &reply_pkt);
 }
 
+/** Handle the tsig-verify-reply */
+static void
+handle_tsig_verify_reply(char* line, FILE* in, const char* fname,
+	struct tsig_key_table* key_table, struct sldns_buffer* pkt)
+{
+	char* arg = get_arg_on_line(line, "tsig-verify-reply");
+	char* s, *keyname, *timestr, *expectedstr, *expectedstr2;
+	int expected_result, expected_result2, ret;
+	uint64_t timepoint;
+	struct tsig_data* tsig;
+	size_t pos;
+	uint8_t buf[65536];
+	sldns_buffer reply_pkt;
+
+	s = arg;
+	keyname = get_next_arg_on_line(&s);
+	timestr = get_next_arg_on_line(&s);
+	expectedstr = get_next_arg_on_line(&s);
+	expectedstr2 = get_next_arg_on_line(&s);
+
+	timepoint = (uint64_t)atoll(timestr);
+	if(timepoint == 0 && strcmp(timestr, "0") != 0)
+		fatal_exit("expected time argument for %s", timestr);
+	expected_result = atoi(expectedstr);
+	if(expected_result == 0 && strcmp(expectedstr, "0") != 0)
+		fatal_exit("expected int argument for %s", expectedstr);
+	expected_result2 = atoi(expectedstr2);
+	if(expected_result2 == 0 && strcmp(expectedstr2, "0") != 0)
+		fatal_exit("expected int argument for %s", expectedstr2);
+
+	sldns_buffer_init_frm_data(&reply_pkt, buf, sizeof(buf));
+	if(!read_packet_hex("", &reply_pkt, in, fname))
+		fatal_exit("Could not read reply packet");
+	if(vtest >= 2) {
+		char* str = sldns_wire2str_pkt(sldns_buffer_begin(&reply_pkt),
+			sldns_buffer_limit(&reply_pkt));
+		if(str)
+			printf("reply packet: %s\n", str);
+		else
+			printf("could not wire2str_pkt\n");
+		free(str);
+	}
+
+	if(vtest) {
+		printf("tsig-verify-reply with %s %d %d %d\n", keyname,
+			(int)timepoint, expected_result, expected_result2);
+	}
+
+	tsig = tsig_create_fromstr(key_table, keyname);
+	if(!tsig)
+		fatal_exit("alloc fail or key not found %s", keyname);
+
+	/* Put position at the end of the packet to sign it. */
+	pos = sldns_buffer_limit(pkt);
+	sldns_buffer_clear(pkt);
+	sldns_buffer_set_position(pkt, pos);
+
+	ret = tsig_sign_query(tsig, pkt, key_table, timepoint);
+	sldns_buffer_flip(pkt);
+
+	if(vtest) {
+		if(ret == expected_result)
+			printf("function ok, %s\n", (ret?"success":"fail"));
+		else
+			printf("function returned %d, expected result %d\n",
+				ret, expected_result);
+	}
+	unit_assert(ret == expected_result);
+
+	/* Verify the reply */
+	/* Put position before TSIG */
+	if(!tsig_find_rr(&reply_pkt)) {
+		if(vtest)
+			printf("tsig-verify-reply found no TSIG RR\n");
+		unit_assert(0);
+		return;
+	}
+	ret = tsig_parse_verify_reply(tsig, &reply_pkt, key_table, timepoint);
+
+	if(vtest) {
+		if(ret == expected_result2)
+			printf("function ok, %s\n", (ret?"success":"fail"));
+		else
+			printf("function returned %d, expected result2 %d\n",
+				ret, expected_result2);
+	}
+	unit_assert(ret == expected_result2);
+
+	tsig_delete(tsig);
+}
+
+/* Read next line from file, skip empty and comment lines. It returns the
+ * key_keyword of the line. Returns false on failure. */
+static char*
+read_next_keyword(char* line, size_t len, FILE* in)
+{
+	char* s = NULL;
+	while(1) {
+		if(!fgets(line, len, in)) {
+			if(vtest) printf("fgets: %s\n", strerror(errno));
+			return NULL;
+		}
+		line[len-1]=0;
+		s = get_keyword(line);
+		if(s[0] == 0 || s[0] == '#')
+			continue;
+		break;
+	}
+	return s;
+}
+
+/** Handle the tsig-sign-reply-xfr */
+static void
+handle_tsig_sign_reply_xfr(char* line, FILE* in, const char* fname,
+	struct tsig_key_table* key_table, struct sldns_buffer* pkt)
+{
+	char* arg = get_arg_on_line(line, "tsig-sign-reply-xfr");
+	char* s, *numstr, *timestr, *expected_rcode_str, *expectedstr2,
+		*nthstr;
+	int expected_rcode, expected_result2, ret, num, i, nth;
+	uint64_t timepoint;
+	struct tsig_data* tsig;
+	size_t pos;
+	uint8_t buf[65536], buf2[65536];
+	sldns_buffer reply_pkt, check_pkt;
+	sldns_buffer_init_frm_data(&reply_pkt, buf, sizeof(buf));
+	sldns_buffer_init_frm_data(&check_pkt, buf2, sizeof(buf2));
+
+	s = arg;
+	numstr = get_next_arg_on_line(&s);
+	timestr = get_next_arg_on_line(&s);
+	expected_rcode_str = get_next_arg_on_line(&s);
+	nthstr = get_next_arg_on_line(&s);
+
+	num = atoi(numstr);
+	if(num == 0 && strcmp(numstr, "0") != 0)
+		fatal_exit("expected int argument for %s", numstr);
+	timepoint = (uint64_t)atoll(timestr);
+	if(timepoint == 0 && strcmp(timestr, "0") != 0)
+		fatal_exit("expected time argument for %s", timestr);
+	expected_rcode = str2wire_rcode(expected_rcode_str);
+	if(expected_rcode == 0 && strcmp(expected_rcode_str, "0") != 0 &&
+		strcmp(expected_rcode_str, "NOERROR") != 0 &&
+		strcmp(expected_rcode_str, "RCODE0") != 0)
+		fatal_exit("expected rcode argument for %s",
+			expected_rcode_str);
+	nth = atoi(nthstr);
+	if(nth == 0 && strcmp(nthstr, "0") != 0)
+		fatal_exit("expected int argument for %s", nthstr);
+	if(nth == 0)
+		nth = 1;
+
+	if(vtest) {
+		char bufrc[16];
+		sldns_wire2str_rcode_buf(expected_rcode, bufrc, sizeof(bufrc));
+		printf("tsig-sign-reply-xfr with %d %d %s %d\n", num,
+			(int)timepoint, bufrc, nth);
+	}
+
+	/* Verify the query in the packet buffer. Use that TSIG to sign
+	 * replies. */
+	if(!tsig_find_rr(pkt)) {
+		if(vtest)
+			printf("tsig-verify-query found no TSIG RR\n");
+		unit_assert(0);
+		return;
+	}
+	ret = tsig_parse_verify_query(key_table, pkt, &tsig, NULL, timepoint);
+	if(vtest) {
+		char bufrc[16];
+		sldns_wire2str_rcode_buf(expected_rcode, bufrc, sizeof(bufrc));
+		if(ret == expected_rcode)
+			printf("verify ok, ret %s\n", bufrc);
+		else
+			printf("verify returned %d, expected result %d %s\n",
+				ret, expected_rcode, bufrc);
+	}
+	unit_assert(ret == expected_rcode);
+	tsig->every_nth = nth;
+
+	/* Sign the reply packets. */
+	for(i=0; i<num; i++) {
+		char callline[1024];
+		if(vtest >= 2)
+			printf("xfr packet %d/%d\n", i+1, num);
+
+		/* read packet keyword */
+		if(!(s=read_next_keyword(callline, sizeof(callline), in)))
+			fatal_exit("could not read next line for "
+				"tsig-sign-reply-xfr %d", i+1);
+		if(strcmp(s, "packet")!=0)
+			fatal_exit("expected 'packet', but read '%s'",
+				callline);
+		if(!read_packet_hex("", &reply_pkt, in, fname))
+			fatal_exit("Could not read reply packet");
+
+		/* read call arguments */
+		if(!(s=read_next_keyword(callline, sizeof(callline), in)))
+			fatal_exit("could not read next line for "
+				"tsig-sign-reply-xfr %d", i+1);
+		if(strncmp(s, "call", 4) == 0) {
+			s = get_arg_on_line(s, "call");
+			timestr = get_next_arg_on_line(&s);
+			expectedstr2 = get_next_arg_on_line(&s);
+			timepoint = (uint64_t)atoll(timestr);
+			if(timepoint == 0 && strcmp(timestr, "0") != 0)
+				fatal_exit("expected time argument for %s", timestr);
+			expected_result2 = atoi(expectedstr2);
+			if(expected_result2 == 0 && strcmp(expectedstr2, "0") != 0)
+				fatal_exit("expected int argument for %s", expectedstr2);
+		} else {
+			fatal_exit("unknown line '%s' is not 'call' for %d in "
+				"tsig-sign-reply-xfr", s, i+1);
+		}
+
+		/* read check-packet keyword */
+		if(!(s=read_next_keyword(callline, sizeof(callline), in)))
+			fatal_exit("could not read next line for "
+				"tsig-sign-reply-xfr %d", i+1);
+		if(strcmp(s, "check-packet")!=0)
+			fatal_exit("expected 'check-packet', but read '%s'",
+				callline);
+		if(!read_packet_hex("", &check_pkt, in, fname))
+			fatal_exit("Could not read check packet");
+
+		if(vtest >= 2) {
+			char* str = sldns_wire2str_pkt(sldns_buffer_begin(&reply_pkt),
+				sldns_buffer_limit(&reply_pkt));
+			if(str)
+				printf("reply packet: %s\n", str);
+			else
+				printf("could not wire2str_pkt\n");
+			free(str);
+		}
+		if(vtest) {
+			printf("call with %d %d\n", (int)timepoint,
+				expected_result2);
+		}
+
+		/* Put position at the end of the packet to sign it. */
+		pos = sldns_buffer_limit(&reply_pkt);
+		sldns_buffer_clear(&reply_pkt);
+		sldns_buffer_set_position(&reply_pkt, pos);
+		if(ret != 0 && i==0) {
+			/* There was an error from verify, set the rcode
+			 * for it */
+			LDNS_RCODE_SET(sldns_buffer_begin(&reply_pkt), ret);
+		}
+		ret = tsig_sign_reply_xfr(tsig, &reply_pkt, key_table,
+			timepoint, (i==num-1));
+		sldns_buffer_flip(&reply_pkt);
+		if(vtest) {
+			if(ret == expected_result2)
+				printf("function ok, %s\n", (ret?"success":"fail"));
+			else
+				printf("function returned %d, expected result %d\n",
+					ret, expected_result2);
+		}
+		unit_assert(ret == expected_result2);
+
+		if(vtest >= 2) {
+			char* str = sldns_wire2str_pkt(sldns_buffer_begin(
+				&check_pkt), sldns_buffer_limit(
+				&check_pkt));
+			if(str)
+				printf("check packet: %s\n", str);
+			else
+				printf("could not wire2str_pkt\n");
+			free(str);
+		}
+		unit_assert(sldns_buffer_limit(&reply_pkt) ==
+				sldns_buffer_limit(&check_pkt) &&
+			memcmp(sldns_buffer_begin(&reply_pkt),
+				sldns_buffer_begin(&check_pkt),
+				sldns_buffer_limit(&reply_pkt)) == 0);
+		if(vtest)
+			printf("check-packet is equal, for %d/%d\n",
+				i+1, num);
+	}
+
+	tsig_delete(tsig);
+	sldns_buffer_copy(pkt, &reply_pkt);
+}
+
+/** Handle the tsig-verify-reply-xfr */
+static void
+handle_tsig_verify_reply_xfr(char* line, FILE* in, const char* fname,
+	struct tsig_key_table* key_table, struct sldns_buffer* pkt)
+{
+	char* arg = get_arg_on_line(line, "tsig-verify-reply-xfr");
+	char* s, *numstr, *keyname, *timestr, *expectedstr, *expectedstr2,
+		*laststr;
+	int i, num, expected_result, expected_result2, ret, last_packet;
+	uint64_t timepoint;
+	struct tsig_data* tsig;
+	size_t pos;
+	uint8_t buf[65536];
+	sldns_buffer reply_pkt;
+	sldns_buffer_init_frm_data(&reply_pkt, buf, sizeof(buf));
+
+	s = arg;
+	numstr = get_next_arg_on_line(&s);
+	keyname = get_next_arg_on_line(&s);
+	timestr = get_next_arg_on_line(&s);
+	expectedstr = get_next_arg_on_line(&s);
+
+	num = atoi(numstr);
+	if(num == 0 && strcmp(numstr, "0") != 0)
+		fatal_exit("expected int argument for %s", numstr);
+	timepoint = (uint64_t)atoll(timestr);
+	if(timepoint == 0 && strcmp(timestr, "0") != 0)
+		fatal_exit("expected time argument for %s", timestr);
+	expected_result = atoi(expectedstr);
+	if(expected_result == 0 && strcmp(expectedstr, "0") != 0)
+		fatal_exit("expected int argument for %s", expectedstr);
+
+	if(vtest) {
+		printf("tsig-verify-reply-xfr with %d %s %d %d\n", num,
+			keyname, (int)timepoint, expected_result);
+	}
+
+	tsig = tsig_create_fromstr(key_table, keyname);
+	if(!tsig)
+		fatal_exit("alloc fail or key not found %s", keyname);
+
+	/* Put position at the end of the packet to sign it. */
+	pos = sldns_buffer_limit(pkt);
+	sldns_buffer_clear(pkt);
+	sldns_buffer_set_position(pkt, pos);
+
+	ret = tsig_sign_query(tsig, pkt, key_table, timepoint);
+	sldns_buffer_flip(pkt);
+
+	if(vtest) {
+		if(ret == expected_result)
+			printf("function ok, %s\n", (ret?"success":"fail"));
+		else
+			printf("function returned %d, expected result %d\n",
+				ret, expected_result);
+	}
+	unit_assert(ret == expected_result);
+
+	/* Verify the reply packets */
+	for(i=0; i<num; i++) {
+		char callline[1024];
+		if(vtest >= 2)
+			printf("xfr packet %d/%d\n", i+1, num);
+
+		/* read packet keyword */
+		if(!(s=read_next_keyword(callline, sizeof(callline), in)))
+			fatal_exit("could not read next line for "
+				"tsig-verify-reply-xfr %d", i+1);
+		if(strcmp(s, "packet")!=0)
+			fatal_exit("expected 'packet', but read '%s'",
+				callline);
+		if(!read_packet_hex("", &reply_pkt, in, fname))
+			fatal_exit("Could not read reply packet");
+
+		/* read call arguments */
+		if(!(s=read_next_keyword(callline, sizeof(callline), in)))
+			fatal_exit("could not read next line for "
+				"tsig-verify-reply-xfr %d", i+1);
+		if(strncmp(s, "call", 4) == 0) {
+			s = get_arg_on_line(s, "call");
+			timestr = get_next_arg_on_line(&s);
+			laststr = get_next_arg_on_line(&s);
+			expectedstr2 = get_next_arg_on_line(&s);
+			timepoint = (uint64_t)atoll(timestr);
+			if(timepoint == 0 && strcmp(timestr, "0") != 0)
+				fatal_exit("expected time argument for %s", timestr);
+			last_packet = atoi(laststr);
+			if(last_packet == 0 && strcmp(laststr, "0") != 0)
+				fatal_exit("expected int argument for %s", laststr);
+			expected_result2 = atoi(expectedstr2);
+			if(expected_result2 == 0 && strcmp(expectedstr2, "0") != 0)
+				fatal_exit("expected int argument for %s", expectedstr2);
+		} else {
+			fatal_exit("unknown line '%s' is not 'call' for %d in "
+				"tsig-verify-reply-xfr", s, i+1);
+		}
+
+		if(vtest >= 2) {
+			char* str = sldns_wire2str_pkt(sldns_buffer_begin(&reply_pkt),
+				sldns_buffer_limit(&reply_pkt));
+			if(str)
+				printf("reply packet: %s\n", str);
+			else
+				printf("could not wire2str_pkt\n");
+			free(str);
+		}
+		if(vtest) {
+			printf("call with %d %d %d\n", (int)timepoint,
+				last_packet, expected_result2);
+		}
+
+		/* Put position before TSIG */
+		if(!tsig_find_rr(&reply_pkt)) {
+			if(vtest)
+				printf("tsig-verify-reply-xfr found no TSIG RR\n");
+			/* Set position at end, if no TSIG. */
+			sldns_buffer_set_position(&reply_pkt,
+				sldns_buffer_limit(&reply_pkt));
+		}
+		ret = tsig_parse_verify_reply_xfr(tsig, &reply_pkt, key_table,
+			timepoint, last_packet);
+
+		if(vtest) {
+			if(ret == expected_result2)
+				printf("function ok, %s\n", (ret?"success":"fail"));
+			else
+				printf("function returned %d, expected result2 %d\n",
+					ret, expected_result2);
+		}
+		unit_assert(ret == expected_result2);
+		if(vtest)
+			printf("call ok, for %d/%d\n", i+1, num);
+	}
+
+	tsig_delete(tsig);
+}
+
+
 /** Handle one line from the TSIG test file */
 static void
 handle_line(char* line, struct tsig_key_table* key_table,
@@ -907,8 +1369,14 @@ handle_line(char* line, struct tsig_key_table* key_table,
 		handle_tsig_sign_shared(s, key_table, pkt);
 	} else if(strncmp(s, "tsig-verify-shared", 18) == 0) {
 		handle_tsig_verify_shared(s, key_table, pkt);
+	} else if(strncmp(s, "tsig-sign-reply-xfr", 19) == 0) {
+		handle_tsig_sign_reply_xfr(s, in, fname, key_table, pkt);
+	} else if(strncmp(s, "tsig-verify-reply-xfr", 21) == 0) {
+		handle_tsig_verify_reply_xfr(s, in, fname, key_table, pkt);
 	} else if(strncmp(s, "tsig-sign-reply", 15) == 0) {
-		handle_tsig_sign_reply(s, in,fname, key_table, pkt);
+		handle_tsig_sign_reply(s, in, fname, key_table, pkt);
+	} else if(strncmp(s, "tsig-verify-reply", 17) == 0) {
+		handle_tsig_verify_reply(s, in, fname, key_table, pkt);
 	} else if(strncmp(s, "#", 1) == 0) {
 		/* skip comment */
 	} else if(strcmp(s, "") == 0) {
diff --git a/testcode/unitverify.c b/testcode/unitverify.c
index 24274c58b..12d5205b0 100644
--- a/testcode/unitverify.c
+++ b/testcode/unitverify.c
@@ -638,7 +638,11 @@ verify_test(void)
 		/* Allow the use of SHA1 signatures for the test,
 		 * in case that OpenSSL disallows use of RSASHA1
 		 * with rh-allow-sha1-signatures disabled. */
+#ifndef UB_ON_WINDOWS
 		setenv("OPENSSL_ENABLE_SHA1_SIGNATURES", "1", 0);
+#else
+		_putenv("OPENSSL_ENABLE_SHA1_SIGNATURES=1");
+#endif
 	}
 #endif
 
diff --git a/testdata/auth_https_origin.tdir/127.0.0.1/example.com.zone b/testdata/auth_https_origin.tdir/127.0.0.1/example.com.zone
new file mode 100644
index 000000000..e5ef82f14
--- /dev/null
+++ b/testdata/auth_https_origin.tdir/127.0.0.1/example.com.zone
@@ -0,0 +1,5 @@
+$ORIGIN .
+$TTL 7200
+example.com. IN SOA ns.example.com. hostmaster.example.com. 1 3600 900 86400 3600
+example.com.	IN NS	ns.example.net.
+www.example.com. IN A	1.2.3.4
diff --git a/testdata/auth_https_origin.tdir/auth_https_origin.conf b/testdata/auth_https_origin.tdir/auth_https_origin.conf
new file mode 100644
index 000000000..bfe013e44
--- /dev/null
+++ b/testdata/auth_https_origin.tdir/auth_https_origin.conf
@@ -0,0 +1,17 @@
+server:
+	verbosity: 7
+	# num-threads: 1
+	interface: 127.0.0.1
+	port: @PORT@
+	use-syslog: no
+	directory: ""
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+auth-zone:
+	name: "example.com"
+	for-upstream: yes
+	for-downstream: yes
+	url: "https://127.0.0.1:@TOPORT@/example.com.zone"
+
diff --git a/testdata/auth_https_origin.tdir/auth_https_origin.dsc b/testdata/auth_https_origin.tdir/auth_https_origin.dsc
new file mode 100644
index 000000000..9727fc6d1
--- /dev/null
+++ b/testdata/auth_https_origin.tdir/auth_https_origin.dsc
@@ -0,0 +1,16 @@
+BaseName: auth_https_origin
+Version: 1.0
+Description: Perform https for authority zone with $ORIGIN
+CreationDate: Mon 29 September 14:35:40 CEST 2025
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: auth_https_origin.pre
+Post: auth_https_origin.post
+Test: auth_https_origin.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/auth_https_origin.tdir/auth_https_origin.post b/testdata/auth_https_origin.tdir/auth_https_origin.post
new file mode 100644
index 000000000..f642d5401
--- /dev/null
+++ b/testdata/auth_https_origin.tdir/auth_https_origin.post
@@ -0,0 +1,11 @@
+# #-- auth_https_origin.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+PRE="../.."
+. ../common.sh
+kill_pid $UNBOUND_PID
+kill_pid $PETAL_PID
diff --git a/testdata/auth_https_origin.tdir/auth_https_origin.pre b/testdata/auth_https_origin.tdir/auth_https_origin.pre
new file mode 100644
index 000000000..ec838c571
--- /dev/null
+++ b/testdata/auth_https_origin.tdir/auth_https_origin.pre
@@ -0,0 +1,34 @@
+# #-- auth_https_origin.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+. ../common.sh
+get_random_port 2
+UNBOUND_PORT=$RND_PORT
+PETAL_PORT=$(($RND_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "PETAL_PORT=$PETAL_PORT" >> .tpkg.var.test
+
+get_make
+(cd $PRE; $MAKE petal)
+
+# start https daemon
+$PRE/petal -v -a "127.0.0.1" -p $PETAL_PORT >petal.log 2>&1 &
+PETAL_PID=$!
+echo "PETAL_PID=$PETAL_PID" >> .tpkg.var.test
+cat .tpkg.var.test
+wait_petal_up petal.log
+
+# make config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$PETAL_PORT'/' < auth_https_origin.conf > ub.conf
+# start unbound in the background
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_unbound_up unbound.log
+
diff --git a/testdata/auth_https_origin.tdir/auth_https_origin.test b/testdata/auth_https_origin.tdir/auth_https_origin.test
new file mode 100644
index 000000000..ac6eda9bb
--- /dev/null
+++ b/testdata/auth_https_origin.tdir/auth_https_origin.test
@@ -0,0 +1,63 @@
+# #-- auth_https_origin.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+. ../common.sh
+# do the test
+echo "> dig www.example.com."
+dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 1
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 1
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 1
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 10
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 10
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+echo "> cat logfiles"
+cat petal.log 
+cat unbound.log
+echo "> check answer"
+if grep "1.2.3.4" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+# Test that notify is allowed from the webserver address
+get_ldns_notify
+echo "> ldns-notify -z example.com"
+$LDNS_NOTIFY -p $UNBOUND_PORT -z example.com 127.0.0.1 | tee outfile
+if grep "rcode: REFUSED"  outfile; then
+	echo "Not OK"
+	exit 1
+else
+	echo "OK"
+fi
+
+exit 0
diff --git a/testdata/auth_https_origin.tdir/petal.key b/testdata/auth_https_origin.tdir/petal.key
new file mode 100644
index 000000000..6614e498f
--- /dev/null
+++ b/testdata/auth_https_origin.tdir/petal.key
@@ -0,0 +1,21 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIDfQIBAAKBwQC1xQ/Kca6zszZbcCtdOTIH2Uy2gOy/DfabMUU7TmNPm0dVE0NJ
+RuN+Rm304SonpwghfP2/ULZNnuDgpG03/32yI7k/VzG6iA4hiF7tT/KAAWC/+2l1
+QCsawCV2bSrFK0VhcZr7ALqXd8vkDaQ867K029ypjOQtAJ85qdO3mERy7TGtdUcu
+O6hLeVet419YeQ2F8cfNxn63d7bOzNGLPW5xwaCd3UcgD+Ib0k4xfFvbinvPQUeU
+J/i4YDWexFYSL+ECAwEAAQKBwCLXXQl+9O+5AEhSnd1Go1Jh0pSA7eBJOuXQcebG
+Rb7ykp+6C4G2NtDziwwPRNdI6wQQQ0sym18RfyVQHydGr78/nbiIbB3HCn5e92Mh
+mefzW6ow9Kvm2txLzGKA1lvoyRbNm81jnG/eygi3u7Nqd5PNv+4dHj2RkTlmxOeh
+qnDMVP5md8uZPv6lYNnrnIzvLCR5vnPNdVwn89AqzI85IcDZdy0R9ZX4NBbsDgAU
+6ig6uXuRXvSGiyJ/OUXSrnogaQJhAOjvkHUhVZQkPOxO90TNH4j0GdKKtbSWxIdz
+lKfuJeBAEqs0TL+C6vbS81Xw3W1alyDdUBk3rJMOBqW6Ryq5HNL+j5H+Jfsh7fvc
+Yle+5wHGci0P9zCFZCrY8It7n9XFIwJhAMfEi6oJa2G8waPJ1bQhxka82Tf9pnKM
+XCn/1BBOFjVIx5F842cpA+zp5a62GENTGYPQTTRBB/2/ZwnW5aIkrlg54AtmbqBZ
+Oh+2kJdJQD/tfoVmc5soUE2ScTHadK5RKwJhAN4w9kjkXS+MSZjX0kIMsBIBVkhh
+C+aREjJqa9ir7/Ey7RvmLXdYuCxtGLRXp7/R8+rjcK49Tx6O+IRJZe042mfhbq3C
+EhS1Tr86f4xXix9EXlDhs9bSxrOgcAN9Dv/opQJhAK7eBcPaav0rVfYh/8emqQHS
+3fJ9Pu6WnzbEksWTFS2ff9KDGCx9YspIFJ5TF/oXDAaumGZdZrlgirm6O1kr8tGY
+F97i04PZl1+bWAaWQH+1TUNI43m2WFUPE7coG2tb8QJgcddDg9VlXliZqgcETZfJ
+kJmYETxrcSn3ao6v116N8yxhEgUgjkmsCTiFgx36iDVnXwK6PIt+sIu8MC7eYNa3
+berrv/M21K0LRn20IWRxvUobG070weHCAgkko7fTWgr2
+-----END RSA PRIVATE KEY-----
diff --git a/testdata/auth_https_origin.tdir/petal.pem b/testdata/auth_https_origin.tdir/petal.pem
new file mode 100644
index 000000000..19c8b895b
--- /dev/null
+++ b/testdata/auth_https_origin.tdir/petal.pem
@@ -0,0 +1,14 @@
+-----BEGIN CERTIFICATE-----
+MIICFzCCAUACCQDO660L5y5LGDANBgkqhkiG9w0BAQUFADAQMQ4wDAYDVQQDEwVw
+ZXRhbDAeFw0xMDA5MzAxMzQzMDFaFw0zMDA2MTcxMzQzMDFaMBAxDjAMBgNVBAMT
+BXBldGFsMIHfMA0GCSqGSIb3DQEBAQUAA4HNADCByQKBwQC1xQ/Kca6zszZbcCtd
+OTIH2Uy2gOy/DfabMUU7TmNPm0dVE0NJRuN+Rm304SonpwghfP2/ULZNnuDgpG03
+/32yI7k/VzG6iA4hiF7tT/KAAWC/+2l1QCsawCV2bSrFK0VhcZr7ALqXd8vkDaQ8
+67K029ypjOQtAJ85qdO3mERy7TGtdUcuO6hLeVet419YeQ2F8cfNxn63d7bOzNGL
+PW5xwaCd3UcgD+Ib0k4xfFvbinvPQUeUJ/i4YDWexFYSL+ECAwEAATANBgkqhkiG
+9w0BAQUFAAOBwQBBkX9KDP2RXbg+xPmdJ4P6CwvA5x1LZwC++ydVx4NlvT0pWicD
+ZUnXjcWAJlkeOuUBAqFG7WHTrXpUUAjmdqFVq2yFjteUYBdrFz0RDB2jM9feeKYO
+mTgxdZyT9a6humxCxt5VfgT02axLjm/2AqCyFPMbf4PASoJDln01AEuZLZ8Xl2gV
+bYHMnHTGoD1Hu6FNEzRgkMC6XT8X3YjHvzQhpc/qL5wEfEsinQGdX4twsuWbf8xd
+q7miNnkO8vd0maw=
+-----END CERTIFICATE-----
diff --git a/testdata/auth_tsig.tdir/auth_tsig.dsc b/testdata/auth_tsig.tdir/auth_tsig.dsc
new file mode 100644
index 000000000..7c9f39249
--- /dev/null
+++ b/testdata/auth_tsig.tdir/auth_tsig.dsc
@@ -0,0 +1,16 @@
+BaseName: auth_tsig
+Version: 1.0
+Description: Perform AXFR with TSIG for authority zone.
+CreationDate: Fri 12 Sep 09:35:40 CEST 2025
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: auth_tsig.pre
+Post: auth_tsig.post
+Test: auth_tsig.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/auth_tsig.tdir/auth_tsig.nsd.conf b/testdata/auth_tsig.tdir/auth_tsig.nsd.conf
new file mode 100644
index 000000000..e03f91fab
--- /dev/null
+++ b/testdata/auth_tsig.tdir/auth_tsig.nsd.conf
@@ -0,0 +1,23 @@
+server:
+	logfile: "/dev/stderr"
+	xfrdfile: xfrd.state
+	username: ""
+	chroot: ""
+	zonesdir: ""
+	pidfile: "nsd.pid"
+	zonelistfile: "zone.list"
+	verbosity: 5
+	port: @NSD_PORT@
+	interface: 127.0.0.1@@NSD_PORT@
+
+key:
+	name: "test.key"
+	algorithm: sha256
+	secret: "K2tf3TRjvQkVCmJF3/Z9vA=="
+
+zone:
+	name: "example.com"
+	zonefile: "example.com.zone"
+	provide-xfr: 0.0.0.0/0 test.key
+	provide-xfr: ::0/0 test.key
+	notify: 127.0.0.1@@UNBOUND_PORT@ test.key
diff --git a/testdata/auth_tsig.tdir/auth_tsig.post b/testdata/auth_tsig.tdir/auth_tsig.post
new file mode 100644
index 000000000..276ad070f
--- /dev/null
+++ b/testdata/auth_tsig.tdir/auth_tsig.post
@@ -0,0 +1,14 @@
+# #-- auth_tsig.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+kill_pid $NSD_PID
+kill_pid $UNBOUND_PID
+echo "nsd.log"
+cat nsd.log
+echo "unbound.log"
+cat unbound.log
diff --git a/testdata/auth_tsig.tdir/auth_tsig.pre b/testdata/auth_tsig.tdir/auth_tsig.pre
new file mode 100644
index 000000000..c5f9d9f37
--- /dev/null
+++ b/testdata/auth_tsig.tdir/auth_tsig.pre
@@ -0,0 +1,59 @@
+# #-- auth_tsig.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+#skip_test "Skip test due to no UDP service for SOA query"
+PRE="../.."
+if test -n "$NSD"; then
+	:
+else
+	if `which nsd >/dev/null 2>&1`; then
+		NSD="nsd"
+	else
+		if test -f $PRE/../nsd/nsd; then
+			NSD="$PRE/../nsd/nsd"
+		else
+			skip_test "need nsd"
+		fi
+	fi
+fi
+echo "NSD=$NSD"
+
+if test -f $PRE/unbound_do_valgrind_in_test; then
+	do_valgrind=yes
+else
+	do_valgrind=no
+fi
+VALGRIND_FLAGS="--leak-check=full --show-leak-kinds=all"
+
+get_random_port 2
+UNBOUND_PORT=$RND_PORT
+NSD_PORT=$(($RND_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "NSD_PORT=$NSD_PORT" >> .tpkg.var.test
+
+# make config file
+sed -e 's/@UNBOUND_PORT\@/'$UNBOUND_PORT'/' -e 's/@NSD_PORT\@/'$NSD_PORT'/' < auth_tsig.ub.conf > ub.conf
+sed -e 's/@UNBOUND_PORT\@/'$UNBOUND_PORT'/' -e 's/@NSD_PORT\@/'$NSD_PORT'/' < auth_tsig.nsd.conf > nsd.conf
+
+# start nsd
+$NSD -d -c nsd.conf >nsd.log 2>&1 &
+NSD_PID=$!
+echo "NSD_PID=$NSD_PID" >> .tpkg.var.test
+
+# start unbound in the background
+if test $do_valgrind = "yes"; then
+valgrind $VALGRIND_FLAGS $PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+else
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+fi
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_nsd_up nsd.log
+wait_unbound_up unbound.log
diff --git a/testdata/auth_tsig.tdir/auth_tsig.test b/testdata/auth_tsig.tdir/auth_tsig.test
new file mode 100644
index 000000000..160dd8a0a
--- /dev/null
+++ b/testdata/auth_tsig.tdir/auth_tsig.test
@@ -0,0 +1,108 @@
+# #-- auth_tsig.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+# do the test
+echo "> dig www.example.com."
+dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 1
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 1
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 1
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 10
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 10
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+echo "> check answer"
+if grep "1.2.3.4" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+# update the zonefile.
+echo "www2.example.com. IN A 1.2.3.5" >> example.com.zone
+mv example.com.zone tmp.zone
+sed -e 's/2024082400/2024082401/' <tmp.zone >example.com.zone
+echo ""
+echo "new example.com.zone:"
+cat example.com.zone
+echo ""
+
+# NSD reloads the zone file,
+# sends notify to unbound, with TSIG.
+# unbound replies to the notify, with TSIG.
+# unbound fetches SOA record, with TSIG.
+# unbound fetches zone transfer, with TSIG.
+kill -1 `cat nsd.pid`
+
+# test if the zone has updated.
+dig @127.0.0.1 -p $UNBOUND_PORT www2.example.com. | tee outfile
+if grep NXDOMAIN outfile; then
+	echo "> try again"
+	dig @127.0.0.1 -p $UNBOUND_PORT www2.example.com. | tee outfile
+fi
+if grep NXDOMAIN outfile; then
+	echo "> try again"
+	sleep 1
+	dig @127.0.0.1 -p $UNBOUND_PORT www2.example.com. | tee outfile
+fi
+if grep NXDOMAIN outfile; then
+	echo "> try again"
+	sleep 1
+	dig @127.0.0.1 -p $UNBOUND_PORT www2.example.com. | tee outfile
+fi
+if grep NXDOMAIN outfile; then
+	echo "> try again"
+	sleep 1
+	dig @127.0.0.1 -p $UNBOUND_PORT www2.example.com. | tee outfile
+fi
+if grep NXDOMAIN outfile; then
+	echo "> try again"
+	sleep 10
+	dig @127.0.0.1 -p $UNBOUND_PORT www2.example.com. | tee outfile
+fi
+if grep NXDOMAIN outfile; then
+	echo "> try again"
+	sleep 10
+	dig @127.0.0.1 -p $UNBOUND_PORT www2.example.com. | tee outfile
+fi
+echo "> check answer"
+if grep "1.2.3.5" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+echo ""
+echo "zonefile: unbound-example.com.zone"
+cat unbound-example.com.zone
+echo ""
+
+exit 0
diff --git a/testdata/auth_tsig.tdir/auth_tsig.ub.conf b/testdata/auth_tsig.tdir/auth_tsig.ub.conf
new file mode 100644
index 000000000..cfcf477b9
--- /dev/null
+++ b/testdata/auth_tsig.tdir/auth_tsig.ub.conf
@@ -0,0 +1,26 @@
+server:
+	verbosity: 7
+	num-threads: 1
+	interface: 127.0.0.1
+	port: @UNBOUND_PORT@
+	use-syslog: no
+	directory: ""
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+	log-queries: yes
+
+# This tsig key is used for testing.
+tsig-key:
+	name: "test.key"
+	algorithm: sha256
+	secret: "K2tf3TRjvQkVCmJF3/Z9vA=="
+
+auth-zone:
+	name: "example.com"
+	zonefile: "unbound-example.com.zone"
+	for-upstream: yes
+	for-downstream: yes
+	primary-tsig: "127.0.0.1@@NSD_PORT@" test.key
+	allow-notify-tsig: "127.0.0.2@@NSD_PORT@" test.key
diff --git a/testdata/auth_tsig.tdir/example.com.zone b/testdata/auth_tsig.tdir/example.com.zone
new file mode 100644
index 000000000..18b5b407e
--- /dev/null
+++ b/testdata/auth_tsig.tdir/example.com.zone
@@ -0,0 +1,4 @@
+example.com.		240	IN	SOA	ns.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2024082400 28800 7200 604800 240
+example.com. NS ns.example.com.
+ns.example.com. IN A 192.0.2.1
+www.example.com. A 1.2.3.4
diff --git a/testdata/cachedb_expired.crpl b/testdata/cachedb_expired.crpl
index d3bf06fe1..697e88e26 100644
--- a/testdata/cachedb_expired.crpl
+++ b/testdata/cachedb_expired.crpl
@@ -5,7 +5,10 @@ server:
 	minimal-responses: no
 	serve-expired: yes
 	serve-expired-client-timeout: 0
+	serve-expired-reply-ttl: 123
 	module-config: "cachedb iterator"
+	ede: yes
+	ede-serve-expired: yes
 
 cachedb:
 	backend: "testframe"
@@ -82,7 +85,7 @@ REPLY QR AA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN A 1.2.3.4
+www.example.com. 200 IN A 1.2.3.4
 ENTRY_END
 
 ENTRY_BEGIN
@@ -91,7 +94,8 @@ REPLY QR AA NOERROR
 SECTION QUESTION
 www2.example.com. IN A
 SECTION ANSWER
-www2.example.com. 10 IN A 1.2.3.5
+; TTL lower than serve-expired-reply-ttl on purpose
+www2.example.com. 100 IN A 1.2.3.5
 ENTRY_END
 RANGE_END
 
@@ -111,7 +115,7 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN A 1.2.3.4
+www.example.com. 200 IN A 1.2.3.4
 ENTRY_END
 
 ; Get another query in cache to make it expired.
@@ -130,46 +134,46 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www2.example.com. IN A
 SECTION ANSWER
-www2.example.com. 10 IN A 1.2.3.5
+www2.example.com. 100 IN A 1.2.3.5
 ENTRY_END
 
 ; it is now expired
-STEP 40 TIME_PASSES ELAPSE 20
+STEP 40 TIME_PASSES ELAPSE 200
 
 ; cache is expired, and cachedb is expired.
 STEP 50 QUERY
 ENTRY_BEGIN
-REPLY RD
+REPLY RD DO
 SECTION QUESTION
 www2.example.com. IN A
 ENTRY_END
 
 STEP 60 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ttl
-REPLY QR RD RA NOERROR
+MATCH all ttl ede=3
+REPLY QR RD RA DO NOERROR
 SECTION QUESTION
 www2.example.com. IN A
 SECTION ANSWER
-www2.example.com. 30 IN A 1.2.3.5
+www2.example.com. 100 IN A 1.2.3.5
 ENTRY_END
 
 ; cache is expired, cachedb has no answer
 STEP 70 QUERY
 ENTRY_BEGIN
-REPLY RD
+REPLY RD DO
 SECTION QUESTION
 www.example.com. IN A
 ENTRY_END
 
 STEP 80 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ttl
-REPLY QR RD RA NOERROR
+MATCH all ttl ede=3
+REPLY QR RD RA DO NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 30 IN A 1.2.3.4
+www.example.com. 123 IN A 1.2.3.4
 ENTRY_END
 
 STEP 90 TRAFFIC
@@ -189,7 +193,7 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN A 1.2.3.4
+www.example.com. 200 IN A 1.2.3.4
 ENTRY_END
 
 ; flush the entry from cache
@@ -210,30 +214,30 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN A 1.2.3.4
+www.example.com. 200 IN A 1.2.3.4
 ENTRY_END
 
 ; it is now expired
-STEP 150 TIME_PASSES ELAPSE 20
+STEP 150 TIME_PASSES ELAPSE 200
 ; flush the entry from cache
 STEP 160 FLUSH_MESSAGE www.example.com. IN A
 
 ; cache has no answer, cachedb is expired
 STEP 170 QUERY
 ENTRY_BEGIN
-REPLY RD
+REPLY RD DO
 SECTION QUESTION
 www.example.com. IN A
 ENTRY_END
 
 STEP 180 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ttl
-REPLY QR RD RA NOERROR
+MATCH all ttl ede=3
+REPLY QR RD RA DO NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 30 IN A 1.2.3.4
+www.example.com. 123 IN A 1.2.3.4
 ENTRY_END
 
 STEP 190 TRAFFIC
@@ -254,7 +258,7 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN A 1.2.3.4
+www.example.com. 200 IN A 1.2.3.4
 ENTRY_END
 
 ; expire the entry in cache
@@ -275,30 +279,30 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN A 1.2.3.4
+www.example.com. 200 IN A 1.2.3.4
 ENTRY_END
 
 ; it is now expired
-STEP 250 TIME_PASSES ELAPSE 20
+STEP 250 TIME_PASSES ELAPSE 200
 ; expire the entry in cache
 STEP 260 EXPIRE_MESSAGE www.example.com. IN A
 
 ; cache is expired, cachedb is expired
 STEP 270 QUERY
 ENTRY_BEGIN
-REPLY RD
+REPLY RD DO
 SECTION QUESTION
 www.example.com. IN A
 ENTRY_END
 
 STEP 280 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ttl
-REPLY QR RD RA NOERROR
+MATCH all ttl ede=3
+REPLY QR RD RA DO NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 30 IN A 1.2.3.4
+www.example.com. 123 IN A 1.2.3.4
 ENTRY_END
 
 STEP 290 TRAFFIC
@@ -319,7 +323,7 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN A 1.2.3.4
+www.example.com. 200 IN A 1.2.3.4
 ENTRY_END
 
 SCENARIO_END
diff --git a/testdata/cachedb_expired_client_timeout.crpl b/testdata/cachedb_expired_client_timeout.crpl
index 78ddf4d8f..16d8cc30d 100644
--- a/testdata/cachedb_expired_client_timeout.crpl
+++ b/testdata/cachedb_expired_client_timeout.crpl
@@ -4,12 +4,14 @@ server:
 	qname-minimisation: no
 	minimal-responses: no
 	serve-expired: yes
-	serve-expired-reply-ttl: 30
+	serve-expired-reply-ttl: 123
 	; at least one second, so we can time skip past the timer in the
 	; testbound script steps, but also reply within the time.
 	serve-expired-client-timeout: 1200
 	module-config: "cachedb iterator"
 	discard-timeout: 3000
+	ede: yes
+	ede-serve-expired: yes
 
 cachedb:
 	backend: "testframe"
@@ -86,7 +88,7 @@ REPLY QR AA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN A 1.2.3.4
+www.example.com. 200 IN A 1.2.3.4
 ENTRY_END
 
 ENTRY_BEGIN
@@ -95,7 +97,8 @@ REPLY QR AA NOERROR
 SECTION QUESTION
 www2.example.com. IN A
 SECTION ANSWER
-www2.example.com. 10 IN A 1.2.3.5
+; TTL lower than serve-expired-reply-ttl on purpose
+www2.example.com. 100 IN A 1.2.3.5
 ENTRY_END
 RANGE_END
 
@@ -108,7 +111,7 @@ REPLY QR AA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN A 1.2.3.6
+www.example.com. 200 IN A 1.2.3.6
 ENTRY_END
 
 ENTRY_BEGIN
@@ -117,7 +120,8 @@ REPLY QR AA NOERROR
 SECTION QUESTION
 www2.example.com. IN A
 SECTION ANSWER
-www2.example.com. 10 IN A 1.2.3.7
+; TTL lower than serve-expired-reply-ttl on purpose
+www2.example.com. 100 IN A 1.2.3.7
 ENTRY_END
 RANGE_END
 
@@ -132,7 +136,7 @@ REPLY QR AA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN A 1.2.3.8
+www.example.com. 200 IN A 1.2.3.8
 ENTRY_END
 
 ENTRY_BEGIN
@@ -141,7 +145,8 @@ REPLY QR AA NOERROR
 SECTION QUESTION
 www2.example.com. IN A
 SECTION ANSWER
-www2.example.com. 10 IN A 1.2.3.9
+; TTL lower than serve-expired-reply-ttl on purpose
+www2.example.com. 100 IN A 1.2.3.9
 ENTRY_END
 RANGE_END
 
@@ -156,7 +161,7 @@ REPLY QR AA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN A 1.2.3.10
+www.example.com. 200 IN A 1.2.3.10
 ENTRY_END
 
 ENTRY_BEGIN
@@ -165,7 +170,7 @@ REPLY QR AA NOERROR
 SECTION QUESTION
 www2.example.com. IN A
 SECTION ANSWER
-www2.example.com. 10 IN A 1.2.3.11
+www2.example.com. 100 IN A 1.2.3.11
 ENTRY_END
 RANGE_END
 
@@ -188,7 +193,7 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN A 1.2.3.4
+www.example.com. 200 IN A 1.2.3.4
 ENTRY_END
 
 ; Get another query in cache.
@@ -207,7 +212,7 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www2.example.com. IN A
 SECTION ANSWER
-www2.example.com. 10 IN A 1.2.3.5
+www2.example.com. 100 IN A 1.2.3.5
 ENTRY_END
 
 ; www.example.com and www2.example.com are in cache, www2 in cachedb.
@@ -217,7 +222,7 @@ STEP 40 FLUSH_MESSAGE www2.example.com. IN A
 ; response from cachedb for www2.
 
 ; make 2 seconds pass to decrement the TTL on the response,
-; the upstream TTL would be 10, cachedb 8.
+; the upstream TTL would be 200, cachedb 198.
 STEP 48 TIME_PASSES ELAPSE 2
 
 STEP 50 QUERY
@@ -234,11 +239,11 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www2.example.com. IN A
 SECTION ANSWER
-www2.example.com. 8 IN A 1.2.3.5
+www2.example.com. 98 IN A 1.2.3.5
 ENTRY_END
 
 ; make both cache and cachedb expired
-STEP 70 TIME_PASSES ELAPSE 20
+STEP 70 TIME_PASSES ELAPSE 200
 
 ; www and www2 expired in cache, www2 expired in cachedb.
 ; the query should now try to resolve and complete within the
@@ -258,11 +263,11 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www2.example.com. IN A
 SECTION ANSWER
-www2.example.com. 10 IN A 1.2.3.7
+www2.example.com. 100 IN A 1.2.3.7
 ENTRY_END
 
 ; expire the data again
-STEP 100 TIME_PASSES ELAPSE 20
+STEP 100 TIME_PASSES ELAPSE 200
 
 ; the query should now try to resolve, but the upstream is not
 ; responsive for several testbound steps. When the timer expires,
@@ -271,7 +276,7 @@ STEP 100 TIME_PASSES ELAPSE 20
 ; www2 expired in cache and www2 expired in cachedb.
 STEP 110 QUERY
 ENTRY_BEGIN
-REPLY RD
+REPLY RD DO
 SECTION QUESTION
 www2.example.com. IN A
 ENTRY_END
@@ -281,26 +286,26 @@ STEP 112 TIME_PASSES ELAPSE 2
 
 STEP 120 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ttl
-REPLY QR RD RA NOERROR
+MATCH all ttl ede=3
+REPLY QR RD RA DO NOERROR
 SECTION QUESTION
 www2.example.com. IN A
 SECTION ANSWER
-www2.example.com. 30 IN A 1.2.3.7
+www2.example.com. 100 IN A 1.2.3.7
 ENTRY_END
 
 ; make traffic flow to resolve the query, server responds.
 STEP 130 TRAFFIC
 
 ; expire the data again
-STEP 140 TIME_PASSES ELAPSE 20
+STEP 140 TIME_PASSES ELAPSE 200
 
 ; The client query tries to resolve, but gets no immediate answer,
 ; so the expired data is used. But the expired data is in cache and
 ; the query is not in cachedb.
 STEP 150 QUERY
 ENTRY_BEGIN
-REPLY RD
+REPLY RD DO
 SECTION QUESTION
 www.example.com. IN A
 ENTRY_END
@@ -310,12 +315,12 @@ STEP 152 TIME_PASSES ELAPSE 2
 
 STEP 160 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ttl
-REPLY QR RD RA NOERROR
+MATCH all ttl ede=3
+REPLY QR RD RA DO NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 30 IN A 1.2.3.4
+www.example.com. 123 IN A 1.2.3.4
 ENTRY_END
 
 ; make traffic flow to resolve the query, server responds.
@@ -337,7 +342,7 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www2.example.com. IN A
 SECTION ANSWER
-www2.example.com. 10 IN A 1.2.3.11
+www2.example.com. 100 IN A 1.2.3.11
 ENTRY_END
 
 SCENARIO_END
diff --git a/testdata/cachedb_expired_reply_ttl.crpl b/testdata/cachedb_expired_reply_ttl.crpl
index 03fd01add..b8adbe738 100644
--- a/testdata/cachedb_expired_reply_ttl.crpl
+++ b/testdata/cachedb_expired_reply_ttl.crpl
@@ -5,8 +5,10 @@ server:
 	minimal-responses: no
 	serve-expired: yes
 	serve-expired-client-timeout: 0
-	serve-expired-reply-ttl: 30
+	serve-expired-reply-ttl: 123
 	module-config: "cachedb iterator"
+	ede: yes
+	ede-serve-expired: yes
 
 cachedb:
 	backend: "testframe"
@@ -83,7 +85,7 @@ REPLY QR AA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN A 1.2.3.4
+www.example.com. 200 IN A 1.2.3.4
 ENTRY_END
 
 ENTRY_BEGIN
@@ -92,7 +94,8 @@ REPLY QR AA NOERROR
 SECTION QUESTION
 www2.example.com. IN A
 SECTION ANSWER
-www2.example.com. 10 IN A 1.2.3.5
+; TTL lower than serve-expired-reply-ttl on purpose
+www2.example.com. 100 IN A 1.2.3.5
 ENTRY_END
 RANGE_END
 
@@ -115,7 +118,7 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN A 1.2.3.4
+www.example.com. 200 IN A 1.2.3.4
 ENTRY_END
 
 ; Get another query in cache to make it expired.
@@ -134,28 +137,28 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www2.example.com. IN A
 SECTION ANSWER
-www2.example.com. 10 IN A 1.2.3.5
+www2.example.com. 100 IN A 1.2.3.5
 ENTRY_END
 
 ; it is now expired
-STEP 40 TIME_PASSES ELAPSE 20
+STEP 40 TIME_PASSES ELAPSE 200
 
 ; cache is expired, and cachedb is expired.
 STEP 50 QUERY
 ENTRY_BEGIN
-REPLY RD
+REPLY RD DO
 SECTION QUESTION
 www2.example.com. IN A
 ENTRY_END
 
 STEP 60 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ttl
-REPLY QR RD RA NOERROR
+MATCH all ttl ede=3
+REPLY QR RD RA DO NOERROR
 SECTION QUESTION
 www2.example.com. IN A
 SECTION ANSWER
-www2.example.com. 30 IN A 1.2.3.5
+www2.example.com. 100 IN A 1.2.3.5
 ENTRY_END
 
 ; got an answer from upstream
@@ -173,25 +176,25 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www2.example.com. IN A
 SECTION ANSWER
-www2.example.com. 10 IN A 1.2.3.5
+www2.example.com. 100 IN A 1.2.3.5
 ENTRY_END
 
 ; cache is expired, cachedb has no answer
 STEP 70 QUERY
 ENTRY_BEGIN
-REPLY RD
+REPLY RD DO
 SECTION QUESTION
 www.example.com. IN A
 ENTRY_END
 
 STEP 80 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ttl
-REPLY QR RD RA NOERROR
+MATCH all ttl ede=3
+REPLY QR RD RA DO NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 30 IN A 1.2.3.4
+www.example.com. 123 IN A 1.2.3.4
 ENTRY_END
 
 STEP 90 TRAFFIC
@@ -211,29 +214,29 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN A 1.2.3.4
+www.example.com. 200 IN A 1.2.3.4
 ENTRY_END
 
 ; make both cache and cachedb expired.
-STEP 120 TIME_PASSES ELAPSE 20
+STEP 120 TIME_PASSES ELAPSE 200
 STEP 130 FLUSH_MESSAGE www.example.com. IN A
 
 ; cache has no entry and cachedb is expired.
 STEP 140 QUERY
 ENTRY_BEGIN
-REPLY RD
+REPLY RD DO
 SECTION QUESTION
 www.example.com. IN A
 ENTRY_END
 
 STEP 150 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ttl
-REPLY QR RD RA NOERROR
+MATCH all ttl ede=3
+REPLY QR RD RA DO NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 30 IN A 1.2.3.4
+www.example.com. 123 IN A 1.2.3.4
 ENTRY_END
 
 ; the name is resolved
@@ -254,7 +257,7 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN A 1.2.3.4
+www.example.com. 200 IN A 1.2.3.4
 ENTRY_END
 
 SCENARIO_END
diff --git a/testdata/cachedb_subnet_change.crpl b/testdata/cachedb_subnet_change.crpl
index 73584305c..87903132c 100644
--- a/testdata/cachedb_subnet_change.crpl
+++ b/testdata/cachedb_subnet_change.crpl
@@ -4,7 +4,7 @@ server:
 	qname-minimisation: no
 	minimal-responses: no
 	serve-expired: yes
-	serve-expired-reply-ttl: 30
+	serve-expired-reply-ttl: 123
 
 	; disable the serve expired client timeout.
 	serve-expired-client-timeout: 0
@@ -14,6 +14,8 @@ server:
 	; store for edns subnet content for modules to the right of it.
 	; this keeps subnet content out of cachedb as global content.
 	module-config: "subnetcache cachedb iterator"
+	ede: yes
+	ede-serve-expired: yes
 
 cachedb:
 	backend: "testframe"
@@ -105,7 +107,7 @@ REPLY QR AA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN CNAME www.initial.com.
+www.example.com. 200 IN CNAME www.initial.com.
 ENTRY_END
 RANGE_END
 
@@ -118,7 +120,7 @@ REPLY QR AA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN CNAME example.foo.com.
+www.example.com. 200 IN CNAME example.foo.com.
 ENTRY_END
 RANGE_END
 
@@ -131,7 +133,7 @@ REPLY QR AA NOERROR
 SECTION QUESTION
 www.initial.com. IN A
 SECTION ANSWER
-www.initial.com. 10 IN A 1.2.3.4
+www.initial.com. 200 IN A 1.2.3.4
 ENTRY_END
 RANGE_END
 
@@ -144,7 +146,7 @@ REPLY QR AA NOERROR
 SECTION QUESTION
 example.foo.com. IN A
 SECTION ANSWER
-example.foo.com. 10 IN A 1.2.3.5
+example.foo.com. 200 IN A 1.2.3.5
 SECTION ADDITIONAL
 	HEX_EDNSDATA_BEGIN
 				; client is 127.0.0.1
@@ -166,7 +168,7 @@ REPLY QR AA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN CNAME example.foo.com.
+www.example.com. 200 IN CNAME example.foo.com.
 ENTRY_END
 RANGE_END
 
@@ -179,7 +181,7 @@ REPLY QR AA NOERROR
 SECTION QUESTION
 example.foo.com. IN A
 SECTION ANSWER
-example.foo.com. 10 IN A 1.2.3.6
+example.foo.com. 200 IN A 1.2.3.6
 SECTION ADDITIONAL
 	HEX_EDNSDATA_BEGIN
 				; client is 127.0.0.1
@@ -211,19 +213,19 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN CNAME www.initial.com.
-www.initial.com. 10 IN A 1.2.3.4
+www.example.com. 200 IN CNAME www.initial.com.
+www.initial.com. 200 IN A 1.2.3.4
 ENTRY_END
 
 ; now valid in cache and valid in cachedb, without subnet.
-STEP 30 TIME_PASSES ELAPSE 20
+STEP 30 TIME_PASSES ELAPSE 200
 
 ; now the cache and cachedb have an expired entry.
 ; the upstream is updated to CNAME to a subnet zone A record.
 
 STEP 40 QUERY ADDRESS 127.0.0.1
 ENTRY_BEGIN
-REPLY RD
+REPLY RD DO
 SECTION QUESTION
 www.example.com. IN A
 ENTRY_END
@@ -231,13 +233,13 @@ ENTRY_END
 ; the expired answer, while the ECS answer is looked up.
 STEP 50 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ttl
-REPLY QR RD RA NOERROR
+MATCH all ttl ede=3
+REPLY QR RD RA DO NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 30 IN CNAME www.initial.com.
-www.initial.com. 30 IN A 1.2.3.4
+www.example.com. 123 IN CNAME www.initial.com.
+www.initial.com. 123 IN A 1.2.3.4
 ENTRY_END
 
 ; check that subnet has the query in cache.
@@ -256,12 +258,12 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 8 IN CNAME example.foo.com.
-example.foo.com. 8 IN A 1.2.3.5
+www.example.com. 198 IN CNAME example.foo.com.
+example.foo.com. 198 IN A 1.2.3.5
 ENTRY_END
 
 ; everything is expired, cache, subnetcache and cachedb.
-STEP 80 TIME_PASSES ELAPSE 20
+STEP 80 TIME_PASSES ELAPSE 200
 
 STEP 90 QUERY ADDRESS 127.0.0.1
 ENTRY_BEGIN
@@ -277,8 +279,8 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN CNAME example.foo.com.
-example.foo.com. 10 IN A 1.2.3.6
+www.example.com. 200 IN CNAME example.foo.com.
+example.foo.com. 200 IN A 1.2.3.6
 ENTRY_END
 
 ; see the entry now in cache, from the subnetcache.
@@ -297,8 +299,8 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 8 IN CNAME example.foo.com.
-example.foo.com. 8 IN A 1.2.3.6
+www.example.com. 198 IN CNAME example.foo.com.
+example.foo.com. 198 IN A 1.2.3.6
 ENTRY_END
 
 SCENARIO_END
diff --git a/testdata/cachedb_val_expired.crpl b/testdata/cachedb_val_expired.crpl
index 741445ce8..aa98b5fe6 100644
--- a/testdata/cachedb_val_expired.crpl
+++ b/testdata/cachedb_val_expired.crpl
@@ -5,8 +5,11 @@ server:
 	minimal-responses: yes
 	serve-expired: yes
 	serve-expired-client-timeout: 0
+	serve-expired-reply-ttl: 123
 	;module-config: "subnetcache validator cachedb iterator"
 	module-config: "validator cachedb iterator"
+	ede: yes
+	ede-serve-expired: yes
 
 cachedb:
 	backend: "testframe"
@@ -83,7 +86,7 @@ REPLY QR AA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN A 1.2.3.4
+www.example.com. 200 IN A 1.2.3.4
 ENTRY_END
 
 ENTRY_BEGIN
@@ -92,7 +95,8 @@ REPLY QR AA NOERROR
 SECTION QUESTION
 www2.example.com. IN A
 SECTION ANSWER
-www2.example.com. 10 IN A 1.2.3.5
+; TTL lower than serve-expired-reply-ttl on purpose
+www2.example.com. 100 IN A 1.2.3.5
 ENTRY_END
 RANGE_END
 
@@ -112,7 +116,7 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN A 1.2.3.4
+www.example.com. 200 IN A 1.2.3.4
 ENTRY_END
 
 ; Get another query in cache to make it expired.
@@ -131,48 +135,48 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www2.example.com. IN A
 SECTION ANSWER
-www2.example.com. 10 IN A 1.2.3.5
+www2.example.com. 100 IN A 1.2.3.5
 ENTRY_END
 
 ; it is now expired
-STEP 40 TIME_PASSES ELAPSE 20
+STEP 40 TIME_PASSES ELAPSE 200
 
 ; cache is expired, and cachedb is expired.
 ; The expired reply, from cachedb, needs a validation status,
 ; because the validator module set that validation is needed.
 STEP 50 QUERY
 ENTRY_BEGIN
-REPLY RD
+REPLY RD DO
 SECTION QUESTION
 www2.example.com. IN A
 ENTRY_END
 
 STEP 60 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ttl
-REPLY QR RD RA NOERROR
+MATCH all ttl ede=3
+REPLY QR RD RA DO NOERROR
 SECTION QUESTION
 www2.example.com. IN A
 SECTION ANSWER
-www2.example.com. 30 IN A 1.2.3.5
+www2.example.com. 100 IN A 1.2.3.5
 ENTRY_END
 
 ; cache is expired, cachedb has no answer
 STEP 70 QUERY
 ENTRY_BEGIN
-REPLY RD
+REPLY RD DO
 SECTION QUESTION
 www.example.com. IN A
 ENTRY_END
 
 STEP 80 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ttl
-REPLY QR RD RA NOERROR
+MATCH all ttl ede=3
+REPLY QR RD RA DO NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 30 IN A 1.2.3.4
+www.example.com. 123 IN A 1.2.3.4
 ENTRY_END
 
 STEP 90 TRAFFIC
@@ -192,7 +196,7 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN A 1.2.3.4
+www.example.com. 200 IN A 1.2.3.4
 ENTRY_END
 
 ; flush the entry from cache
@@ -213,30 +217,30 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN A 1.2.3.4
+www.example.com. 200 IN A 1.2.3.4
 ENTRY_END
 
 ; it is now expired
-STEP 150 TIME_PASSES ELAPSE 20
+STEP 150 TIME_PASSES ELAPSE 200
 ; flush the entry from cache
 STEP 160 FLUSH_MESSAGE www.example.com. IN A
 
 ; cache has no answer, cachedb is expired
 STEP 170 QUERY
 ENTRY_BEGIN
-REPLY RD
+REPLY RD DO
 SECTION QUESTION
 www.example.com. IN A
 ENTRY_END
 
 STEP 180 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ttl
-REPLY QR RD RA NOERROR
+MATCH all ttl ede=3
+REPLY QR RD RA DO NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 30 IN A 1.2.3.4
+www.example.com. 123 IN A 1.2.3.4
 ENTRY_END
 
 STEP 190 TRAFFIC
@@ -257,7 +261,7 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN A 1.2.3.4
+www.example.com. 200 IN A 1.2.3.4
 ENTRY_END
 
 ; expire the entry in cache
@@ -278,30 +282,30 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN A 1.2.3.4
+www.example.com. 200 IN A 1.2.3.4
 ENTRY_END
 
 ; it is now expired
-STEP 250 TIME_PASSES ELAPSE 20
+STEP 250 TIME_PASSES ELAPSE 200
 ; expire the entry in cache
 STEP 260 EXPIRE_MESSAGE www.example.com. IN A
 
 ; cache is expired, cachedb is expired
 STEP 270 QUERY
 ENTRY_BEGIN
-REPLY RD
+REPLY RD DO
 SECTION QUESTION
 www.example.com. IN A
 ENTRY_END
 
 STEP 280 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ttl
-REPLY QR RD RA NOERROR
+MATCH all ttl ede=3
+REPLY QR RD RA DO NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 30 IN A 1.2.3.4
+www.example.com. 123 IN A 1.2.3.4
 ENTRY_END
 
 STEP 290 TRAFFIC
@@ -322,7 +326,7 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN A 1.2.3.4
+www.example.com. 200 IN A 1.2.3.4
 ENTRY_END
 
 SCENARIO_END
diff --git a/testdata/fwd_0ttlservfail.rpl b/testdata/fwd_0ttlservfail.rpl
index d50d386d4..635ee6db6 100644
--- a/testdata/fwd_0ttlservfail.rpl
+++ b/testdata/fwd_0ttlservfail.rpl
@@ -46,25 +46,10 @@ www.example.com. IN A
 SECTION ANSWER
 ENTRY_END
 
-; enough to pass by the TTL of the servfail answer in cache
+; enough to expire the servfail answer in cache
 STEP 50 TIME_PASSES ELAPSE 5
 
-; this query triggers a prefetch
-STEP 210 QUERY
-ENTRY_BEGIN
-REPLY RD
-SECTION QUESTION
-www.example.com. IN A
-ENTRY_END
-
-STEP 220 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA SERVFAIL
-SECTION QUESTION
-www.example.com. IN A
-SECTION ANSWER
-ENTRY_END
+; Expired SERVFAILS are no longer served from Unbound
 
 ; this query gets the 0ttl answer
 STEP 230 QUERY
@@ -76,7 +61,7 @@ ENTRY_END
 
 STEP 240 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all
+MATCH all ttl
 REPLY QR RD RA NOERROR
 SECTION QUESTION
 www.example.com. IN A
diff --git a/testdata/redis_reconnect_interval.tdir/after.zone b/testdata/redis_reconnect_interval.tdir/after.zone
new file mode 100644
index 000000000..11c268f81
--- /dev/null
+++ b/testdata/redis_reconnect_interval.tdir/after.zone
@@ -0,0 +1,2 @@
+redis.com. IN SOA server. ma.il 1 2 3 4 5
+redis.com. IN A 2.2.2.2
diff --git a/testdata/redis_reconnect_interval.tdir/before.zone b/testdata/redis_reconnect_interval.tdir/before.zone
new file mode 100644
index 000000000..8e50c6267
--- /dev/null
+++ b/testdata/redis_reconnect_interval.tdir/before.zone
@@ -0,0 +1,2 @@
+redis.com. IN SOA server. ma.il 1 2 3 4 5
+redis.com. IN A 1.1.1.1
diff --git a/testdata/redis_reconnect_interval.tdir/redis.conf b/testdata/redis_reconnect_interval.tdir/redis.conf
new file mode 100644
index 000000000..3b80736e2
--- /dev/null
+++ b/testdata/redis_reconnect_interval.tdir/redis.conf
@@ -0,0 +1,583 @@
+###
+###  Settings for this test ###################################################
+###
+
+# Accept connections on the specified port, default is 6379 (IANA #815344).
+# If port 0 is specified Redis will not listen on a TCP socket.
+port 0
+
+# Unix socket.
+#
+# Specify the path for the Unix socket that will be used to listen for
+# incoming connections. There is no default, so Redis will not listen
+# on a unix socket when not specified.
+#
+unixsocket @SOCKET@
+# unixsocketperm 700
+
+# By default Redis does not run as a daemon. Use 'yes' if you need it.
+# Note that Redis will write a pid file in /var/run/redis.pid when daemonized.
+# When Redis is supervised by upstart or systemd, this parameter has no impact.
+daemonize no
+
+# Specify the server verbosity level.
+# This can be one of:
+# debug (a lot of information, useful for development/testing)
+# verbose (many rarely useful info, but not a mess like the debug level)
+# notice (moderately verbose, what you want in production probably)
+# warning (only very important / critical messages are logged)
+# nothing (nothing is logged)
+loglevel notice
+
+# Specify the log file name. Also the empty string can be used to force
+# Redis to log on the standard output. Note that if you use standard
+# output for logging but daemonize, logs will be sent to /dev/null
+logfile @LOGFILE@
+
+# To enable logging to the system logger, just set 'syslog-enabled' to yes,
+# and optionally update the other syslog parameters to suit your needs.
+syslog-enabled no
+
+# Set the number of databases. The default database is DB 0, you can select
+# a different one on a per-connection basis using SELECT <dbid> where
+# dbid is a number between 0 and 'databases'-1
+databases 2
+
+# Snapshotting can be completely disabled with a single empty string argument
+# as in following example:
+#
+save ""
+
+# The working directory.
+#
+# The DB will be written inside this directory, with the filename specified
+# above using the 'dbfilename' configuration directive.
+#
+# The Append Only File will also be created inside this directory.
+#
+# Note that you must specify a directory here, not a file name.
+dir .
+
+###
+###  Rest of the default Redis settings #######################################
+###
+
+bind 127.0.0.1 -::1
+
+# When protected mode is on and the default user has no password, the server
+# only accepts local connections from the IPv4 address (127.0.0.1), IPv6 address
+# (::1) or Unix domain sockets.
+protected-mode yes
+
+# TCP listen() backlog.
+#
+# In high requests-per-second environments you need a high backlog in order
+# to avoid slow clients connection issues. Note that the Linux kernel
+# will silently truncate it to the value of /proc/sys/net/core/somaxconn so
+# make sure to raise both the value of somaxconn and tcp_max_syn_backlog
+# in order to get the desired effect.
+tcp-backlog 511
+
+# Close the connection after a client is idle for N seconds (0 to disable)
+timeout 0
+
+# TCP keepalive.
+# A reasonable value for this option is 300 seconds, which is the new
+# Redis default starting with Redis 3.2.1.
+tcp-keepalive 300
+
+# By default Redis shows an ASCII art logo only when started to log to the
+# standard output and if the standard output is a TTY and syslog logging is
+# disabled. Basically this means that normally a logo is displayed only in
+# interactive sessions.
+#
+# However it is possible to force the pre-4.0 behavior and always show a
+# ASCII art logo in startup logs by setting the following option to yes.
+always-show-logo no
+
+# By default, Redis modifies the process title (as seen in 'top' and 'ps') to
+# provide some runtime information. It is possible to disable this and leave
+# the process name as executed by setting the following to no.
+set-proc-title yes
+
+# When changing the process title, Redis uses the following template to construct
+# the modified title.
+#
+# Template variables are specified in curly brackets. The following variables are
+# supported:
+#
+# {title}           Name of process as executed if parent, or type of child process.
+# {listen-addr}     Bind address or '*' followed by TCP or TLS port listening on, or
+#                   Unix socket if only that's available.
+# {server-mode}     Special mode, i.e. "[sentinel]" or "[cluster]".
+# {port}            TCP port listening on, or 0.
+# {tls-port}        TLS port listening on, or 0.
+# {unixsocket}      Unix domain socket listening on, or "".
+# {config-file}     Name of configuration file used.
+#
+proc-title-template "{title} {listen-addr} {server-mode}"
+
+# Set the local environment which is used for string comparison operations, and
+# also affect the performance of Lua scripts. Empty String indicates the locale
+# is derived from the environment variables.
+#locale-collate ""
+
+# By default Redis will stop accepting writes if RDB snapshots are enabled
+# (at least one save point) and the latest background save failed.
+# This will make the user aware (in a hard way) that data is not persisting
+# on disk properly, otherwise chances are that no one will notice and some
+# disaster will happen.
+#
+# If the background saving process will start working again Redis will
+# automatically allow writes again.
+#
+# However if you have setup your proper monitoring of the Redis server
+# and persistence, you may want to disable this feature so that Redis will
+# continue to work as usual even if there are problems with disk,
+# permissions, and so forth.
+stop-writes-on-bgsave-error yes
+
+# Compress string objects using LZF when dump .rdb databases?
+# By default compression is enabled as it's almost always a win.
+# If you want to save some CPU in the saving child set it to 'no' but
+# the dataset will likely be bigger if you have compressible values or keys.
+rdbcompression yes
+
+# Since version 5 of RDB a CRC64 checksum is placed at the end of the file.
+# This makes the format more resistant to corruption but there is a performance
+# hit to pay (around 10%) when saving and loading RDB files, so you can disable it
+# for maximum performances.
+#
+# RDB files created with checksum disabled have a checksum of zero that will
+# tell the loading code to skip the check.
+rdbchecksum yes
+
+# The filename where to dump the DB
+dbfilename redis.rdb
+
+# Remove RDB files used by replication in instances without persistence
+# enabled. By default this option is disabled, however there are environments
+# where for regulations or other security concerns, RDB files persisted on
+# disk by masters in order to feed replicas, or stored on disk by replicas
+# in order to load them for the initial synchronization, should be deleted
+# ASAP. Note that this option ONLY WORKS in instances that have both AOF
+# and RDB persistence disabled, otherwise is completely ignored.
+#
+# An alternative (and sometimes better) way to obtain the same effect is
+# to use diskless replication on both master and replicas instances. However
+# in the case of replicas, diskless is not always an option.
+rdb-del-sync-files no
+
+# When a replica loses its connection with the master, or when the replication
+# is still in progress, the replica can act in two different ways:
+#
+# 1) if replica-serve-stale-data is set to 'yes' (the default) the replica will
+#    still reply to client requests, possibly with out of date data, or the
+#    data set may just be empty if this is the first synchronization.
+#
+# 2) If replica-serve-stale-data is set to 'no' the replica will reply with error
+#    "MASTERDOWN Link with MASTER is down and replica-serve-stale-data is set to 'no'"
+#    to all data access commands, excluding commands such as:
+#    INFO, REPLICAOF, AUTH, SHUTDOWN, REPLCONF, ROLE, CONFIG, SUBSCRIBE,
+#    UNSUBSCRIBE, PSUBSCRIBE, PUNSUBSCRIBE, PUBLISH, PUBSUB, COMMAND, POST,
+#    HOST and LATENCY.
+#
+replica-serve-stale-data yes
+
+# You can configure a replica instance to accept writes or not. Writing against
+# a replica instance may be useful to store some ephemeral data (because data
+# written on a replica will be easily deleted after resync with the master) but
+# may also cause problems if clients are writing to it because of a
+# misconfiguration.
+#
+# Since Redis 2.6 by default replicas are read-only.
+#
+# Note: read only replicas are not designed to be exposed to untrusted clients
+# on the internet. It's just a protection layer against misuse of the instance.
+# Still a read only replica exports by default all the administrative commands
+# such as CONFIG, DEBUG, and so forth. To a limited extent you can improve
+# security of read only replicas using 'rename-command' to shadow all the
+# administrative / dangerous commands.
+replica-read-only yes
+
+# Replication SYNC strategy: disk or socket.
+#
+# New replicas and reconnecting replicas that are not able to continue the
+# replication process just receiving differences, need to do what is called a
+# "full synchronization". An RDB file is transmitted from the master to the
+# replicas.
+#
+# The transmission can happen in two different ways:
+#
+# 1) Disk-backed: The Redis master creates a new process that writes the RDB
+#                 file on disk. Later the file is transferred by the parent
+#                 process to the replicas incrementally.
+# 2) Diskless: The Redis master creates a new process that directly writes the
+#              RDB file to replica sockets, without touching the disk at all.
+#
+# With disk-backed replication, while the RDB file is generated, more replicas
+# can be queued and served with the RDB file as soon as the current child
+# producing the RDB file finishes its work. With diskless replication instead
+# once the transfer starts, new replicas arriving will be queued and a new
+# transfer will start when the current one terminates.
+#
+# When diskless replication is used, the master waits a configurable amount of
+# time (in seconds) before starting the transfer in the hope that multiple
+# replicas will arrive and the transfer can be parallelized.
+#
+# With slow disks and fast (large bandwidth) networks, diskless replication
+# works better.
+repl-diskless-sync yes
+
+# When diskless replication is enabled, it is possible to configure the delay
+# the server waits in order to spawn the child that transfers the RDB via socket
+# to the replicas.
+#
+# This is important since once the transfer starts, it is not possible to serve
+# new replicas arriving, that will be queued for the next RDB transfer, so the
+# server waits a delay in order to let more replicas arrive.
+#
+# The delay is specified in seconds, and by default is 5 seconds. To disable
+# it entirely just set it to 0 seconds and the transfer will start ASAP.
+repl-diskless-sync-delay 5
+
+# When diskless replication is enabled with a delay, it is possible to let
+# the replication start before the maximum delay is reached if the maximum
+# number of replicas expected have connected. Default of 0 means that the
+# maximum is not defined and Redis will wait the full delay.
+#repl-diskless-sync-max-replicas 0
+
+# -----------------------------------------------------------------------------
+# WARNING: Since in this setup the replica does not immediately store an RDB on
+# disk, it may cause data loss during failovers. RDB diskless load + Redis
+# modules not handling I/O reads may cause Redis to abort in case of I/O errors
+# during the initial synchronization stage with the master.
+# -----------------------------------------------------------------------------
+#
+# Replica can load the RDB it reads from the replication link directly from the
+# socket, or store the RDB to a file and read that file after it was completely
+# received from the master.
+#
+# In many cases the disk is slower than the network, and storing and loading
+# the RDB file may increase replication time (and even increase the master's
+# Copy on Write memory and replica buffers).
+# However, when parsing the RDB file directly from the socket, in order to avoid
+# data loss it's only safe to flush the current dataset when the new dataset is
+# fully loaded in memory, resulting in higher memory usage.
+# For this reason we have the following options:
+#
+# "disabled"    - Don't use diskless load (store the rdb file to the disk first)
+# "swapdb"      - Keep current db contents in RAM while parsing the data directly
+#                 from the socket. Replicas in this mode can keep serving current
+#                 dataset while replication is in progress, except for cases where
+#                 they can't recognize master as having a data set from same
+#                 replication history.
+#                 Note that this requires sufficient memory, if you don't have it,
+#                 you risk an OOM kill.
+# "on-empty-db" - Use diskless load only when current dataset is empty. This is
+#                 safer and avoid having old and new dataset loaded side by side
+#                 during replication.
+repl-diskless-load disabled
+
+# Master send PINGs to its replicas in a predefined interval. It's possible to
+# change this interval with the repl_ping_replica_period option. The default
+# value is 10 seconds.
+#
+# repl-ping-replica-period 10
+
+# The following option sets the replication timeout for:
+#
+# 1) Bulk transfer I/O during SYNC, from the point of view of replica.
+# 2) Master timeout from the point of view of replicas (data, pings).
+# 3) Replica timeout from the point of view of masters (REPLCONF ACK pings).
+#
+# It is important to make sure that this value is greater than the value
+# specified for repl-ping-replica-period otherwise a timeout will be detected
+# every time there is low traffic between the master and the replica. The default
+# value is 60 seconds.
+#
+# repl-timeout 60
+
+# Disable TCP_NODELAY on the replica socket after SYNC?
+#
+# If you select "yes" Redis will use a smaller number of TCP packets and
+# less bandwidth to send data to replicas. But this can add a delay for
+# the data to appear on the replica side, up to 40 milliseconds with
+# Linux kernels using a default configuration.
+#
+# If you select "no" the delay for data to appear on the replica side will
+# be reduced but more bandwidth will be used for replication.
+#
+# By default we optimize for low latency, but in very high traffic conditions
+# or when the master and replicas are many hops away, turning this to "yes" may
+# be a good idea.
+repl-disable-tcp-nodelay no
+
+# The replica priority is an integer number published by Redis in the INFO
+# output. It is used by Redis Sentinel in order to select a replica to promote
+# into a master if the master is no longer working correctly.
+#
+# A replica with a low priority number is considered better for promotion, so
+# for instance if there are three replicas with priority 10, 100, 25 Sentinel
+# will pick the one with priority 10, that is the lowest.
+#
+# However a special priority of 0 marks the replica as not able to perform the
+# role of master, so a replica with priority of 0 will never be selected by
+# Redis Sentinel for promotion.
+#
+# By default the priority is 100.
+replica-priority 100
+
+# ACL LOG
+#
+# The ACL Log tracks failed commands and authentication events associated
+# with ACLs. The ACL Log is useful to troubleshoot failed commands blocked
+# by ACLs. The ACL Log is stored in memory. You can reclaim memory with
+# ACL LOG RESET. Define the maximum entry length of the ACL Log below.
+acllog-max-len 128
+
+lazyfree-lazy-eviction no
+lazyfree-lazy-expire no
+lazyfree-lazy-server-del no
+replica-lazy-flush no
+
+# It is also possible, for the case when to replace the user code DEL calls
+# with UNLINK calls is not easy, to modify the default behavior of the DEL
+# command to act exactly like UNLINK, using the following configuration
+# directive:
+lazyfree-lazy-user-del no
+
+# FLUSHDB, FLUSHALL, SCRIPT FLUSH and FUNCTION FLUSH support both asynchronous and synchronous
+# deletion, which can be controlled by passing the [SYNC|ASYNC] flags into the
+# commands. When neither flag is passed, this directive will be used to determine
+# if the data should be deleted asynchronously.
+lazyfree-lazy-user-flush no
+
+# On Linux, it is possible to hint the kernel OOM killer on what processes
+# should be killed first when out of memory.
+#
+# Enabling this feature makes Redis actively control the oom_score_adj value
+# for all its processes, depending on their role. The default scores will
+# attempt to have background child processes killed before all others, and
+# replicas killed before masters.
+#
+# Redis supports these options:
+#
+# no:       Don't make changes to oom-score-adj (default).
+# yes:      Alias to "relative" see below.
+# absolute: Values in oom-score-adj-values are written as is to the kernel.
+# relative: Values are used relative to the initial value of oom_score_adj when
+#           the server starts and are then clamped to a range of -1000 to 1000.
+#           Because typically the initial value is 0, they will often match the
+#           absolute values.
+oom-score-adj no
+
+# When oom-score-adj is used, this directive controls the specific values used
+# for master, replica and background child processes. Values range -2000 to
+# 2000 (higher means more likely to be killed).
+#
+# Unprivileged processes (not root, and without CAP_SYS_RESOURCE capabilities)
+# can freely increase their value, but not decrease it below its initial
+# settings. This means that setting oom-score-adj to "relative" and setting the
+# oom-score-adj-values to positive values will always succeed.
+oom-score-adj-values 0 200 800
+
+# Usually the kernel Transparent Huge Pages control is set to "madvise" or
+# or "never" by default (/sys/kernel/mm/transparent_hugepage/enabled), in which
+# case this config has no effect. On systems in which it is set to "always",
+# redis will attempt to disable it specifically for the redis process in order
+# to avoid latency problems specifically with fork(2) and CoW.
+# If for some reason you prefer to keep it enabled, you can set this config to
+# "no" and the kernel global to "always".
+disable-thp yes
+
+# By default Redis asynchronously dumps the dataset on disk. This mode is
+# good enough in many applications, but an issue with the Redis process or
+# a power outage may result into a few minutes of writes lost (depending on
+# the configured save points).
+#
+# The Append Only File is an alternative persistence mode that provides
+# much better durability. For instance using the default data fsync policy
+# (see later in the config file) Redis can lose just one second of writes in a
+# dramatic event like a server power outage, or a single write if something
+# wrong with the Redis process itself happens, but the operating system is
+# still running correctly.
+#
+# AOF and RDB persistence can be enabled at the same time without problems.
+# If the AOF is enabled on startup Redis will load the AOF, that is the file
+# with the better durability guarantees.
+#
+# Please check https://redis.io/topics/persistence for more information.
+appendonly no
+
+# The following time is expressed in microseconds, so 1000000 is equivalent
+# to one second. Note that a negative number disables the slow log, while
+# a value of zero forces the logging of every command.
+slowlog-log-slower-than 10000
+
+# There is no limit to this length. Just be aware that it will consume memory.
+# You can reclaim memory used by the slow log with SLOWLOG RESET.
+slowlog-max-len 128
+
+# By default latency monitoring is disabled since it is mostly not needed
+# if you don't have latency issues, and collecting data has a performance
+# impact, that while very small, can be measured under big load. Latency
+# monitoring can easily be enabled at runtime using the command
+# "CONFIG SET latency-monitor-threshold <milliseconds>" if needed.
+latency-monitor-threshold 0
+
+#  By default all notifications are disabled because most users don't need
+#  this feature and the feature has some overhead. Note that if you don't
+#  specify at least one of K or E, no events will be delivered.
+notify-keyspace-events ""
+
+# Hashes are encoded using a memory efficient data structure when they have a
+# small number of entries, and the biggest entry does not exceed a given
+# threshold. These thresholds can be configured using the following directives.
+#hash-max-listpack-entries 512
+#hash-max-listpack-value 64
+
+# Lists are also encoded in a special way to save a lot of space.
+# The number of entries allowed per internal list node can be specified
+# as a fixed maximum size or a maximum number of elements.
+# For a fixed maximum size, use -5 through -1, meaning:
+# -5: max size: 64 Kb  <-- not recommended for normal workloads
+# -4: max size: 32 Kb  <-- not recommended
+# -3: max size: 16 Kb  <-- probably not recommended
+# -2: max size: 8 Kb   <-- good
+# -1: max size: 4 Kb   <-- good
+# Positive numbers mean store up to _exactly_ that number of elements
+# per list node.
+# The highest performing option is usually -2 (8 Kb size) or -1 (4 Kb size),
+# but if your use case is unique, adjust the settings as necessary.
+#list-max-listpack-size -2
+
+# Lists may also be compressed.
+# Compress depth is the number of quicklist ziplist nodes from *each* side of
+# the list to *exclude* from compression.  The head and tail of the list
+# are always uncompressed for fast push/pop operations.  Settings are:
+# 0: disable all list compression
+# 1: depth 1 means "don't start compressing until after 1 node into the list,
+#    going from either the head or tail"
+#    So: [head]->node->node->...->node->[tail]
+#    [head], [tail] will always be uncompressed; inner nodes will compress.
+# 2: [head]->[next]->node->node->...->node->[prev]->[tail]
+#    2 here means: don't compress head or head->next or tail->prev or tail,
+#    but compress all nodes between them.
+# 3: [head]->[next]->[next]->node->node->...->node->[prev]->[prev]->[tail]
+# etc.
+list-compress-depth 0
+
+# Sets have a special encoding when a set is composed
+# of just strings that happen to be integers in radix 10 in the range
+# of 64 bit signed integers.
+# The following configuration setting sets the limit in the size of the
+# set in order to use this special memory saving encoding.
+set-max-intset-entries 512
+
+# Sets containing non-integer values are also encoded using a memory efficient
+# data structure when they have a small number of entries, and the biggest entry
+# does not exceed a given threshold. These thresholds can be configured using
+# the following directives.
+#set-max-listpack-entries 128
+#set-max-listpack-value 64
+
+# Similarly to hashes and lists, sorted sets are also specially encoded in
+# order to save a lot of space. This encoding is only used when the length and
+# elements of a sorted set are below the following limits:
+#zset-max-listpack-entries 128
+#zset-max-listpack-value 64
+
+# HyperLogLog sparse representation bytes limit. The limit includes the
+# 16 bytes header. When a HyperLogLog using the sparse representation crosses
+# this limit, it is converted into the dense representation.
+#
+# A value greater than 16000 is totally useless, since at that point the
+# dense representation is more memory efficient.
+#
+# The suggested value is ~ 3000 in order to have the benefits of
+# the space efficient encoding without slowing down too much PFADD,
+# which is O(N) with the sparse encoding. The value can be raised to
+# ~ 10000 when CPU is not a concern, but space is, and the data set is
+# composed of many HyperLogLogs with cardinality in the 0 - 15000 range.
+hll-sparse-max-bytes 3000
+
+# Streams macro node max size / items. The stream data structure is a radix
+# tree of big nodes that encode multiple items inside. Using this configuration
+# it is possible to configure how big a single node can be in bytes, and the
+# maximum number of items it may contain before switching to a new node when
+# appending new stream entries. If any of the following settings are set to
+# zero, the limit is ignored, so for instance it is possible to set just a
+# max entries limit by setting max-bytes to 0 and max-entries to the desired
+# value.
+stream-node-max-bytes 4096
+stream-node-max-entries 100
+
+# Active rehashing uses 1 millisecond every 100 milliseconds of CPU time in
+# order to help rehashing the main Redis hash table (the one mapping top-level
+# keys to values). The hash table implementation Redis uses (see dict.c)
+# performs a lazy rehashing: the more operation you run into a hash table
+# that is rehashing, the more rehashing "steps" are performed, so if the
+# server is idle the rehashing is never complete and some more memory is used
+# by the hash table.
+#
+# The default is to use this millisecond 10 times every second in order to
+# actively rehash the main dictionaries, freeing memory when possible.
+#
+# If unsure:
+# use "activerehashing no" if you have hard latency requirements and it is
+# not a good thing in your environment that Redis can reply from time to time
+# to queries with 2 milliseconds delay.
+#
+# use "activerehashing yes" if you don't have such hard requirements but
+# want to free memory asap when possible.
+activerehashing yes
+
+# The client output buffer limits can be used to force disconnection of clients
+# that are not reading data from the server fast enough for some reason (a
+# common reason is that a Pub/Sub client can't consume messages as fast as the
+# publisher can produce them).
+#
+# Both the hard or the soft limit can be disabled by setting them to zero.
+client-output-buffer-limit normal 0 0 0
+client-output-buffer-limit replica 256mb 64mb 60
+client-output-buffer-limit pubsub 32mb 8mb 60
+
+# Redis calls an internal function to perform many background tasks, like
+# closing connections of clients in timeout, purging expired keys that are
+# never requested, and so forth.
+#
+# Not all tasks are performed with the same frequency, but Redis checks for
+# tasks to perform according to the specified "hz" value.
+#
+# By default "hz" is set to 10. Raising the value will use more CPU when
+# Redis is idle, but at the same time will make Redis more responsive when
+# there are many keys expiring at the same time, and timeouts may be
+# handled with more precision.
+#
+# The range is between 1 and 500, however a value over 100 is usually not
+# a good idea. Most users should use the default of 10 and raise this up to
+# 100 only in environments where very low latency is required.
+hz 10
+
+# When dynamic HZ is enabled, the actual configured HZ will be used
+# as a baseline, but multiples of the configured HZ value will be actually
+# used as needed once more clients are connected. In this way an idle
+# instance will use very little CPU time while a busy instance will be
+# more responsive.
+dynamic-hz yes
+
+# When a child rewrites the AOF file, if the following option is enabled
+# the file will be fsync-ed every 4 MB of data generated. This is useful
+# in order to commit the file to the disk more incrementally and avoid
+# big latency spikes.
+aof-rewrite-incremental-fsync yes
+
+# When redis saves RDB file, if the following option is enabled
+# the file will be fsync-ed every 4 MB of data generated. This is useful
+# in order to commit the file to the disk more incrementally and avoid
+# big latency spikes.
+rdb-save-incremental-fsync yes
+
+# Jemalloc background thread for purging will be enabled by default
+jemalloc-bg-thread yes
diff --git a/testdata/redis_reconnect_interval.tdir/redis_reconnect_interval.conf b/testdata/redis_reconnect_interval.tdir/redis_reconnect_interval.conf
new file mode 100644
index 000000000..eb76de8db
--- /dev/null
+++ b/testdata/redis_reconnect_interval.tdir/redis_reconnect_interval.conf
@@ -0,0 +1,33 @@
+server:
+	verbosity: 7
+	num-threads: 1
+	interface: 127.0.0.1
+	port: @PORT@
+	use-syslog: no
+	directory: ""
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	module-config: "cachedb iterator"
+	root-key-sentinel: no
+	trust-anchor-signaling: no
+	log-time-ascii: yes
+	log-time-iso: yes
+cachedb:
+        backend: redis
+        redis-server-path: @REDIS_SOCKET@
+        redis-replica-server-path: @REDIS_REPLICA_SOCKET@
+auth-zone:
+	name: "redis.com"
+	for-upstream: yes
+	for-downstream: no
+	zonefile: "redis.zone"
+remote-control:
+	control-enable: yes
+	control-interface: 127.0.0.1
+	# control-interface: ::1
+	control-port: @CONTROL_PORT@
+	server-key-file: "unbound_server.key"
+	server-cert-file: "unbound_server.pem"
+	control-key-file: "unbound_control.key"
+	control-cert-file: "unbound_control.pem"
diff --git a/testdata/redis_reconnect_interval.tdir/redis_reconnect_interval.dsc b/testdata/redis_reconnect_interval.tdir/redis_reconnect_interval.dsc
new file mode 100644
index 000000000..b07612d33
--- /dev/null
+++ b/testdata/redis_reconnect_interval.tdir/redis_reconnect_interval.dsc
@@ -0,0 +1,16 @@
+BaseName: redis_reconnect_interval
+Version: 1.0
+Description: Test redis reconnect interval
+CreationDate: Thu 24 July 09:29:09 CEST 2025
+Maintainer: Wouter Wijngaards
+Category:
+Component:
+CmdDepends:
+Depends:
+Help:
+Pre: redis_reconnect_interval.pre
+Post: redis_reconnect_interval.post
+Test: redis_reconnect_interval.test
+AuxFiles:
+Passed:
+Failure:
diff --git a/testdata/redis_reconnect_interval.tdir/redis_reconnect_interval.post b/testdata/redis_reconnect_interval.tdir/redis_reconnect_interval.post
new file mode 100644
index 000000000..fc48d7e38
--- /dev/null
+++ b/testdata/redis_reconnect_interval.tdir/redis_reconnect_interval.post
@@ -0,0 +1,18 @@
+# #-- redis_reconnect_interval.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+kill_pid $REDIS_PID
+kill_pid $REDIS_REPLICA_PID
+kill_pid $UNBOUND_PID
+echo "> cat logfiles"
+echo "redis server.log"
+cat server.log
+echo "redis replica.log"
+cat replica.log
+echo "unbound.log"
+cat unbound.log
diff --git a/testdata/redis_reconnect_interval.tdir/redis_reconnect_interval.pre b/testdata/redis_reconnect_interval.tdir/redis_reconnect_interval.pre
new file mode 100644
index 000000000..1c7a7f397
--- /dev/null
+++ b/testdata/redis_reconnect_interval.tdir/redis_reconnect_interval.pre
@@ -0,0 +1,46 @@
+# #-- redis_reconnect_interval.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+. ../common.sh
+
+if grep "define USE_REDIS 1" $PRE/config.h; then echo test enabled; else skip_test "test skipped"; fi
+
+get_random_port 2
+UNBOUND_PORT=$RND_PORT
+CONTROL_PORT=$(($RND_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "CONTROL_PORT=$CONTROL_PORT" >> .tpkg.var.test
+
+REDIS_SOCKET=server.sock
+REDIS_REPLICA_SOCKET=replica.sock
+echo "REDIS_SOCKET=$REDIS_SOCKET" >> .tpkg.var.test
+echo "REDIS_REPLICA_SOCKET=$REDIS_REPLICA_SOCKET" >> .tpkg.var.test
+
+# start redis
+sed -e 's/@SOCKET\@/'$REDIS_SOCKET'/' -e 's/@LOGFILE\@/server.log/' < redis.conf > server.conf
+redis-server server.conf &
+REDIS_PID=$!
+echo "REDIS_PID=$REDIS_PID" >> .tpkg.var.test
+
+# start redis replica
+sed -e 's/@SOCKET\@/'$REDIS_REPLICA_SOCKET'/' -e 's/@LOGFILE\@/replica.log/' < redis.conf > replica.conf
+redis-server replica.conf &
+REDIS_REPLICA_PID=$!
+echo "REDIS_REPLICA_PID=$REDIS_REPLICA_PID" >> .tpkg.var.test
+
+# Copy initial zonefile
+cp before.zone redis.zone
+
+# make config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@REDIS_SOCKET\@/'$REDIS_SOCKET'/' -e 's/@REDIS_REPLICA_SOCKET\@/'$REDIS_REPLICA_SOCKET'/' -e 's/@CONTROL_PORT\@/'$CONTROL_PORT'/' < redis_reconnect_interval.conf > ub.conf
+# start unbound in the background
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_unbound_up unbound.log
diff --git a/testdata/redis_reconnect_interval.tdir/redis_reconnect_interval.test b/testdata/redis_reconnect_interval.tdir/redis_reconnect_interval.test
new file mode 100644
index 000000000..ac15f50b0
--- /dev/null
+++ b/testdata/redis_reconnect_interval.tdir/redis_reconnect_interval.test
@@ -0,0 +1,121 @@
+# #-- redis_reconnect_interval.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+. ../common.sh
+# do the test
+
+# Check number of keys in the db
+# $1: socket to connect to
+# $2: expected number of keys
+redis_cli_check_keys () {
+	echo "> redis-cli connecting to $1 to check number of keys; expecting $2"
+	keys=$(redis-cli --no-raw -s $1 keys "*" | grep -vF empty | wc -l)
+	if test $keys -ne $2
+	then
+		echo "Expected $2 keys, got $keys"
+		exit 1
+	fi
+	echo "OK"
+}
+
+# Query and check the expected result
+# $1: query
+# $2: expected answer
+expect_answer () {
+	echo "> dig @127.0.0.1 -p $UNBOUND_PORT $1"
+	dig @127.0.0.1 -p $UNBOUND_PORT $1 > tmp.answer
+	if ! grep -F $2 tmp.answer
+	then
+		echo "Expected $2 in the answer, got:"
+		cat tmp.answer
+		exit 1
+	fi
+	echo "OK"
+}
+
+# Start test
+
+# check Redis server has no keys
+redis_cli_check_keys $REDIS_SOCKET 0
+
+# check Redis replica server has no keys
+redis_cli_check_keys $REDIS_REPLICA_SOCKET 0
+
+# query and check answer
+expect_answer redis.com 1.1.1.1
+
+# check Redis server has 1 key
+redis_cli_check_keys $REDIS_SOCKET 1
+
+# check Redis replica server has no keys
+redis_cli_check_keys $REDIS_REPLICA_SOCKET 0
+
+# change auth zone and reload
+cp after.zone redis.zone
+echo "$PRE/unbound-control -c ub.conf reload"
+$PRE/unbound-control -c ub.conf reload
+if test $? -ne 0; then
+	echo "wrong exit value after success"
+	exit 1
+fi
+
+# query and check answer
+# we are writing to server but reading from replica; which is not actually
+# replicating so the new answer will come through while overwriting the record
+# in the server.
+expect_answer redis.com 2.2.2.2
+
+# check Redis server has 1 key
+redis_cli_check_keys $REDIS_SOCKET 1
+
+# check Redis replica server has no keys
+redis_cli_check_keys $REDIS_REPLICA_SOCKET 0
+
+echo "> OK"
+
+# take down the redis server and observe reconnect attempts.
+# first the replica that it tries to read from.
+kill_pid $REDIS_REPLICA_PID
+$PRE/unbound-control -c ub.conf reload
+expect_answer redis.com 2.2.2.2
+# some more queries to exceed the limit on reconnects.
+expect_answer d1.redis.com NXDOMAIN
+expect_answer d2.redis.com NXDOMAIN
+expect_answer d3.redis.com NXDOMAIN
+expect_answer d4.redis.com NXDOMAIN
+expect_answer d5.redis.com NXDOMAIN
+# it has entered the wait period
+sleep 2
+expect_answer d6.redis.com NXDOMAIN
+
+kill_pid $REDIS_PID
+$PRE/unbound-control -c ub.conf reload
+expect_answer redis.com 2.2.2.2
+expect_answer d1.redis.com NXDOMAIN
+expect_answer d2.redis.com NXDOMAIN
+expect_answer d3.redis.com NXDOMAIN
+expect_answer d4.redis.com NXDOMAIN
+expect_answer d5.redis.com NXDOMAIN
+# it has entered the wait period
+sleep 2
+expect_answer d6.redis.com NXDOMAIN
+
+# bring up the redis server again.
+redis-server server.conf &
+REDIS_PID=$!
+echo "REDIS_PID=$REDIS_PID" >> .tpkg.var.test
+redis-server replica.conf &
+REDIS_REPLICA_PID=$!
+echo "REDIS_REPLICA_PID=$REDIS_REPLICA_PID" >> .tpkg.var.test
+
+expect_answer d7.redis.com NXDOMAIN
+expect_answer d8.redis.com NXDOMAIN
+sleep 2
+expect_answer d9.redis.com NXDOMAIN
+expect_answer d10.redis.com NXDOMAIN
+
+exit 0
diff --git a/testdata/redis_reconnect_interval.tdir/unbound_control.key b/testdata/redis_reconnect_interval.tdir/unbound_control.key
new file mode 100644
index 000000000..753a4ef61
--- /dev/null
+++ b/testdata/redis_reconnect_interval.tdir/unbound_control.key
@@ -0,0 +1,39 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIG4gIBAAKCAYEAstEp+Pyh8XGrtZ77A4FhYjvbeB3dMa7Q2rGWxobzlA9przhA
+1aChAvUtCOAuM+rB6NTNB8YWfZJbQHawyMNpmC77cg6vXLYCGUQHZyAqidN049RJ
+F5T7j4N8Vniv17LiRdr0S6swy4PRvEnIPPV43EQHZqC5jVvHsKkhIfmBF/Dj5TXR
+ypeawWV/m5jeU6/4HRYMfytBZdO1mPXuWLh0lgbQ4SCbgrOUVD3rniMk1yZIbQOm
+vlDHYqekjDb/vOW2KxUQLG04aZMJ1mWfdbwG0CKQkSjISEDZ1l76vhM6mTM0fwXb
+IvyFZ9yPPCle1mF5aSlxS2cmGuGVSRQaw8XF9fe3a9ACJJTr33HdSpyaZkKRAUzL
+cKqLCl323daKv3NwwAT03Tj4iQM416ASMoiyfFa/2GWTKQVjddu8Crar7tGaf5xr
+lig4DBmrBvdYA3njy72/RD71hLwmlRoCGU7dRuDr9O6KASUm1Ri91ONZ/qdjMvov
+15l2vj4GV+KXR00dAgMBAAECggGAHepIL1N0dEQkCdpy+/8lH54L9WhpnOo2HqAf
+LU9eaKK7d4jdr9+TkD8cLaPzltPrZNxVALvu/0sA4SP6J1wpyj/x6P7z73qzly5+
+Xo5PD4fEwmi9YaiW/UduAblnEZrnp/AddptJKoL/D5T4XtpiQddPtael4zQ7kB57
+YIexRSQTvEDovA/o3/nvA0TrzOxfgd4ycQP3iOWGN/TMzyLsvjydrUwbOB567iz9
+whL3Etdgvnwh5Sz2blbFfH+nAR8ctvFFz+osPvuIVR21VMEI6wm7kTpSNnQ6sh/c
+lrLb/bTADn4g7z/LpIZJ+MrLvyEcoqValrLYeFBhM9CV8woPxvkO2P3pU47HVGax
+tC7GV6a/kt5RoKFd/TNdiA3OC7NGZtaeXv9VkPf4fVwBtSO9d5ZZXTGEynDD/rUQ
+U4KFJe6OD23APjse08HiiKqTPhsOneOONU67iqoaTdIkT2R4EdlkVEDpXVtWb+G9
+Q+IqYzVljlzuyHrhWXLJw/FMa2aBAoHBAOnZbi4gGpH+P6886WDWVgIlTccuXoyc
+Mg9QQYk9UDeXxL0AizR5bZy49Sduegz9vkHpAiZARQsUnizHjZ8YlRcrmn4t6tx3
+ahTIKAjdprnxJfYINM580j8CGbXvX5LhIlm3O267D0Op+co3+7Ujy+cjsIuFQrP+
+1MqMgXSeBjzC1APivmps7HeFE+4w0k2PfN5wSMDNCzLo99PZuUG5XZ93OVOS5dpN
+b+WskdcD8NOoJy/X/5A08veEI/jYO/DyqQKBwQDDwUQCOWf41ecvJLtBHKmEnHDz
+ftzHino9DRKG8a9XaN4rmetnoWEaM2vHGX3pf3mwH+dAe8vJdAQueDhBKYeEpm6C
+TYNOpou1+Zs5s99BilCTNYo8fkMOAyqwRwmz9zgHS6QxXuPwsghKefLJGt6o6RFF
+tfWVTfLlYJ+I3GQe3ySsk3wjVz4oUTKiyiq5+KzD+HhEkS7u+RQ7Z0ZI2xd2cF8Y
+aN2hjKDpcOiFf3CDoqka5D1qMNLgIHO52AHww1UCgcA1h7o7AMpURRka6hyaODY0
+A4oMYEbwdQjYjIyT998W+rzkbu1us6UtzQEBZ760npkgyU/epbOoV63lnkCC/MOU
+LD0PST+L/CHiY/cWIHb79YG1EifUZKpUFg0Aoq0EGFkepF0MefGCkbRGYA5UZr9U
+R80wAu9D+L+JJiS0J0BSRF74DL196zUuHt5zFeXuLzxsRtPAnq9DliS08BACRYZy
+7H3I7cWD9Vn5/0jbKWHFcaaWwyETR6uekTcSzZzbCRECgcBeoE3/xUA9SSk34Mmj
+7/cB4522Ft0imA3+9RK/qJTZ7Bd5fC4PKjOGNtUiqW/0L2rjeIiQ40bfWvWqgPKw
+jSK1PL6uvkl6+4cNsFsYyZpiVDoe7wKju2UuoNlB3RUTqa2r2STFuNj2wRjA57I1
+BIgdnox65jqQsd14g/yaa+75/WP9CE45xzKEyrtvdcqxm0Pod3OrsYK+gikFjiar
+kT0GQ8u0QPzh2tjt/2ZnIfOBrl+QYERP0MofDZDjhUdq2wECgcB0Lu841+yP5cdR
+qbJhXO4zJNh7oWNcJlOuQp3ZMNFrA1oHpe9pmLukiROOy01k9WxIMQDzU5GSqRv3
+VLkYOIcbhJ3kClKAcM3j95SkKbU2H5/RENb3Ck52xtl4pNU1x/3PnVFZfDVuuHO9
+MZ9YBcIeK98MyP2jr5JtFKnOyPE7xKq0IHIhXadpbc2wjje5FtZ1cUtMyEECCXNa
+C1TpXebHGyXGpY9WdWXhjdE/1jPvfS+uO5WyuDpYPr339gsdq1g=
+-----END RSA PRIVATE KEY-----
diff --git a/testdata/redis_reconnect_interval.tdir/unbound_control.pem b/testdata/redis_reconnect_interval.tdir/unbound_control.pem
new file mode 100644
index 000000000..a1edf7017
--- /dev/null
+++ b/testdata/redis_reconnect_interval.tdir/unbound_control.pem
@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDszCCAhsCFGD5193whHQ2bVdzbaQfdf1gc4SkMA0GCSqGSIb3DQEBCwUAMBIx
+EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMjMwWhcNNDAwMzI1MTMzMjMw
+WjAaMRgwFgYDVQQDDA91bmJvdW5kLWNvbnRyb2wwggGiMA0GCSqGSIb3DQEBAQUA
+A4IBjwAwggGKAoIBgQCy0Sn4/KHxcau1nvsDgWFiO9t4Hd0xrtDasZbGhvOUD2mv
+OEDVoKEC9S0I4C4z6sHo1M0HxhZ9kltAdrDIw2mYLvtyDq9ctgIZRAdnICqJ03Tj
+1EkXlPuPg3xWeK/XsuJF2vRLqzDLg9G8Scg89XjcRAdmoLmNW8ewqSEh+YEX8OPl
+NdHKl5rBZX+bmN5Tr/gdFgx/K0Fl07WY9e5YuHSWBtDhIJuCs5RUPeueIyTXJkht
+A6a+UMdip6SMNv+85bYrFRAsbThpkwnWZZ91vAbQIpCRKMhIQNnWXvq+EzqZMzR/
+Bdsi/IVn3I88KV7WYXlpKXFLZyYa4ZVJFBrDxcX197dr0AIklOvfcd1KnJpmQpEB
+TMtwqosKXfbd1oq/c3DABPTdOPiJAzjXoBIyiLJ8Vr/YZZMpBWN127wKtqvu0Zp/
+nGuWKDgMGasG91gDeePLvb9EPvWEvCaVGgIZTt1G4Ov07ooBJSbVGL3U41n+p2My
++i/XmXa+PgZX4pdHTR0CAwEAATANBgkqhkiG9w0BAQsFAAOCAYEAd++Wen6l8Ifj
+4h3p/y16PhSsWJWuJ4wdNYy3/GM84S26wGjzlEEwiW76HpH6VJzPOiBAeWnFKE83
+hFyetEIxgJeIPbcs9ZP/Uoh8GZH9tRISBSN9Hgk2Slr9llo4t1H0g/XTgA5HqMQU
+9YydlBh43G7Vw3FVwh09OM6poNOGQKNc/tq2/QdKeUMtyBbLWpRmjH5XcCT35fbn
+ZiVOUldqSHD4kKrFO4nJYXZyipRbcXybsLiX9GP0GLemc3IgIvOXyJ2RPp06o/SJ
+pzlMlkcAfLJaSuEW57xRakhuNK7m051TKKzJzIEX+NFYOVdafFHS8VwGrYsdrFvD
+72tMfu+Fu55y3awdWWGc6YlaGogZiuMnJkvQphwgn+5qE/7CGEckoKEsH601rqIZ
+muaIc85+nEcHJeijd/ZlBN9zeltjFoMuqTUENgmv8+tUAdVm/UMY9Vjme6b43ydP
+uv6DS02+k9z8toxXworLiPr94BGaiGV1NxgwZKLZigYJt/Fi2Qte
+-----END CERTIFICATE-----
diff --git a/testdata/redis_reconnect_interval.tdir/unbound_server.key b/testdata/redis_reconnect_interval.tdir/unbound_server.key
new file mode 100644
index 000000000..370a7bbb2
--- /dev/null
+++ b/testdata/redis_reconnect_interval.tdir/unbound_server.key
@@ -0,0 +1,39 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIG5AIBAAKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI
+0x41iG32a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+Nqq
+GRS7XVQ24vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Z
+uh9MDgotaBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8K
+WaBe1ca4TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5
+FzUReSXZuTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xP
+q6O9UPj4+nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XL
+A5UoZgRzXgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP
+7kFZSngxdy1+A/bNAgMBAAECggGBALpTOIqQwVg4CFBylL/a8K1IWJTI/I65sklf
+XxYL7G7SB2HlEJ//z+E+F0+S4Vlao1vyLQ5QkgE82pAUB8FoMWvY1qF0Y8A5wtm6
+iZSGk4OLK488ZbT8Ii9i+AGKgPe2XbVxsJwj8N4k7Zooqec9hz73Up8ATEWJkRz7
+2u7oMGG4z91E0PULA64dOi3l/vOQe5w/Aa+CwVbAWtI05o7kMvQEBMDJn6C7CByo
+MB5op9wueJMnz7PM7hns+U7Dy6oE4ljuolJUy51bDzFWwoM54cRoQqLFNHd8JVQj
+WxldCkbfF43iyprlsEcUrTyUjtdA+ZeiG39vg/mtdmgNpGmdupHJZQvSuG8IcVlz
+O+eMSeQS1QXPD6Ik8UK4SU0h+zOl8xIWtRrsxQuh4fnTN40udm/YUWl/6gOebsBI
+IrVLlKGqJSfB3tMjpCRqdTzJ0dA9keVpkqm2ugZkxEf1+/efq/rFIQ2pUBLCqNTN
+qpNqruK8y8FphP30I2uI4Ej2UIB8AQKBwQDd2Yptj2FyDyaXCycsyde0wYkNyzGU
+dRnzdibfHnMZwjgTjwAwgIUBVIS8H0/z7ZJQKN7osJfddMrtjJtYYUk9g/dCpHXs
+bNh2QSoWah3FdzNGuWd0iRf9+LFxhjAAMo/FS8zFJAJKrFsBdCGTfFUMdsLC0bjr
+YjiWBuvV72uKf8XIZX5KIZruKdWBBcWukcb21R1UDyFYyXRBsly5XHaIYKZql3km
+7pV7MKWO0IYgHbHIqGUqPQlzZ/lkunS1jKECgcEA23wHffD6Ou9/x3okPx2AWpTr
+gh8rgqbyo6hQkBW5Y90Wz824cqaYebZDaBR/xlVx/YwjKkohv8Bde2lpH/ZxRZ1Z
+5Sk2s6GJ/vU0L9RsJZgCgj4L6Coal1NMxuZtCXAlnOpiCdxSZgfqbshbTVz30KsG
+ZJG361Cua1ScdAHxlZBxT52/1Sm0zRC2hnxL7h4qo7Idmtzs40LAJvYOKekR0pPN
+oWeJfra7vgx/jVNvMFWoOoSLpidVO4g+ot4ery6tAoHAdW3rCic1C2zdnmH28Iw+
+s50l8Lk3mz+I5wgJd1zkzCO0DxZIoWPGA3g7cmCYr6N3KRsZMs4W9NAXgjpFGDkW
+zYsG3K21BdpvkdjYcFjnPVjlOXB2RIc0vehf9Jl02wXoeCSxVUDEPcaRvWk9RJYx
+ZpGOchUU7vNkxHURbIJ4yCzuAi9G8/Jp0dsu+kaV5tufF5SjG5WOrzKjaQsCbdN1
+oqaWMCHRrTvov/Z2C+xwsptFOdN5CSyZzg6hQiI4GMlBAoHAXyb6KINcOEi0YMp3
+BFXJ23tMTnEs78tozcKeipigcsbaqORK3omS+NEnj+uzKUzJyl4CsMbKstK2tFYS
+mSTCHqgE3PBtIpsZtEqhgUraR8IK9GPpzZDTTl9ynZgwFTNlWw3RyuyVXF56J+T8
+kCGJ3hEHCHqT/ZRQyX85BKIDFhA0z4tYKxWVqIFiYBNq56R0X9tMMmMs36mEnF93
+7Ht6mowxTZQRa7nU0qOgeKh/P7ki4Zus3y+WJ+T9IqahLtlRAoHBAIhqMrcxSAB8
+RpB9jukJlAnidw2jCMPgrFE8tP0khhVvGrXMldxAUsMKntDIo8dGCnG1KTcWDI0O
+jepvSPHSsxVLFugL79h0eVIS5z4huW48i9xgU8VlHdgAcgEPIAOFcOw2BCu/s0Vp
+O+MM/EyUOdo3NsibB3qc/GJI6iNBYS7AljYEVo6rXo5V/MZvZUF4vClen6Obzsre
+MTTb+4sJjfqleWuvr1XNMeu2mBfXBQkWGZP1byBK0MvD/aQ2PWq92A==
+-----END RSA PRIVATE KEY-----
diff --git a/testdata/redis_reconnect_interval.tdir/unbound_server.pem b/testdata/redis_reconnect_interval.tdir/unbound_server.pem
new file mode 100644
index 000000000..986807310
--- /dev/null
+++ b/testdata/redis_reconnect_interval.tdir/unbound_server.pem
@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDqzCCAhMCFBHWXeQ6ZIa9QcQbXLFfC6tj+KA+MA0GCSqGSIb3DQEBCwUAMBIx
+EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMjI5WhcNNDAwMzI1MTMzMjI5
+WjASMRAwDgYDVQQDDAd1bmJvdW5kMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIB
+igKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI0x41iG32
+a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+NqqGRS7XVQ2
+4vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Zuh9MDgot
+aBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8KWaBe1ca4
+TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5FzUReSXZ
+uTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xPq6O9UPj4
++nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XLA5UoZgRz
+XgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP7kFZSngx
+dy1+A/bNAgMBAAEwDQYJKoZIhvcNAQELBQADggGBABunf93MKaCUHiZgnoOTinsW
+84/EgInrgtKzAyH+BhnKkJOhhR0kkIAx5d9BpDlaSiRTACFon9moWCgDIIsK/Ar7
+JE0Kln9cV//wiiNoFU0O4mnzyGUIMvlaEX6QHMJJQYvL05+w/3AAcf5XmMJtR5ca
+fJ8FqvGC34b2WxX9lTQoyT52sRt+1KnQikiMEnEyAdKktMG+MwKsFDdOwDXyZhZg
+XZhRrfX3/NVJolqB6EahjWIGXDeKuSSKZVtCyib6LskyeMzN5lcRfvubKDdlqFVF
+qlD7rHBsKhQUWK/IO64mGf7y/de+CgHtED5vDvr/p2uj/9sABATfbrOQR3W/Of25
+sLBj4OEfrJ7lX8hQgFaxkMI3x6VFT3W8dTCp7xnQgb6bgROWB5fNEZ9jk/gjSRmD
+yIU+r0UbKe5kBk/CmZVFXL2TyJ92V5NYEQh8V4DGy19qZ6u/XKYyNJL4ocs35GGe
+CA8SBuyrmdhx38h1RHErR2Skzadi1S7MwGf1y431fQ==
+-----END CERTIFICATE-----
diff --git a/testdata/respip_dns64_lookup.rpl b/testdata/respip_dns64_lookup.rpl
new file mode 100644
index 000000000..df6e56121
--- /dev/null
+++ b/testdata/respip_dns64_lookup.rpl
@@ -0,0 +1,522 @@
+; config options
+server:
+	target-fetch-policy: "0 0 0 0 0"
+	qname-minimisation: no
+	minimal-responses: yes
+	; respip is before dns64 in the module list.
+	module-config: "respip dns64 validator iterator"
+	dns64-prefix: 64:ff9b::0/96
+	response-ip: 10.20.30.42/32 always_refuse
+	response-ip: 10.20.30.43/32 redirect
+	response-ip-data: 10.20.30.43/32 "A 4.5.6.3"
+	response-ip: 5.6.7.9/32 redirect
+	response-ip-data: 5.6.7.9/32 "A 4.5.6.7"
+	response-ip: 5.6.7.10/32 always_nxdomain
+	response-ip: 64:ff9b::506:70B/128 redirect
+	response-ip-data: 64:ff9b::506:70B/128 "AAAA 2001:db8::4"
+
+rpz:
+	name: "rpz.example.com."
+	rpz-log: yes
+	zonefile:
+TEMPFILE_NAME rpz.example.com
+TEMPFILE_CONTENTS rpz.example.com
+$ORIGIN example.com.
+rpz	3600	IN	SOA	ns1.rpz.example.com. hostmaster.rpz.example.com. (
+		1379078166 28800 7200 604800 7200 )
+	3600	IN	NS	ns1.rpz.example.com.
+	3600	IN	NS	ns2.rpz.example.com.
+$ORIGIN rpz.example.com.
+32.44.30.20.10.rpz-ip CNAME .
+32.12.7.6.5.rpz-ip CNAME .
+32.13.7.6.5.rpz-ip A 4.5.6.13
+32.14.7.6.5.rpz-ip CNAME alias.example.com.
+TEMPFILE_END
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129		# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test respip and dns64 lookup.
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 1000
+	ADDRESS 193.0.14.129
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 1000
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN	A	192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.	IN	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 1000
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.	IN	A	1.2.3.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A 10.20.30.40
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www2.example.com. IN A
+SECTION ANSWER
+www2.example.com. IN A 10.20.30.42
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www3.example.com. IN A
+SECTION ANSWER
+www3.example.com. IN A 10.20.30.43
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www4.example.com. IN A
+SECTION ANSWER
+www4.example.com. IN A 10.20.30.44
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ip4.example.com. IN AAAA
+SECTION ANSWER
+; NO AAAA present
+SECTION AUTHORITY
+example.com. IN SOA a. b. 1 2 3 4 5
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ip4.example.com. IN A
+SECTION ANSWER
+ip4.example.com. IN A 5.6.7.8
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ip4-2.example.com. IN AAAA
+SECTION ANSWER
+; NO AAAA present
+SECTION AUTHORITY
+example.com. IN SOA a. b. 1 2 3 4 5
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ip4-2.example.com. IN A
+SECTION ANSWER
+ip4-2.example.com. IN A 5.6.7.9
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ip4-3.example.com. IN AAAA
+SECTION ANSWER
+; NO AAAA present
+SECTION AUTHORITY
+example.com. IN SOA a. b. 1 2 3 4 5
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ip4-3.example.com. IN A
+SECTION ANSWER
+ip4-3.example.com. IN A 5.6.7.10
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ip4-4.example.com. IN AAAA
+SECTION ANSWER
+; NO AAAA present
+SECTION AUTHORITY
+example.com. IN SOA a. b. 1 2 3 4 5
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ip4-4.example.com. IN A
+SECTION ANSWER
+ip4-4.example.com. IN A 5.6.7.11
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ip4-5.example.com. IN AAAA
+SECTION ANSWER
+; NO AAAA present
+SECTION AUTHORITY
+example.com. IN SOA a. b. 1 2 3 4 5
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ip4-5.example.com. IN A
+SECTION ANSWER
+ip4-5.example.com. IN A 5.6.7.12
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ip4-6.example.com. IN AAAA
+SECTION ANSWER
+; NO AAAA present
+SECTION AUTHORITY
+example.com. IN SOA a. b. 1 2 3 4 5
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ip4-6.example.com. IN A
+SECTION ANSWER
+ip4-6.example.com. IN A 5.6.7.13
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ip4-7.example.com. IN AAAA
+SECTION ANSWER
+; NO AAAA present
+SECTION AUTHORITY
+example.com. IN SOA a. b. 1 2 3 4 5
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ip4-7.example.com. IN A
+SECTION ANSWER
+ip4-7.example.com. IN A 5.6.7.14
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+alias.example.com. IN A
+SECTION ANSWER
+alias.example.com. IN A 4.5.6.14
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+; The query is unaltered.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A 10.20.30.40
+ENTRY_END
+
+STEP 20 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www2.example.com. IN A
+ENTRY_END
+
+; The query is altered by respip, A query refused.
+STEP 30 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA REFUSED
+SECTION QUESTION
+www2.example.com. IN A
+SECTION ANSWER
+ENTRY_END
+
+STEP 40 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www3.example.com. IN A
+ENTRY_END
+
+; The query is altered by respip, with redirect.
+STEP 50 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www3.example.com. IN A
+SECTION ANSWER
+www3.example.com. IN A 4.5.6.3
+ENTRY_END
+
+STEP 60 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+ip4.example.com. IN AAAA
+ENTRY_END
+
+; synthesize from A record 5.6.7.8 with DNS64.
+STEP 70 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+ip4.example.com. IN AAAA
+SECTION ANSWER
+ip4.example.com. IN AAAA 64:ff9b::506:708
+ENTRY_END
+
+STEP 80 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+ip4-2.example.com. IN AAAA
+ENTRY_END
+
+; The dns64 subquery is altered by respip, with redirect.
+; and the respip result is dns64 synthesized.
+STEP 90 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+ip4-2.example.com. IN AAAA
+SECTION ANSWER
+ip4-2.example.com. IN AAAA 64:ff9b::405:607
+ENTRY_END
+
+STEP 100 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+ip4-3.example.com. IN AAAA
+ENTRY_END
+
+; The dns64 subquery is altered by respip, with nxdomain.
+; and the respip result is dns64 synthesized.
+STEP 110 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+ip4-3.example.com. IN AAAA
+SECTION ANSWER
+SECTION AUTHORITY
+example.com. IN SOA a. b. 1 2 3 4 5
+ENTRY_END
+
+STEP 120 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+ip4-4.example.com. IN AAAA
+ENTRY_END
+
+; The dns64 subquery is synthesized, respip operates on the
+; synthesized AAAA result, and makes a redirect.
+STEP 130 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+ip4-4.example.com. IN AAAA
+SECTION ANSWER
+ip4-4.example.com. IN AAAA 2001:db8::4
+ENTRY_END
+
+STEP 140 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www4.example.com. IN A
+ENTRY_END
+
+; The query is blocked by rpz.
+STEP 150 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NXDOMAIN
+SECTION QUESTION
+www4.example.com. IN A
+SECTION ANSWER
+ENTRY_END
+
+STEP 160 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+ip4-5.example.com. IN AAAA
+ENTRY_END
+
+; The dns64 subquery is blocked by RPZ.
+STEP 170 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+ip4-5.example.com. IN AAAA
+SECTION ANSWER
+SECTION AUTHORITY
+example.com. IN SOA a. b. 1 2 3 4 5
+ENTRY_END
+
+STEP 180 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+ip4-6.example.com. IN AAAA
+ENTRY_END
+
+; The dns64 subquery is redirected by RPZ.
+STEP 190 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+ip4-6.example.com. IN AAAA
+SECTION ANSWER
+ip4-6.example.com. AAAA 64:ff9b::405:60d
+ENTRY_END
+
+STEP 200 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+ip4-7.example.com. IN AAAA
+ENTRY_END
+
+; The dns64 subquery is a CNAME by RPZ.
+; that CNAME resolves to an A record, dns64 synthesizes that A record.
+STEP 210 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+ip4-7.example.com. IN AAAA
+SECTION ANSWER
+ip4-7.example.com. CNAME alias.example.com.
+alias.example.com. AAAA 64:ff9b::405:60e
+ENTRY_END
+
+SCENARIO_END
diff --git a/testdata/rpz_cname_wild.rpl b/testdata/rpz_cname_wild.rpl
new file mode 100644
index 000000000..ce7200acc
--- /dev/null
+++ b/testdata/rpz_cname_wild.rpl
@@ -0,0 +1,190 @@
+; config options
+server:
+	module-config: "respip validator iterator"
+	target-fetch-policy: "0 0 0 0 0"
+	qname-minimisation: no
+	access-control: 192.0.0.0/8 allow
+
+rpz:
+	name: "rpz.example.com."
+	rpz-log: yes
+	rpz-log-name: "rpz.example.com"
+	zonefile:
+TEMPFILE_NAME rpz.example.com
+TEMPFILE_CONTENTS rpz.example.com
+$ORIGIN example.com. 
+rpz	3600	IN	SOA	ns1.rpz.example.com. hostmaster.rpz.example.com. (
+		1379078166 28800 7200 604800 7200 )
+	3600	IN	NS	ns1.rpz.example.com.
+	3600	IN	NS	ns2.rpz.example.com.
+$ORIGIN rpz.example.com.
+*.gotham5.a CNAME static.gotham6.a.
+*.gotham7.a.rpz-nsdname CNAME static.gotham8.a.
+TEMPFILE_END
+
+stub-zone:
+	name: "a."
+	stub-addr: 10.20.30.40
+CONFIG_END
+
+SCENARIO_BEGIN Test RPZ with CNAME with a wildcarded qname trigger after it.
+
+; a.
+RANGE_BEGIN 0 100
+	ADDRESS 10.20.30.40
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+gotham.a. IN NS
+SECTION AUTHORITY
+gotham.a. NS ns1.gotham.a.
+SECTION ADDITIONAL
+ns1.gotham.a. A 10.20.30.41
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+gotham2.a. IN NS
+SECTION AUTHORITY
+gotham2.a. NS ns1.gotham2.a.
+SECTION ADDITIONAL
+ns1.gotham2.a. A 10.20.30.42
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+gotham6.a. IN NS
+SECTION AUTHORITY
+gotham6.a. NS ns1.gotham6.a.
+SECTION ADDITIONAL
+ns1.gotham6.a. A 10.20.30.46
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+gotham7.a. IN NS
+SECTION AUTHORITY
+gotham7.a. NS ns1.gotham7.a.
+SECTION ADDITIONAL
+ns1.gotham7.a. A 10.20.30.47
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+gotham8.a. IN NS
+SECTION AUTHORITY
+gotham8.a. NS ns1.gotham8.a.
+SECTION ADDITIONAL
+ns1.gotham8.a. A 10.20.30.48
+ENTRY_END
+RANGE_END
+
+; gotham.a.
+RANGE_BEGIN 0 100
+	ADDRESS 10.20.30.41
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.gotham.a. IN A
+SECTION ANSWER
+www.gotham.a. CNAME host.gotham5.a.
+ENTRY_END
+RANGE_END
+
+; gotham2.a.
+RANGE_BEGIN 0 100
+	ADDRESS 10.20.30.42
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.gotham2.a. IN A
+SECTION ANSWER
+www.gotham2.a. CNAME host.gotham7.a.
+ENTRY_END
+RANGE_END
+
+; gotham6.a.
+RANGE_BEGIN 0 100
+	ADDRESS 10.20.30.46
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+static.gotham6.a. IN A
+SECTION ANSWER
+static.gotham6.a. A 1.2.3.4
+ENTRY_END
+RANGE_END
+
+; gotham8.a.
+RANGE_BEGIN 0 100
+	ADDRESS 10.20.30.48
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+static.gotham8.a. IN A
+SECTION ANSWER
+static.gotham8.a. A 1.2.3.5
+ENTRY_END
+RANGE_END
+
+STEP 10 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.gotham.a.	IN	A
+ENTRY_END
+
+STEP 20 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.gotham.a.	IN	A
+SECTION ANSWER
+www.gotham.a. CNAME host.gotham5.a.
+host.gotham5.a CNAME static.gotham6.a.
+static.gotham6.a. A 1.2.3.4
+ENTRY_END
+
+STEP 30 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.gotham2.a.	IN	A
+ENTRY_END
+
+STEP 40 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.gotham2.a.	IN	A
+SECTION ANSWER
+www.gotham2.a. CNAME host.gotham7.a.
+host.gotham7.a CNAME static.gotham8.a.
+static.gotham8.a. A 1.2.3.5
+ENTRY_END
+
+SCENARIO_END
diff --git a/testdata/rrset_use_cached.rpl b/testdata/rrset_use_cached.rpl
index 8420ae02a..7af5c85d2 100644
--- a/testdata/rrset_use_cached.rpl
+++ b/testdata/rrset_use_cached.rpl
@@ -5,8 +5,11 @@ server:
 	# We do not want only serve-expired because fetches from that
 	# apply a generous PREFETCH_LEEWAY.
 	serve-expired-client-timeout: 1000
+	serve-expired-reply-ttl: 123
 	# So that we can only have to give one SERVFAIL answer.
 	outbound-msg-retry: 0
+	ede: yes
+	ede-serve-expired: yes
 
 forward-zone: name: "." forward-addr: 216.0.0.1
 CONFIG_END
@@ -35,11 +38,11 @@ ENTRY_BEGIN
 	SECTION QUESTION
 	www.example.com. IN A
 	SECTION ANSWER
-	www.example.com. 5 IN A 10.20.30.40
+	www.example.com. 205 IN A 10.20.30.40
 	SECTION AUTHORITY
-	example.com. 10 IN NS ns.example.com.
+	example.com. 210 IN NS ns.example.com.
 	SECTION ADDITIONAL
-	ns.example.com. 10 IN A 10.20.30.50
+	ns.example.com. 210 IN A 10.20.30.50
 ENTRY_END
 STEP 4 CHECK_ANSWER
 ENTRY_BEGIN
@@ -48,15 +51,15 @@ ENTRY_BEGIN
 	SECTION QUESTION
 	www.example.com. IN A
 	SECTION ANSWER
-	www.example.com. 5 IN A 10.20.30.40
+	www.example.com. 205 IN A 10.20.30.40
 	SECTION AUTHORITY
-	example.com. 10 IN NS ns.example.com.
+	example.com. 210 IN NS ns.example.com.
 	SECTION ADDITIONAL
-	ns.example.com. 10 IN A 10.20.30.50
+	ns.example.com. 210 IN A 10.20.30.50
 ENTRY_END
 
 ; Wait for the A RRSET to expire.
-STEP 5 TIME_PASSES ELAPSE 6
+STEP 5 TIME_PASSES ELAPSE 205
 
 STEP 6 QUERY
 ENTRY_BEGIN
@@ -80,14 +83,14 @@ ENTRY_BEGIN
 	SECTION QUESTION
 	www.example.com. IN A
 	SECTION ANSWER
-	www.example.com. 5 IN A 10.20.30.40
+	www.example.com. 205 IN A 10.20.30.40
 	SECTION AUTHORITY
-	example.com. 10 IN NS ns.example.com.
+	example.com. 210 IN NS ns.example.com.
 	SECTION ADDITIONAL
-	ns.example.com. 10 IN A 10.20.30.50
+	ns.example.com. 210 IN A 10.20.30.50
 ENTRY_END
 ; The cached NS related RRSETs will not be overwritten by the fresh answer.
-; The message should have a TTL of 4 instead of 5 from above.
+; The message should have a TTL of 5 instead of 205 from above.
 STEP 9 CHECK_ANSWER
 ENTRY_BEGIN
 	MATCH all ttl
@@ -95,11 +98,11 @@ ENTRY_BEGIN
 	SECTION QUESTION
 	www.example.com. IN A
 	SECTION ANSWER
-	www.example.com. 5 IN A 10.20.30.40
+	www.example.com. 205 IN A 10.20.30.40
 	SECTION AUTHORITY
-	example.com. 4 IN NS ns.example.com.
+	example.com. 5 IN NS ns.example.com.
 	SECTION ADDITIONAL
-	ns.example.com. 4 IN A 10.20.30.50
+	ns.example.com. 5 IN A 10.20.30.50
 ENTRY_END
 
 ; Wait for the NS RRSETs to expire.
@@ -107,7 +110,7 @@ STEP 10 TIME_PASSES ELAPSE 5
 
 STEP 11 QUERY
 ENTRY_BEGIN
-	REPLY RD
+	REPLY RD DO
 	SECTION QUESTION
 	www.example.com. IN A
 ENTRY_END
@@ -129,23 +132,23 @@ ENTRY_BEGIN
 ENTRY_END
 ; The SERVFAIL will trigger the serve-expired-client-timeout logic to try and
 ; replace the SERVFAIL with a possible cached (expired) answer.
-; The A RRSET would be at 0TTL left (not expired) but the message should have
-; been updated to use a TTL of 4 so expired by now.
+; The A RRSET would be at 200 left but the message should have
+; been updated to use a TTL of 5 so expired by now.
 ; If the message TTL was not updated (bug), this message would be treated as
 ; non-expired and the now expired NS related RRSETs would fail sanity checks
 ; for non-expired messages. The result would be SERVFAIL here.
 STEP 14 CHECK_ANSWER
 ENTRY_BEGIN
-	MATCH all ttl
-	REPLY QR RD RA
+	MATCH all ttl ede=3
+	REPLY QR RD RA DO
 	SECTION QUESTION
 	www.example.com. IN A
 	SECTION ANSWER
-	www.example.com. 0 IN A 10.20.30.40
+	www.example.com. 200 IN A 10.20.30.40
 	SECTION AUTHORITY
-	example.com. 30 IN NS ns.example.com.
+	example.com. 123 IN NS ns.example.com.
 	SECTION ADDITIONAL
-	ns.example.com. 30 IN A 10.20.30.50
+	ns.example.com. 123 IN A 10.20.30.50
 ENTRY_END
 
 SCENARIO_END
diff --git a/testdata/serve_expired.rpl b/testdata/serve_expired.rpl
index 990a562c7..4aa65e167 100644
--- a/testdata/serve_expired.rpl
+++ b/testdata/serve_expired.rpl
@@ -5,6 +5,7 @@ server:
 	minimal-responses: no
 	serve-expired: yes
 	serve-expired-client-timeout: 0
+	serve-expired-reply-ttl: 123
 	access-control: 127.0.0.1/32 allow_snoop
 	ede: yes
 	ede-serve-expired: yes
@@ -44,7 +45,7 @@ RANGE_BEGIN 0 100
 		SECTION QUESTION
 			example.com. IN A
 		SECTION ANSWER
-			example.com. 10 IN A 5.6.7.8
+			example.com. 200 IN A 5.6.7.8
 		SECTION AUTHORITY
 			example.com. IN NS ns.example.com.
 		SECTION ADDITIONAL
@@ -68,15 +69,15 @@ ENTRY_BEGIN
 	SECTION QUESTION
 		example.com. IN A
 	SECTION ANSWER
-		example.com. 10 IN A 5.6.7.8
+		example.com. 200 IN A 5.6.7.8
 	SECTION AUTHORITY
 		example.com. IN NS ns.example.com.
 	SECTION ADDITIONAL
 		ns.example.com. IN A 1.2.3.4
 ENTRY_END
 
-; Wait for the TTL to expire
-STEP 11 TIME_PASSES ELAPSE 3601
+; Wait for the TTL to expire (for all RRSets; default 3600)
+STEP 11 TIME_PASSES ELAPSE 3600
 
 ; Query again without RD bit
 STEP 30 QUERY
@@ -94,11 +95,11 @@ ENTRY_BEGIN
 	SECTION QUESTION
 		example.com. IN A
 	SECTION ANSWER
-		example.com.  30 IN A 5.6.7.8
+		example.com.  123 IN A 5.6.7.8
 	SECTION AUTHORITY
-		example.com. 30 IN NS ns.example.com.
+		example.com. 123 IN NS ns.example.com.
 	SECTION ADDITIONAL
-		ns.example.com. 30 IN A 1.2.3.4
+		ns.example.com. 123 IN A 1.2.3.4
 ENTRY_END
 
 ; Query with RD bit (the record should have been prefetched)
@@ -116,7 +117,7 @@ ENTRY_BEGIN
 	SECTION QUESTION
 		example.com. IN A
 	SECTION ANSWER
-		example.com.  10 IN A 5.6.7.8
+		example.com.  200 IN A 5.6.7.8
 	SECTION AUTHORITY
 		example.com. IN NS ns.example.com.
 	SECTION ADDITIONAL
diff --git a/testdata/serve_expired_0ttl_nodata.rpl b/testdata/serve_expired_0ttl_nodata.rpl
index 8ca461be2..a53df437a 100644
--- a/testdata/serve_expired_0ttl_nodata.rpl
+++ b/testdata/serve_expired_0ttl_nodata.rpl
@@ -5,6 +5,7 @@ server:
 	minimal-responses: no
 	serve-expired: yes
 	serve-expired-client-timeout: 0
+	serve-expired-reply-ttl: 123
 	ede: yes
 	ede-serve-expired: yes
 
@@ -48,9 +49,9 @@ RANGE_BEGIN 30 100
 		SECTION QUESTION
 			example.com. IN NS
 		SECTION ANSWER
-			example.com. 10 IN NS ns.example.com.
+			example.com. 200 IN NS ns.example.com.
 		SECTION ADDITIONAL
-			ns.example.com. 10 IN A 1.2.3.4
+			ns.example.com. 200 IN A 1.2.3.4
 	ENTRY_END
 
 	ENTRY_BEGIN
@@ -62,9 +63,9 @@ RANGE_BEGIN 30 100
 		SECTION ANSWER
 			0ttl.example.com. 0 IN A 5.6.7.8
 		SECTION AUTHORITY
-			example.com. 10 IN NS ns.example.com.
+			example.com. 200 IN NS ns.example.com.
 		SECTION ADDITIONAL
-			ns.example.com. 10 IN A 1.2.3.4
+			ns.example.com. 200 IN A 1.2.3.4
 	ENTRY_END
 RANGE_END
 
@@ -106,13 +107,13 @@ ENTRY_BEGIN
 		example.com IN SOA ns.example.com dns.example.com 1 7200 3600 2419200 10
 ENTRY_END
 
-; Wait for the NXDOMAIN to expire
-STEP 31 TIME_PASSES ELAPSE 32
+; Wait for the NODATA to expire
+STEP 31 TIME_PASSES ELAPSE 10
 
 ; Query again
 STEP 40 QUERY
 ENTRY_BEGIN
-	REPLY RD
+	REPLY RD DO
 	SECTION QUESTION
 		0ttl.example.com. IN A
 ENTRY_END
@@ -120,8 +121,8 @@ ENTRY_END
 ; Check that we get the cached NODATA
 STEP 50 CHECK_ANSWER
 ENTRY_BEGIN
-	MATCH all
-	REPLY QR RD RA NOERROR
+	MATCH all ede=3
+	REPLY QR RD RA DO NOERROR
 	SECTION QUESTION
 		0ttl.example.com. IN A
 	SECTION AUTHORITY
@@ -146,9 +147,9 @@ ENTRY_BEGIN
 	SECTION ANSWER
 		0ttl.example.com. 0 IN A 5.6.7.8
 	SECTION AUTHORITY
-		example.com. 10 IN NS ns.example.com.
+		example.com. 200 IN NS ns.example.com.
 	SECTION ADDITIONAL
-		ns.example.com. 10 IN A 1.2.3.4
+		ns.example.com. 200 IN A 1.2.3.4
 ENTRY_END
 
 SCENARIO_END
diff --git a/testdata/serve_expired_0ttl_nxdomain.rpl b/testdata/serve_expired_0ttl_nxdomain.rpl
index 7cf26aedd..7dd27b8d5 100644
--- a/testdata/serve_expired_0ttl_nxdomain.rpl
+++ b/testdata/serve_expired_0ttl_nxdomain.rpl
@@ -107,7 +107,7 @@ ENTRY_BEGIN
 ENTRY_END
 
 ; Wait for the NXDOMAIN to expire
-STEP 31 TIME_PASSES ELAPSE 32
+STEP 31 TIME_PASSES ELAPSE 10
 
 ; Query again
 STEP 40 QUERY
@@ -117,7 +117,7 @@ ENTRY_BEGIN
 		0ttl.example.com. IN A
 ENTRY_END
 
-; Check that we get the cached NXDOMAIN
+; Check that we get the newly cached NXDOMAIN
 STEP 50 CHECK_ANSWER
 ENTRY_BEGIN
 	MATCH all
diff --git a/testdata/serve_expired_0ttl_servfail.rpl b/testdata/serve_expired_0ttl_servfail.rpl
index e9d4c4884..9e5a17a09 100644
--- a/testdata/serve_expired_0ttl_servfail.rpl
+++ b/testdata/serve_expired_0ttl_servfail.rpl
@@ -101,7 +101,7 @@ ENTRY_BEGIN
 ENTRY_END
 
 ; Wait for the SERVFAIL to expire
-STEP 31 TIME_PASSES ELAPSE 32
+STEP 31 TIME_PASSES ELAPSE 10
 
 ; Query again
 STEP 40 QUERY
diff --git a/testdata/serve_expired_client_timeout.rpl b/testdata/serve_expired_client_timeout.rpl
index 5560aa05a..c44543692 100644
--- a/testdata/serve_expired_client_timeout.rpl
+++ b/testdata/serve_expired_client_timeout.rpl
@@ -48,7 +48,7 @@ RANGE_BEGIN 0 20
 		SECTION QUESTION
 			example.com. IN A
 		SECTION ANSWER
-			example.com. 10 IN A 5.6.7.8
+			example.com. 200 IN A 5.6.7.8
 		SECTION AUTHORITY
 			example.com. IN NS ns.example.com.
 		SECTION ADDITIONAL
@@ -72,7 +72,7 @@ ENTRY_BEGIN
 	SECTION QUESTION
 		example.com. IN A
 	SECTION ANSWER
-		example.com. 10 IN A 5.6.7.8
+		example.com. 200 IN A 5.6.7.8
 	SECTION AUTHORITY
 		example.com. IN NS ns.example.com.
 	SECTION ADDITIONAL
diff --git a/testdata/serve_expired_client_timeout_no_prefetch.rpl b/testdata/serve_expired_client_timeout_no_prefetch.rpl
deleted file mode 100644
index aed397d9e..000000000
--- a/testdata/serve_expired_client_timeout_no_prefetch.rpl
+++ /dev/null
@@ -1,110 +0,0 @@
-; config options
-server:
-	module-config: "validator iterator"
-	qname-minimisation: "no"
-	minimal-responses: no
-	serve-expired: yes
-	serve-expired-client-timeout: 1
-	serve-expired-reply-ttl: 123
-	ede: yes
-	ede-serve-expired: yes
-
-stub-zone:
-	name: "example.com"
-	stub-addr: 1.2.3.4
-CONFIG_END
-
-SCENARIO_BEGIN Test that no prefetch is triggered for 0TTL records with serve-expired and client-timeout enabled
-; Scenario overview:
-; - query for example.com. IN A
-; - check that we get an answer for example.com. IN A with the correct TTL
-; - query again right at the 0TTL cached entry
-; - check that we get the cached answer with no prefetching triggered
-
-; ns.example.com.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.4
-	ENTRY_BEGIN
-		MATCH opcode qtype qname
-		ADJUST copy_id
-		REPLY QR NOERROR
-		SECTION QUESTION
-			example.com. IN NS
-		SECTION ANSWER
-			example.com. IN NS ns.example.com.
-		SECTION ADDITIONAL
-			ns.example.com. IN A 1.2.3.4
-	ENTRY_END
-RANGE_END
-
-; ns.example.com.
-RANGE_BEGIN 0 10
-	ADDRESS 1.2.3.4
-	; response to A query
-	ENTRY_BEGIN
-		MATCH opcode qtype qname
-		ADJUST copy_id
-		REPLY QR NOERROR
-		SECTION QUESTION
-			example.com. IN A
-		SECTION ANSWER
-			example.com. 10 IN A 5.6.7.8
-		SECTION AUTHORITY
-			example.com. IN NS ns.example.com.
-		SECTION ADDITIONAL
-			ns.example.com. IN A 1.2.3.4
-	ENTRY_END
-RANGE_END
-
-; Query with RD flag
-STEP 0 QUERY
-ENTRY_BEGIN
-	REPLY RD
-	SECTION QUESTION
-		example.com. IN A
-ENTRY_END
-
-; Check that we got the correct answer (should be cached)
-STEP 1 CHECK_ANSWER
-ENTRY_BEGIN
-	MATCH all ttl
-	REPLY QR RD RA NOERROR
-	SECTION QUESTION
-		example.com. IN A
-	SECTION ANSWER
-		example.com. 10 IN A 5.6.7.8
-	SECTION AUTHORITY
-		example.com. IN NS ns.example.com.
-	SECTION ADDITIONAL
-		ns.example.com. IN A 1.2.3.4
-ENTRY_END
-
-; Wait for the TTL to expire and produce a 0 TTL cached record.
-STEP 10 TIME_PASSES ELAPSE 10
-
-; Query again
-STEP 20 QUERY
-ENTRY_BEGIN
-	REPLY RD DO
-	SECTION QUESTION
-		example.com. IN A
-ENTRY_END
-
-; This should come from the cache with no prefetch triggered (earlier bug).
-STEP 21 CHECK_ANSWER
-ENTRY_BEGIN
-	MATCH all ttl
-	REPLY QR RD RA DO NOERROR
-	SECTION QUESTION
-		example.com. IN A
-	SECTION ANSWER
-		example.com.  0 IN A 5.6.7.8
-	SECTION AUTHORITY
-		example.com. 3590 IN NS ns.example.com.
-	SECTION ADDITIONAL
-		ns.example.com. 3590 IN A 1.2.3.4
-ENTRY_END
-
-; If a prefetch triggers the test will fail with 'messages pending'.
-
-SCENARIO_END
diff --git a/testdata/serve_expired_client_timeout_servfail.rpl b/testdata/serve_expired_client_timeout_servfail.rpl
index 3c5b35e17..46fe032fb 100644
--- a/testdata/serve_expired_client_timeout_servfail.rpl
+++ b/testdata/serve_expired_client_timeout_servfail.rpl
@@ -40,9 +40,9 @@ RANGE_BEGIN 0 20
 		SECTION QUESTION
 			example.com. IN NS
 		SECTION ANSWER
-			example.com. 10 IN NS ns.example.com.
+			example.com. 200 IN NS ns.example.com.
 		SECTION ADDITIONAL
-			ns.example.com. 10 IN A 1.2.3.4
+			ns.example.com. 200 IN A 1.2.3.4
 	ENTRY_END
 
 	ENTRY_BEGIN
@@ -52,11 +52,11 @@ RANGE_BEGIN 0 20
 		SECTION QUESTION
 			example.com. IN A
 		SECTION ANSWER
-			example.com. 10 IN A 5.6.7.8
+			example.com. 200 IN A 5.6.7.8
 		SECTION AUTHORITY
-			example.com. 10 IN NS ns.example.com.
+			example.com. 200 IN NS ns.example.com.
 		SECTION ADDITIONAL
-			ns.example.com. 10 IN A 1.2.3.4
+			ns.example.com. 200 IN A 1.2.3.4
 	ENTRY_END
 RANGE_END
 
@@ -84,11 +84,11 @@ RANGE_BEGIN 50 100
 		SECTION QUESTION
 			example.com. IN A
 		SECTION ANSWER
-			example.com. 10 IN A 5.6.7.8
+			example.com. 200 IN A 5.6.7.8
 		SECTION AUTHORITY
-			example.com. 10 IN NS ns.example.com.
+			example.com. 200 IN NS ns.example.com.
 		SECTION ADDITIONAL
-			ns.example.com. 10 IN A 1.2.3.4
+			ns.example.com. 200 IN A 1.2.3.4
 	ENTRY_END
 RANGE_END
 
@@ -108,15 +108,15 @@ ENTRY_BEGIN
 	SECTION QUESTION
 		example.com. IN A
 	SECTION ANSWER
-		example.com. 10 IN A 5.6.7.8
+		example.com. 200 IN A 5.6.7.8
 	SECTION AUTHORITY
-		example.com. 10 IN NS ns.example.com.
+		example.com. 200 IN NS ns.example.com.
 	SECTION ADDITIONAL
-		ns.example.com. 10 IN A 1.2.3.4
+		ns.example.com. 200 IN A 1.2.3.4
 ENTRY_END
 
 ; Wait for the TTL to expire
-STEP 11 TIME_PASSES ELAPSE 11
+STEP 11 TIME_PASSES ELAPSE 200
 
 ; Query again
 STEP 30 QUERY
@@ -209,11 +209,11 @@ ENTRY_BEGIN
 	SECTION QUESTION
 		example.com. IN A
 	SECTION ANSWER
-		example.com. 10 IN A 5.6.7.8
+		example.com. 200 IN A 5.6.7.8
 	SECTION AUTHORITY
-		example.com. 10 IN NS ns.example.com.
+		example.com. 200 IN NS ns.example.com.
 	SECTION ADDITIONAL
-		ns.example.com. 10 IN A 1.2.3.4
+		ns.example.com. 200 IN A 1.2.3.4
 ENTRY_END
 
 SCENARIO_END
diff --git a/testdata/serve_expired_reply_ttl.rpl b/testdata/serve_expired_reply_ttl.rpl
index e76976bde..c7859e00e 100644
--- a/testdata/serve_expired_reply_ttl.rpl
+++ b/testdata/serve_expired_reply_ttl.rpl
@@ -18,8 +18,11 @@ SCENARIO_BEGIN Test serve-expired with reply-ttl
 ; Scenario overview:
 ; - query for example.com. IN A
 ; - check that we get an answer for example.com. IN A with the correct TTL
+; - query for shorterttl.example.com. IN A
+; - check that we get an answer for shorterttl.example.com. IN A with the correct TTL
 ; - query again right after the TTL expired
-; - check that we get the expired cached answer with the configured TTL
+; - check that we get the expired cached answer for example.com. with the configured TTL
+; - check that we get the expired cached answer for shorterttl.example.com. with its own original TTL since it is shorter than the configured one
 
 ; ns.example.com.
 RANGE_BEGIN 0 100
@@ -43,7 +46,21 @@ RANGE_BEGIN 0 100
 		SECTION QUESTION
 			example.com. IN A
 		SECTION ANSWER
-			example.com. 10 IN A 5.6.7.8
+			example.com. 200 IN A 5.6.7.8
+		SECTION AUTHORITY
+			example.com. IN NS ns.example.com.
+		SECTION ADDITIONAL
+			ns.example.com. IN A 1.2.3.4
+	ENTRY_END
+
+	ENTRY_BEGIN
+		MATCH opcode qtype qname
+		ADJUST copy_id
+		REPLY QR NOERROR
+		SECTION QUESTION
+			shorterttl.example.com. IN A
+		SECTION ANSWER
+			shorterttl.example.com. 121 IN A 5.6.7.8
 		SECTION AUTHORITY
 			example.com. IN NS ns.example.com.
 		SECTION ADDITIONAL
@@ -67,15 +84,37 @@ ENTRY_BEGIN
 	SECTION QUESTION
 		example.com. IN A
 	SECTION ANSWER
-		example.com. 10 IN A 5.6.7.8
+		example.com. 200 IN A 5.6.7.8
 	SECTION AUTHORITY
 		example.com. IN NS ns.example.com.
 	SECTION ADDITIONAL
 		ns.example.com. IN A 1.2.3.4
 ENTRY_END
 
-; Wait for the TTL to expire
-STEP 11 TIME_PASSES ELAPSE 3601
+STEP 11 QUERY
+ENTRY_BEGIN
+	REPLY RD
+	SECTION QUESTION
+		shorterttl.example.com. IN A
+ENTRY_END
+
+
+STEP 12 CHECK_ANSWER
+ENTRY_BEGIN
+	MATCH all ttl
+	REPLY QR RD RA NOERROR
+	SECTION QUESTION
+		shorterttl.example.com. IN A
+	SECTION ANSWER
+		shorterttl.example.com. 121 IN A 5.6.7.8
+	SECTION AUTHORITY
+		example.com. IN NS ns.example.com.
+	SECTION ADDITIONAL
+		ns.example.com. IN A 1.2.3.4
+ENTRY_END
+
+; Wait for the TTL to expire (for all rrsets; default 3600)
+STEP 20 TIME_PASSES ELAPSE 3600
 
 ; Query again
 STEP 30 QUERY
@@ -100,7 +139,31 @@ ENTRY_BEGIN
 		ns.example.com. 123 A 1.2.3.4
 ENTRY_END
 
+; Query again for shorter ttl
+STEP 50 QUERY
+ENTRY_BEGIN
+	REPLY RD DO
+	SECTION QUESTION
+		shorterttl.example.com. IN A
+ENTRY_END
+
+; Check that we got a stale answer
+; Note: auth, additional rrsets are already updated from previous recursion.
+STEP 60 CHECK_ANSWER
+ENTRY_BEGIN
+	MATCH all ttl ede=3
+	REPLY QR RD RA DO NOERROR
+	SECTION QUESTION
+		shorterttl.example.com. IN A
+	SECTION ANSWER
+		shorterttl.example.com.  121 A 5.6.7.8
+	SECTION AUTHORITY
+		example.com. 3600 NS ns.example.com.
+	SECTION ADDITIONAL
+		ns.example.com. 3600 A 1.2.3.4
+ENTRY_END
+
 ; Give time for the pending query to get answered
-STEP 41 TRAFFIC
+STEP 61 TRAFFIC
 
 SCENARIO_END
diff --git a/testdata/serve_expired_ttl_client_timeout.rpl b/testdata/serve_expired_ttl_client_timeout.rpl
index 169d070ea..d1aef32af 100644
--- a/testdata/serve_expired_ttl_client_timeout.rpl
+++ b/testdata/serve_expired_ttl_client_timeout.rpl
@@ -78,7 +78,7 @@ ENTRY_BEGIN
 ENTRY_END
 
 ; Wait for the TTL to expire + serve-expired-ttl
-STEP 11 TIME_PASSES ELAPSE 3611
+STEP 11 TIME_PASSES ELAPSE 3610
 
 ; Query again
 STEP 30 QUERY
diff --git a/testdata/serve_expired_ttl_reset.rpl b/testdata/serve_expired_ttl_reset.rpl
index 9f215c96b..f732fddcf 100644
--- a/testdata/serve_expired_ttl_reset.rpl
+++ b/testdata/serve_expired_ttl_reset.rpl
@@ -36,7 +36,7 @@ REPLY QR AA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN A 0.0.0.0
+www.example.com. 200 IN A 0.0.0.0
 ENTRY_END
 
 STEP 3 CHECK_ANSWER
@@ -46,11 +46,11 @@ REPLY QR RA RD NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN A 0.0.0.0
+www.example.com. 200 IN A 0.0.0.0
 ENTRY_END
 
 ; Expire the record (+ serve-expired-ttl)
-STEP 4 TIME_PASSES ELAPSE 12
+STEP 4 TIME_PASSES ELAPSE 201
 
 STEP 5 QUERY
 ENTRY_BEGIN
diff --git a/testdata/serve_expired_zerottl.rpl b/testdata/serve_expired_zerottl.rpl
index 1411cb8e7..50a50bb3b 100644
--- a/testdata/serve_expired_zerottl.rpl
+++ b/testdata/serve_expired_zerottl.rpl
@@ -65,11 +65,11 @@ RANGE_BEGIN 11 100
 		SECTION QUESTION
 			example.com. IN A
 		SECTION ANSWER
-			example.com. 10 IN A 5.6.7.8
+			example.com. 200 IN A 5.6.7.8
 		SECTION AUTHORITY
-			example.com. 10 IN NS ns.example.com.
+			example.com. 200 IN NS ns.example.com.
 		SECTION ADDITIONAL
-			ns.example.com. 10 IN A 1.2.3.4
+			ns.example.com. 200 IN A 1.2.3.4
 	ENTRY_END
 RANGE_END
 
@@ -118,15 +118,15 @@ ENTRY_BEGIN
 	SECTION QUESTION
 		example.com. IN A
 	SECTION ANSWER
-		example.com. 10 IN A 5.6.7.8
+		example.com. 200 IN A 5.6.7.8
 	SECTION AUTHORITY
-		example.com. 10 IN NS ns.example.com.
+		example.com. 200 IN NS ns.example.com.
 	SECTION ADDITIONAL
-		ns.example.com. 10 IN A 1.2.3.4
+		ns.example.com. 200 IN A 1.2.3.4
 ENTRY_END
 
 ; Wait for the TTL to expire
-STEP 30 TIME_PASSES ELAPSE 11
+STEP 30 TIME_PASSES ELAPSE 200
 
 ; Query with RD flag
 STEP 40 QUERY
diff --git a/testdata/subnet_cache_lookup.tdir/subnet_cache_lookup.conf b/testdata/subnet_cache_lookup.tdir/subnet_cache_lookup.conf
new file mode 100644
index 000000000..81072c70b
--- /dev/null
+++ b/testdata/subnet_cache_lookup.tdir/subnet_cache_lookup.conf
@@ -0,0 +1,36 @@
+server:
+	verbosity: 7
+	# num-threads: 1
+	interface: 127.0.0.1
+	interface: 127.0.0.1@@PROXYPORT@
+	port: @PORT@
+	proxy-protocol-port: @PROXYPORT@
+	access-control: 1.0.0.0/8 allow
+	use-syslog: no
+	directory: ""
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+	target-fetch-policy: "0 0 0 0 0"
+	send-client-subnet: 127.0.0.1
+	max-client-subnet-ipv4: 17
+	module-config: "subnetcache iterator"
+	qname-minimisation: no
+	minimal-responses: no
+remote-control:
+	control-enable: yes
+	control-interface: @CONTROL_PATH@/controlpipe.@CONTROL_PID@
+	control-use-cert: no
+stub-zone:
+	name: "."
+	stub-prime: no
+	stub-addr: "127.0.0.1@@TOPORT@"
+stub-zone:
+	name: "example.com"
+	stub-prime: no
+	stub-addr: "127.0.0.1@@TOPORT@"
+stub-zone:
+	name: "example.net"
+	stub-prime: no
+	stub-addr: "127.0.0.1@@TOPORT@"
diff --git a/testdata/subnet_cache_lookup.tdir/subnet_cache_lookup.dsc b/testdata/subnet_cache_lookup.tdir/subnet_cache_lookup.dsc
new file mode 100644
index 000000000..5f478e935
--- /dev/null
+++ b/testdata/subnet_cache_lookup.tdir/subnet_cache_lookup.dsc
@@ -0,0 +1,16 @@
+BaseName: subnet_cache_lookup
+Version: 1.0
+Description: Subnet cache contents with unbound-control cache_lookup
+CreationDate: Fri Aug 15 11:00:00 CEST 2025
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: subnet_cache_lookup.pre
+Post: subnet_cache_lookup.post
+Test: subnet_cache_lookup.test
+AuxFiles: 
+Passed:
+Failure:
diff --git a/testdata/subnet_cache_lookup.tdir/subnet_cache_lookup.post b/testdata/subnet_cache_lookup.tdir/subnet_cache_lookup.post
new file mode 100644
index 000000000..247ea68a6
--- /dev/null
+++ b/testdata/subnet_cache_lookup.tdir/subnet_cache_lookup.post
@@ -0,0 +1,15 @@
+# #-- subnet_cache_lookup.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+PRE="../.."
+. ../common.sh
+echo "> cat logfiles"
+kill_pid $FWD_PID
+kill_pid $UNBOUND_PID
+rm -f $CONTROL_PATH/controlpipe.$CONTROL_PID
+cat fwd.log 
+cat unbound.log
diff --git a/testdata/subnet_cache_lookup.tdir/subnet_cache_lookup.pre b/testdata/subnet_cache_lookup.tdir/subnet_cache_lookup.pre
new file mode 100644
index 000000000..ce007c4fa
--- /dev/null
+++ b/testdata/subnet_cache_lookup.tdir/subnet_cache_lookup.pre
@@ -0,0 +1,42 @@
+# #-- subnet_cache_lookup.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+. ../common.sh
+if grep "define CLIENT_SUBNET 1" $PRE/config.h; then echo test enabled; else skip_test "test skipped"; fi
+
+get_make
+(cd $PRE; $MAKE streamtcp)
+
+get_random_port 3
+UNBOUND_PORT=$RND_PORT
+PROXY_PORT=$(($RND_PORT + 1))
+FWD_PORT=$(($RND_PORT + 2))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "PROXY_PORT=$PROXY_PORT" >> .tpkg.var.test
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+
+# start forwarder
+get_ldns_testns
+$LDNS_TESTNS -p $FWD_PORT subnet_cache_lookup.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+# make config file
+CONTROL_PATH=/tmp
+CONTROL_PID=$$
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@PROXYPORT\@/'$PROXY_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' -e 's?@CONTROL_PATH\@?'$CONTROL_PATH'?' -e 's/@CONTROL_PID@/'$CONTROL_PID'/' < subnet_cache_lookup.conf > ub.conf
+# start unbound in the background
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+echo "CONTROL_PATH=$CONTROL_PATH" >> .tpkg.var.test
+echo "CONTROL_PID=$CONTROL_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_ldns_testns_up fwd.log
+wait_unbound_up unbound.log
+
diff --git a/testdata/subnet_cache_lookup.tdir/subnet_cache_lookup.test b/testdata/subnet_cache_lookup.tdir/subnet_cache_lookup.test
new file mode 100644
index 000000000..8838a64ed
--- /dev/null
+++ b/testdata/subnet_cache_lookup.tdir/subnet_cache_lookup.test
@@ -0,0 +1,121 @@
+# #-- subnet_cache_lookup.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+# do the test
+echo "> dig www.example.com."
+dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 1
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 1
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 1
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 10
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 10
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+#echo "> cat logfiles"
+#cat fwd.log 
+#cat unbound.log
+echo "> check answer"
+if grep www.example.com outfile | grep "10.20.30.40"; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+echo "> unbound-control status"
+$PRE/unbound-control -c ub.conf status
+if test $? -ne 0; then
+	echo "wrong exit value."
+	exit 1
+else
+	echo "exit value: OK"
+fi
+
+echo "> unbound-control cache_lookup example.com"
+$PRE/unbound-control -c ub.conf cache_lookup example.com 2>&1 | tee outfile
+if test $? -ne 0; then
+	echo "wrong exit value."
+	exit 1
+fi
+echo "> check unbound-control output"
+if grep "subnet" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+echo "> use proxy-protocol to put more addresses in the edns subnet cache"
+$PRE/streamtcp -f 127.0.0.1@$PROXY_PORT -p 1.1.3.4 www.example.net. A IN | tee outfile
+if grep www.example.net outfile | grep "10.20.30.41"; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+$PRE/streamtcp -f 127.0.0.1@$PROXY_PORT -p 1.2.3.4 www.example.net. A IN | tee outfile
+if grep www.example.net outfile | grep "10.20.30.42"; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+$PRE/streamtcp -f 127.0.0.1@$PROXY_PORT -p 1.3.3.4 www.example.net. A IN | tee outfile
+if grep www.example.net outfile | grep "10.20.30.43"; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+$PRE/streamtcp -f 127.0.0.1@$PROXY_PORT -p 1.4.3.4 www.example.net. A IN | tee outfile
+if grep www.example.net outfile | grep "10.20.30.44"; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+echo "> unbound-control cache_lookup example.net"
+$PRE/unbound-control -c ub.conf cache_lookup example.net 2>&1 | tee outfile
+if test $? -ne 0; then
+	echo "wrong exit value."
+	exit 1
+fi
+echo "> check unbound-control output"
+if grep "subnet" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+exit 0
diff --git a/testdata/subnet_cache_lookup.tdir/subnet_cache_lookup.testns b/testdata/subnet_cache_lookup.tdir/subnet_cache_lookup.testns
new file mode 100644
index 000000000..ebdbffa71
--- /dev/null
+++ b/testdata/subnet_cache_lookup.tdir/subnet_cache_lookup.testns
@@ -0,0 +1,181 @@
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS test.ns.
+SECTION ADDITIONAL
+test.ns. IN A 127.0.0.1
+ENTRY_END
+
+; response to query of interest
+ENTRY_BEGIN
+;MATCH opcode qtype qname ednsdata
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+HEX_EDNSDATA_BEGIN
+			; client is 127.0.0.1
+	00 08 		; OPC
+	00 07 		; option length
+	00 01 		; Family
+	11 11 		; source mask, scopemask
+	7f 00 00 	; address
+HEX_EDNSDATA_END
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+example.com. IN SOA
+SECTION ANSWER
+example.com. IN SOA ns.example.com. hostmaster.example.com. 1 3600 900 86400 3600
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname ednsdata
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.example.net. IN A
+SECTION ADDITIONAL
+HEX_EDNSDATA_BEGIN
+			; client is 1.1.3.4
+	00 08 		; OPC
+	00 07 		; option length
+	00 01 		; Family
+	11 00 		; source mask, scopemask
+	01 01 00 	; address
+HEX_EDNSDATA_END
+HEX_ANSWER_BEGIN
+        00 00 84 00 00 01 00 01         ;ID 0, QR AA
+        00 00 00 01 03 77 77 77         ; www.example.net. A? (DO)
+        07 65 78 61 6d 70 6c 65
+        03 6e 65 74 00 00 01 00
+        01
+					; www.example.net. A 10.20.30.41
+	03 77 77 77 07 65 78 61 6d 70 6c 65 03 6e 65 74 00
+	00 01 00 01 00 00 0e 10 00 04
+	0a 14 1e 29
+
+	00 00 29 10 00 00 00
+        80 00 00 0b
+        00 08 00 07                     ; OPC, optlen
+        00 01 11 11                     ; ip4, scope 17, source 17
+        01 01 00                        ;1.1.0.0/17
+HEX_ANSWER_END
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname ednsdata
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.example.net. IN A
+SECTION ADDITIONAL
+HEX_EDNSDATA_BEGIN
+			; client is 1.2.3.4
+	00 08 		; OPC
+	00 07 		; option length
+	00 01 		; Family
+	11 00 		; source mask, scopemask
+	01 02 00 	; address
+HEX_EDNSDATA_END
+HEX_ANSWER_BEGIN
+        00 00 84 00 00 01 00 01         ;ID 0, QR AA
+        00 00 00 01 03 77 77 77         ; www.example.net. A? (DO)
+        07 65 78 61 6d 70 6c 65
+        03 6e 65 74 00 00 01 00
+        01
+					; www.example.net. A 10.20.30.42
+	03 77 77 77 07 65 78 61 6d 70 6c 65 03 6e 65 74 00
+	00 01 00 01 00 00 0e 10 00 04
+	0a 14 1e 2a
+
+	00 00 29 10 00 00 00
+        80 00 00 0b
+        00 08 00 07                     ; OPC, optlen
+        00 01 11 11                     ; ip4, scope 17, source 17
+        01 02 00                        ;1.2.0.0/17
+HEX_ANSWER_END
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname ednsdata
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.example.net. IN A
+SECTION ADDITIONAL
+HEX_EDNSDATA_BEGIN
+			; client is 1.3.3.4
+	00 08 		; OPC
+	00 07 		; option length
+	00 01 		; Family
+	11 00 		; source mask, scopemask
+	01 03 00 	; address
+HEX_EDNSDATA_END
+HEX_ANSWER_BEGIN
+        00 00 84 00 00 01 00 01         ;ID 0, QR AA
+        00 00 00 01 03 77 77 77         ; www.example.net. A? (DO)
+        07 65 78 61 6d 70 6c 65
+        03 6e 65 74 00 00 01 00
+        01
+					; www.example.net. A 10.20.30.43
+	03 77 77 77 07 65 78 61 6d 70 6c 65 03 6e 65 74 00
+	00 01 00 01 00 00 0e 10 00 04
+	0a 14 1e 2b
+
+	00 00 29 10 00 00 00
+        80 00 00 0b
+        00 08 00 07                     ; OPC, optlen
+        00 01 11 11                     ; ip4, scope 17, source 17
+        01 03 00                        ;1.3.0.0/17
+HEX_ANSWER_END
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname ednsdata
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.example.net. IN A
+SECTION ADDITIONAL
+HEX_EDNSDATA_BEGIN
+			; client is 1.4.3.4
+	00 08 		; OPC
+	00 07 		; option length
+	00 01 		; Family
+	11 00 		; source mask, scopemask
+	01 04 00 	; address
+HEX_EDNSDATA_END
+HEX_ANSWER_BEGIN
+        00 00 84 00 00 01 00 01         ;ID 0, QR AA
+        00 00 00 01 03 77 77 77         ; www.example.net. A? (DO)
+        07 65 78 61 6d 70 6c 65
+        03 6e 65 74 00 00 01 00
+        01
+					; www.example.net. A 10.20.30.44
+	03 77 77 77 07 65 78 61 6d 70 6c 65 03 6e 65 74 00
+	00 01 00 01 00 00 0e 10 00 04
+	0a 14 1e 2c
+
+	00 00 29 10 00 00 00
+        80 00 00 0b
+        00 08 00 07                     ; OPC, optlen
+        00 01 11 11                     ; ip4, scope 17, source 17
+        01 04 00                        ;1.4.0.0/17
+HEX_ANSWER_END
+ENTRY_END
diff --git a/testdata/subnet_global_prefetch_always_forward.crpl b/testdata/subnet_global_prefetch_always_forward.crpl
index 775474cbc..f2c8bdb60 100644
--- a/testdata/subnet_global_prefetch_always_forward.crpl
+++ b/testdata/subnet_global_prefetch_always_forward.crpl
@@ -7,12 +7,15 @@ server:
 	target-fetch-policy: "0 0 0 0 0"
 	serve-expired: yes
 	serve-expired-client-timeout: 0
+	serve-expired-reply-ttl: 123
 	client-subnet-always-forward: yes
 	module-config: "subnetcache iterator"
 	verbosity: 3
 	access-control: 127.0.0.1 allow_snoop
 	qname-minimisation: no
 	minimal-responses: no
+	ede: yes
+	ede-serve-expired: yes
 
 stub-zone:
 	name: "."
@@ -100,7 +103,7 @@ RANGE_BEGIN 0 100
 		SECTION QUESTION
 			www.example.com. IN A
 		SECTION ANSWER
-			www.example.com. 10 IN A	10.20.30.40
+			www.example.com. 200 IN A	10.20.30.40
 		SECTION AUTHORITY
 			example.com.	IN NS	ns.example.com.
 		SECTION ADDITIONAL
@@ -131,11 +134,11 @@ ns.example.com.		IN A	1.2.3.4
 ENTRY_END
 
 ; Wait for the TTL to expire
-STEP 3 TIME_PASSES ELAPSE 20
+STEP 3 TIME_PASSES ELAPSE 200
 
 STEP 11 QUERY
 ENTRY_BEGIN
-REPLY RD
+REPLY RD DO
 SECTION QUESTION
 www.example.com. IN A
 ENTRY_END
@@ -143,16 +146,16 @@ ENTRY_END
 ; This record came from the global cache and a prefetch was triggered
 STEP 12 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ttl
-REPLY QR RD RA NOERROR
+MATCH all ttl ede=3
+REPLY QR RD RA DO NOERROR
 SECTION QUESTION
 www.example.com.		IN A
 SECTION ANSWER
-www.example.com.	30	IN A	10.20.30.40
+www.example.com.	123	IN A	10.20.30.40
 SECTION AUTHORITY
-example.com.		3580	IN NS	ns.example.com.
+example.com.		3400	IN NS	ns.example.com.
 SECTION ADDITIONAL
-ns.example.com.		3580	IN A	1.2.3.4
+ns.example.com.		3400	IN A	1.2.3.4
 ENTRY_END
 
 STEP 13 CHECK_OUT_QUERY
diff --git a/testdata/subnet_global_prefetch_expired.crpl b/testdata/subnet_global_prefetch_expired.crpl
index 374bf3e69..a347550ba 100644
--- a/testdata/subnet_global_prefetch_expired.crpl
+++ b/testdata/subnet_global_prefetch_expired.crpl
@@ -16,7 +16,11 @@ server:
 	serve-expired: yes
 	serve-expired-client-timeout: 0
 	serve-expired-ttl: 1
-	prefetch: yes
+	serve-expired-client-timeout: 0
+	serve-expired-reply-ttl: 123
+	#prefetch: yes  #not needed, expired answers also trigger refetch
+	ede: yes
+	ede-serve-expired: yes
 
 stub-zone:
 	name: "."
@@ -113,7 +117,7 @@ RANGE_BEGIN 0 10
 		SECTION QUESTION
 			www.example.com. IN A
 		SECTION ANSWER
-			www.example.com. 10 IN A	10.20.30.40
+			www.example.com. 200 IN A	10.20.30.40
 		SECTION AUTHORITY
 			example.com.	IN NS	ns.example.com.
 		SECTION ADDITIONAL
@@ -147,7 +151,7 @@ RANGE_BEGIN 11 100
 		SECTION QUESTION
 			www.example.com. IN A
 		SECTION ANSWER
-			www.example.com. 10 IN A	10.20.30.40
+			www.example.com. 200 IN A	10.20.30.40
 		SECTION AUTHORITY
 			example.com.	IN NS	ns.example.com.
 		SECTION ADDITIONAL
@@ -178,7 +182,7 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. IN A	10.20.30.40
+www.example.com. 200 IN A	10.20.30.40
 SECTION AUTHORITY
 example.com.	IN NS	ns.example.com.
 SECTION ADDITIONAL
@@ -186,11 +190,11 @@ ns.example.com.		IN 	A	1.2.3.4
 ENTRY_END
 
 ; Try to trigger a prefetch with expired data
-STEP 3 TIME_PASSES ELAPSE 11
+STEP 3 TIME_PASSES ELAPSE 200
 
 STEP 11 QUERY
 ENTRY_BEGIN
-REPLY RD
+REPLY RD DO
 SECTION QUESTION
 www.example.com. IN A
 ENTRY_END
@@ -198,19 +202,18 @@ ENTRY_END
 ; This expired record came from the global cache and a prefetch is triggered.
 STEP 12 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ttl
-REPLY QR RD RA NOERROR
+MATCH all ttl ede=3
+REPLY QR RD RA DO NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 30 IN A	10.20.30.40
+www.example.com. 123 IN A	10.20.30.40
 SECTION AUTHORITY
-example.com.	3589 IN NS	ns.example.com.
+example.com.	3400 IN NS	ns.example.com.
 SECTION ADDITIONAL
-ns.example.com.	3589 IN 	A	1.2.3.4
+ns.example.com.	3400 IN 	A	1.2.3.4
 ENTRY_END
 
-;STEP 13 TRAFFIC
 ; Allow enough time to pass so that the expired record from the global cache
 ; cannot be used anymore.
 STEP 14 TIME_PASSES ELAPSE 1
@@ -232,7 +235,7 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 9 IN A	10.20.30.40
+www.example.com. 199 IN A	10.20.30.40
 SECTION AUTHORITY
 example.com.	3599 IN NS	ns.example.com.
 SECTION ADDITIONAL
diff --git a/testdata/subnet_scopezero_global.crpl b/testdata/subnet_scopezero_global.crpl
new file mode 100644
index 000000000..1db7cc322
--- /dev/null
+++ b/testdata/subnet_scopezero_global.crpl
@@ -0,0 +1,280 @@
+; config options
+server:
+	target-fetch-policy: "0 0 0 0 0"
+	module-config: "subnetcache validator iterator"
+	verbosity: 4
+	qname-minimisation: no
+	; the domain is not configured for edns-subnet
+	;send-client-subnet: 1.2.3.4
+	client-subnet-zone: "ex2.com"
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129
+
+stub-zone:
+	name: "example.com"
+	stub-addr: 1.2.3.4
+stub-zone:
+	name: "ex2.com"
+	stub-addr: 1.2.3.5
+CONFIG_END
+
+SCENARIO_BEGIN Test subnet cache with scope zero for global cache store.
+
+; the upstream server.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129
+
+ENTRY_BEGIN
+MATCH opcode qtype qname ednsdata
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+HEX_EDNSDATA_BEGIN
+	;; we expect to receive empty
+HEX_EDNSDATA_END
+K.ROOT-SERVERS.NET.     IN      A       193.0.14.129
+ENTRY_END
+RANGE_END
+
+RANGE_BEGIN 0 21
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A   10.20.30.40
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ENTRY_END
+RANGE_END
+
+RANGE_BEGIN 20 61
+	ADDRESS 1.2.3.5
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.ex2.com. IN A
+SECTION ANSWER
+www.ex2.com. IN A   10.20.30.41
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ENTRY_END
+RANGE_END
+
+RANGE_BEGIN 90 101
+	ADDRESS 1.2.3.5
+ENTRY_BEGIN
+	MATCH opcode qtype qname ednsdata
+	ADJUST copy_id copy_ednsdata_assume_clientsubnet
+	REPLY QR NOERROR
+	SECTION QUESTION
+		www.ex2.com. IN A
+	SECTION ANSWER
+		www.ex2.com. 10 IN A	10.20.30.42
+	SECTION AUTHORITY
+		ex2.com.	IN NS	ns.ex2.com.
+	SECTION ADDITIONAL
+		HEX_EDNSDATA_BEGIN
+					; client is 127.0.0.1
+			00 08 		; OPC
+			00 07 		; option length
+			00 01 		; Family
+			18 00 		; source mask, scopemask
+			7f 00 00 	; address
+		HEX_EDNSDATA_END
+		ns.ex2.com.		IN 	A	1.2.3.5
+ENTRY_END
+RANGE_END
+
+; query for 0.0.0.0/0
+STEP 10 QUERY
+ENTRY_BEGIN
+HEX_ANSWER_BEGIN
+	00 00 01 00 00 01 00 00         ;ID 0
+	00 00 00 01 03 77 77 77         ; www.example.com A? (DO)
+	07 65 78 61 6d 70 6c 65
+	03 63 6f 6d 00 00 01 00
+	01 00 00 29 10 00 00 00
+	80 00 00 08
+
+	00 08 00 04                     ; OPC, optlen
+	00 01 00 00                     ; ip4, scope 0, source 0
+	                                ;0.0.0.0/0
+HEX_ANSWER_END
+ENTRY_END
+
+STEP 20 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ednsdata
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A   10.20.30.40
+SECTION AUTHORITY
+SECTION ADDITIONAL
+HEX_EDNSDATA_BEGIN
+	00 08           ; OPC
+	00 04           ; option length
+	00 01           ; Family
+	00 00           ; source mask, scopemask
+	                ; address
+HEX_EDNSDATA_END
+ENTRY_END
+
+; That that it is in global cache.
+STEP 30 QUERY
+ENTRY_BEGIN
+REPLY RD NOERROR
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+STEP 40 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ednsdata
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A   10.20.30.40
+ENTRY_END
+
+; With a query where the name is whitelisted, it should not be stored
+; in global cache.
+STEP 50 QUERY
+ENTRY_BEGIN
+HEX_ANSWER_BEGIN
+	00 00 01 00 00 01 00 00         ;ID 0
+	00 00 00 01 03 77 77 77         ; www.ex2.com A? (DO)
+	03 65 78 32 03 63 6f 6d
+	00 00 01 00 01 00 00 29
+	10 00 00 00 80 00 00 08
+
+	00 08 00 04                     ; OPC, optlen
+	00 01 00 00                     ; ip4, scope 0, source 0
+	                                ;0.0.0.0/0
+HEX_ANSWER_END
+ENTRY_END
+
+STEP 60 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ednsdata
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.ex2.com. IN A
+SECTION ANSWER
+www.ex2.com. IN A   10.20.30.41
+SECTION AUTHORITY
+SECTION ADDITIONAL
+HEX_EDNSDATA_BEGIN
+	00 08           ; OPC
+	00 04           ; option length
+	00 01           ; Family
+	00 00           ; source mask, scopemask
+	                ; address
+HEX_EDNSDATA_END
+ENTRY_END
+
+STEP 70 QUERY
+ENTRY_BEGIN
+HEX_ANSWER_BEGIN
+	00 00 01 00 00 01 00 00         ;ID 0
+	00 00 00 01 03 77 77 77         ; www.ex2.com A? (DO)
+	03 65 78 32 03 63 6f 6d
+	00 00 01 00 01 00 00 29
+	10 00 00 00 80 00 00 08
+
+	00 08 00 04                     ; OPC, optlen
+	00 01 00 00                     ; ip4, scope 0, source 0
+	                                ;0.0.0.0/0
+HEX_ANSWER_END
+ENTRY_END
+
+STEP 80 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ednsdata
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.ex2.com. IN A
+SECTION ANSWER
+www.ex2.com. IN A   10.20.30.41
+SECTION AUTHORITY
+SECTION ADDITIONAL
+HEX_EDNSDATA_BEGIN
+	00 08           ; OPC
+	00 04           ; option length
+	00 01           ; Family
+	00 00           ; source mask, scopemask
+	                ; address
+HEX_EDNSDATA_END
+ENTRY_END
+
+; www.ex2.com is not in the global cache. and gets subnet treatment
+STEP 90 QUERY
+ENTRY_BEGIN
+REPLY RD NOERROR
+SECTION QUESTION
+www.ex2.com. IN A
+ENTRY_END
+
+STEP 100 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ednsdata
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.ex2.com. IN A
+SECTION ANSWER
+www.ex2.com. IN A   10.20.30.42
+ENTRY_END
+
+; that result is in the subnet cache
+STEP 110 QUERY
+ENTRY_BEGIN
+HEX_ANSWER_BEGIN
+	00 00 01 00 00 01 00 00         ;ID 0
+	00 00 00 01 03 77 77 77         ; www.ex2.com A? (DO)
+	03 65 78 32 03 63 6f 6d
+	00 00 01 00 01 00 00 29
+	10 00 00 00 80 00 00 0b
+
+	00 08 00 07                     ; OPC, optlen
+			; ip4 127.0.0.0/24 scope /0
+	00 01 		; Family
+	18 00 		; source mask, scopemask
+	7f 00 00 	; address
+HEX_ANSWER_END
+ENTRY_END
+
+STEP 120 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ednsdata
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.ex2.com. IN A
+SECTION ANSWER
+www.ex2.com. IN A   10.20.30.42
+SECTION AUTHORITY
+SECTION ADDITIONAL
+HEX_EDNSDATA_BEGIN
+	00 08           ; OPC
+	00 07           ; option length
+			; ip4 127.0.0.0/24 scope /24
+	00 01 		; Family
+	18 18 		; source mask, scopemask
+	7f 00 00 	; address
+HEX_EDNSDATA_END
+ENTRY_END
+
+SCENARIO_END
diff --git a/testdata/tsig_test.1 b/testdata/tsig_test.1
index d74bd1076..1f1ee2779 100644
--- a/testdata/tsig_test.1
+++ b/testdata/tsig_test.1
@@ -163,3 +163,14 @@ endpacket
 check-packet
 e7078400000100010000000203777777076578616d706c65036e65740000010001c00c0001000100000e1000040a141e2800002904d00000000000000474657374036b65790000fa00ff00000000003a08686d61632d6d6435077369672d616c670372656703696e740000006855490d012c0010dc3c138476fcb04cc138aa5c59647b86e70700000000
 endpacket
+
+# www.example.net A
+packet
+e707002000010000000000010377777707657861
+6d706c65036e6574000001000100002910000000
+00000000
+endpacket
+
+tsig-verify-reply test.key 1750419725 1 1
+e7078400000100010000000203777777076578616d706c65036e65740000010001c00c0001000100000e1000040a141e2800002904d00000000000000474657374036b65790000fa00ff00000000003a08686d61632d6d6435077369672d616c670372656703696e740000006855490d012c0010dc3c138476fcb04cc138aa5c59647b86e70700000000
+endpacket
diff --git a/testdata/tsig_test.2 b/testdata/tsig_test.2
index 552b0b16f..951f81404 100644
--- a/testdata/tsig_test.2
+++ b/testdata/tsig_test.2
@@ -46,3 +46,12 @@ endpacket
 check-packet
 092d8400000100010000000203777777076578616d706c65036e65740000010001c00c0001000100000e1000040a141e2800002904d00000000000000474657374036b65790000fa00ff00000000002f09686d61632d7368613100000068554d04012c001475eace537fd51a9fbf192a10b20bfe824dd20318092d00000000
 endpacket
+
+# www.example.net A
+packet
+092d0000000100000000000103777777076578616d706c65036e657400000100010000291000000000000000
+endpacket
+
+tsig-verify-reply test.key 1750420740 1 1
+092d8400000100010000000203777777076578616d706c65036e65740000010001c00c0001000100000e1000040a141e2800002904d00000000000000474657374036b65790000fa00ff00000000002f09686d61632d7368613100000068554d04012c001475eace537fd51a9fbf192a10b20bfe824dd20318092d00000000
+endpacket
diff --git a/testdata/tsig_test.3 b/testdata/tsig_test.3
index 3d5cd618e..505ff2b32 100644
--- a/testdata/tsig_test.3
+++ b/testdata/tsig_test.3
@@ -46,3 +46,12 @@ endpacket
 check-packet
 7e7e8400000100010000000203777777076578616d706c65036e65740000010001c00c0001000100000e1000040a141e2800002904d00000000000000474657374036b65790000fa00ff0000000000390b686d61632d736861323234000000685550bc012c001c0fa7ddec264122b5e0c3d1a64ed043c3d68582f0ae2ba2d5b3e186127e7e00000000
 endpacket
+
+# www.example.net A
+packet
+7e7e0000000100000000000103777777076578616d706c65036e657400000100010000291000000000000000
+endpacket
+
+tsig-verify-reply test.key 1750421692 1 1
+7e7e8400000100010000000203777777076578616d706c65036e65740000010001c00c0001000100000e1000040a141e2800002904d00000000000000474657374036b65790000fa00ff0000000000390b686d61632d736861323234000000685550bc012c001c0fa7ddec264122b5e0c3d1a64ed043c3d68582f0ae2ba2d5b3e186127e7e00000000
+endpacket
diff --git a/testdata/tsig_test.4 b/testdata/tsig_test.4
index f5b1a4b49..aab7b2434 100644
--- a/testdata/tsig_test.4
+++ b/testdata/tsig_test.4
@@ -58,3 +58,1171 @@ c7588400000100010000000203777777076578616d706c65036e65740000010001c00c0001000100
 endpacket
 
 tsig-verify-shared test.key 1750411954 0
+
+# www.example.net A
+packet
+c7580000000100000000000103777777076578616d706c65036e657400000100010000291000000000000000
+endpacket
+
+tsig-verify-reply test.key 1750421767 1 1
+c7588400000100010000000203777777076578616d706c65036e65740000010001c00c0001000100000e1000040a141e2800002904d00000000000000474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068555107012c0020a377c921817d4009a6ab35e7f84aa697751b3a976701e8fb6b843965325bf9bdc75800000000
+endpacket
+
+# www.example.net A
+packet
+c7580000000100000000000103777777076578616d706c65036e657400000100010000291000000000000000
+endpacket
+
+# the reply packet has a wrong tsig signature. The A record is modified.
+tsig-verify-reply test.key 1750421767 1 0
+c7588400000100010000000203777777076578616d706c65036e65740000010001c00c0001000100000e1000040a141e4800002904d00000000000000474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068555107012c0020a377c921817d4009a6ab35e7f84aa697751b3a976701e8fb6b843965325bf9bdc75800000000
+endpacket
+
+# example.com. AXFR
+packet
+74c400000001000000000001076578616d706c6503636f6d0000fc00010000291000000000000000
+endpacket
+
+tsig-sign-query test.key 1756302015 1
+
+check-packet
+74c400000001000000000002076578616d706c6503636f6d0000fc000100002910000000000000000474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068af0abf012c00207652f5647d92370be5ae6c5e748519845779e02ecdb95c5a0829b712c26563d374c400000000
+endpacket
+
+packet
+74c400000001000000000002076578616d706c6503636f6d0000fc000100002910000000000000000474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068af0abf012c00207652f5647d92370be5ae6c5e748519845779e02ecdb95c5a0829b712c26563d374c400000000
+endpacket
+
+tsig-sign-reply 1756302015 NOERROR 1
+74c484000001000200000001076578616d706c6503636f6d0000fc0001c00c0006000100000e100023c00c0a686f73746d6173746572c00c5cd7fffe00000e10000003840012750000000708c00c0001000100000e1000043ed26e0700002904d0000000000000
+endpacket
+
+check-packet
+74c484000001000200000002076578616d706c6503636f6d0000fc0001c00c0006000100000e100023c00c0a686f73746d6173746572c00c5cd7fffe00000e10000003840012750000000708c00c0001000100000e1000043ed26e0700002904d00000000000000474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068af0abf012c0020df2b53f8f88720570cd0cb8f31e315037d68e95c380674f5439793a576ef615e74c400000000
+endpacket
+
+packet
+74c400000001000000000001076578616d706c6503636f6d0000fc00010000291000000000000000
+endpacket
+
+tsig-verify-reply test.key 1756302015 1 1
+74c484000001000200000002076578616d706c6503636f6d0000fc0001c00c0006000100000e100023c00c0a686f73746d6173746572c00c5cd7fffe00000e10000003840012750000000708c00c0001000100000e1000043ed26e0700002904d00000000000000474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068af0abf012c0020df2b53f8f88720570cd0cb8f31e315037d68e95c380674f5439793a576ef615e74c400000000
+endpacket
+
+# tsig-sign-reply-xfr test.
+# The output was captured from NSD, with dig as querier. NSD and dig verified.
+# It signs an AXFR for example.com, every two RRs.
+# it was: dig @127.0.0.1 -p <port> +nocookie +noadflag -y hmac-sha256:test.key:K2tf3TRjvQkVCmJF3/Z9vA== example.com AXFR
+
+# the incoming query, example.com AXFR
+packet
+1c9600000001000000000002076578616d706c6503636f6d0000fc000100002910000000000000000474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c00202f017432ef8f8ef3dab9be9f9c4765eda7939f0485dfe384206e97e13acbd8f91c9600000000
+endpacket
+#      <number of packets> <time> <rcode for query process> <every nth>
+tsig-sign-reply-xfr 24 1757420114 NOERROR 1
+# packet 1
+# unsigned input before the TSIG is added
+# (without TSIG so, ARcount 02->01, RR TSIG 0474657374036b657900.. deleted.)
+packet
+1c9684000001000200000001076578616d706c6503636f6d0000fc0001c00c0006000100000e100023c00c0a686f73746d6173746572c00c5cd7fffe00000e10000003840012750000000708c00c0001000100000e1000043ed26e0700002904d0000000000000
+endpacket
+# call information of the TSIG routine.
+#    <timepoint> <expected function return value>
+call 1757420114 1
+# check for output packet that is the result of TSIG signature.
+check-packet
+1c9684000001000200000002076578616d706c6503636f6d0000fc0001c00c0006000100000e100023c00c0a686f73746d6173746572c00c5cd7fffe00000e10000003840012750000000708c00c0001000100000e1000043ed26e0700002904d00000000000000474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c00200fe349e19b5b3e952c097db0dfef9430734da92125ab1d4542d450774f352b4d1c9600000000
+endpacket
+
+# packet 2
+packet
+1c9684000000000200000000076578616d706c6503636f6d000002000100000e100005026e73c00cc00c000f000100000e1000070005026d78c00c
+endpacket
+call 1757420114 1
+check-packet
+1c9684000000000200000001076578616d706c6503636f6d000002000100000e100005026e73c00cc00c000f000100000e1000070005026d78c00c0474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c0020d03727ee94d091b5ae91ffb0b7aec23ad6f753571c66b958c0e5fca8ad49f9931c9600000000
+endpacket
+
+# packet 3
+packet
+1c96840000000002000000000131026161076578616d706c6503636f6d000001000100000e1000047f000001023130c00e0001000100000e1000047f000001
+endpacket
+call 1757420114 1
+check-packet
+1c96840000000002000000010131026161076578616d706c6503636f6d000001000100000e1000047f000001023130c00e0001000100000e1000047f0000010474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c0020e32db0e11c2084fbe37f0a7603ba35eca8ad24efeeea0a6ad0a9c5fac2d82fef1c9600000000
+endpacket
+
+# packet 4
+packet
+1c9684000000000200000000023131026161076578616d706c6503636f6d000001000100000e1000047f000001023132c00f0001000100000e1000047f000001
+endpacket
+call 1757420114 1
+check-packet
+1c9684000000000200000001023131026161076578616d706c6503636f6d000001000100000e1000047f000001023132c00f0001000100000e1000047f0000010474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c0020e38f1b5ff94189c0f1e43d12002f72fedd04842b9562036a890e434b28b01a361c9600000000
+endpacket
+
+# packet 5
+packet
+1c9684000000000200000000023133026161076578616d706c6503636f6d000001000100000e1000047f000001023134c00f0001000100000e1000047f000001
+endpacket
+call 1757420114 1
+check-packet
+1c9684000000000200000001023133026161076578616d706c6503636f6d000001000100000e1000047f000001023134c00f0001000100000e1000047f0000010474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c00209ec339cdb4ff11f704920aebc81decded09ddb6ff3e5181f3ef410fbc7074b201c9600000000
+endpacket
+
+# packet 6
+packet
+1c9684000000000200000000023135026161076578616d706c6503636f6d000001000100000e1000047f000001023136c00f0001000100000e1000047f000001
+endpacket
+call 1757420114 1
+check-packet
+1c9684000000000200000001023135026161076578616d706c6503636f6d000001000100000e1000047f000001023136c00f0001000100000e1000047f0000010474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c00209d4fc84ad670d95791fd281d8465213ff95432d18d920d3bba819ef8ef39307a1c9600000000
+endpacket
+
+# packet 7
+packet
+1c9684000000000200000000023137026161076578616d706c6503636f6d000001000100000e1000047f000001023138c00f0001000100000e1000047f000001
+endpacket
+call 1757420114 1
+check-packet
+1c9684000000000200000001023137026161076578616d706c6503636f6d000001000100000e1000047f000001023138c00f0001000100000e1000047f0000010474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c002085b43b7552da236e9e786a764797936dd35bf5b66240eda86b55b1401b7c89001c9600000000
+endpacket
+
+# packet 8
+packet
+1c9684000000000200000000023139026161076578616d706c6503636f6d000001000100000e1000047f0000010132c00f0001000100000e1000047f000001
+endpacket
+call 1757420114 1
+check-packet
+1c9684000000000200000001023139026161076578616d706c6503636f6d000001000100000e1000047f0000010132c00f0001000100000e1000047f0000010474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c0020c509d9d88403cd38de55041c25df3918094d2ba58d7aef3421894375145c9b481c9600000000
+endpacket
+
+# packet 9
+packet
+1c9684000000000200000000023230026161076578616d706c6503636f6d000001000100000e1000047f000001023231c00f0001000100000e1000047f000001
+endpacket
+call 1757420114 1
+check-packet
+1c9684000000000200000001023230026161076578616d706c6503636f6d000001000100000e1000047f000001023231c00f0001000100000e1000047f0000010474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c002035bb99b902597883326e520924197823afe67c16bc1277b76c0fe6a5c8df71481c9600000000
+endpacket
+
+# packet 10
+packet
+1c9684000000000200000000023232026161076578616d706c6503636f6d000001000100000e1000047f000001023233c00f0001000100000e1000047f000001
+endpacket
+call 1757420114 1
+check-packet
+1c9684000000000200000001023232026161076578616d706c6503636f6d000001000100000e1000047f000001023233c00f0001000100000e1000047f0000010474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c002076cabe0adbfd33dc0de403b12eb4ab6760a01e309590b2fcbf1feb58d2b9d2d21c9600000000
+endpacket
+
+# packet 11
+packet
+1c9684000000000200000000023234026161076578616d706c6503636f6d000001000100000e1000047f000001023235c00f0001000100000e1000047f000001
+endpacket
+call 1757420114 1
+check-packet
+1c9684000000000200000001023234026161076578616d706c6503636f6d000001000100000e1000047f000001023235c00f0001000100000e1000047f0000010474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c0020239b0438becc231a906e1b58871d708f8f2f6b4fa3d13d4c416e6a405261f7c11c9600000000
+endpacket
+
+# packet 12
+packet
+1c9684000000000200000000023236026161076578616d706c6503636f6d000001000100000e1000047f000001023237c00f0001000100000e1000047f000001
+endpacket
+call 1757420114 1
+check-packet
+1c9684000000000200000001023236026161076578616d706c6503636f6d000001000100000e1000047f000001023237c00f0001000100000e1000047f0000010474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c0020f7f700322f917f820711b19d0737ea883ef1f84df10fe43768ddeb208436a2c71c9600000000
+endpacket
+
+# packet 13
+packet
+1c9684000000000200000000023238026161076578616d706c6503636f6d000001000100000e1000047f000001023239c00f0001000100000e1000047f000001
+endpacket
+call 1757420114 1
+check-packet
+1c9684000000000200000001023238026161076578616d706c6503636f6d000001000100000e1000047f000001023239c00f0001000100000e1000047f0000010474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c0020734aeda53e0b3bba7adbc6f3107be3a1ca15c0519ef9bc4c358266b279e4a84c1c9600000000
+endpacket
+
+# packet 14
+packet
+1c96840000000002000000000133026161076578616d706c6503636f6d000001000100000e1000047f000001023330c00e0001000100000e1000047f000001
+endpacket
+call 1757420114 1
+check-packet
+1c96840000000002000000010133026161076578616d706c6503636f6d000001000100000e1000047f000001023330c00e0001000100000e1000047f0000010474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c00208bba7720eb76db59ca223e72e75161a51905ad7da75bfe87ea7e3f858e95a5e31c9600000000
+endpacket
+
+# packet 15
+packet
+1c96840000000002000000000134026161076578616d706c6503636f6d000001000100000e1000047f0000010135c00e0001000100000e1000047f000001
+endpacket
+call 1757420114 1
+check-packet
+1c96840000000002000000010134026161076578616d706c6503636f6d000001000100000e1000047f0000010135c00e0001000100000e1000047f0000010474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c0020bd18bd75f9b6073af2f0c2e3321530f18b48768881fc246e5485b7adf744e18f1c9600000000
+endpacket
+
+# packet 16
+packet
+1c96840000000002000000000136026161076578616d706c6503636f6d000001000100000e1000047f0000010137c00e0001000100000e1000047f000001
+endpacket
+call 1757420114 1
+check-packet
+1c96840000000002000000010136026161076578616d706c6503636f6d000001000100000e1000047f0000010137c00e0001000100000e1000047f0000010474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c00209bde6bd3ff63bcadc4987cb97056fefa57b6f2b62f0715d7f569ff2526c1cd7a1c9600000000
+endpacket
+
+# packet 17
+packet
+1c96840000000002000000000138026161076578616d706c6503636f6d000001000100000e1000047f0000010139c00e0001000100000e1000047f000001
+endpacket
+call 1757420114 1
+check-packet
+1c96840000000002000000010138026161076578616d706c6503636f6d000001000100000e1000047f0000010139c00e0001000100000e1000047f0000010474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c0020eb67e8b02e2e2464a688c420e5705e137ada69a9e56d65e1fb94fe4061a1bb091c9600000000
+endpacket
+
+# packet 18
+packet
+1c9684000000000200000000012a01630164076578616d706c6503636f6d000010000100000e1000222174657874207265636f72642077697468206d61696c207065726d697373696f6e73c00c000f000100000e1000070005026d78c012
+endpacket
+call 1757420114 1
+check-packet
+1c9684000000000200000001012a01630164076578616d706c6503636f6d000010000100000e1000222174657874207265636f72642077697468206d61696c207065726d697373696f6e73c00c000f000100000e1000070005026d78c0120474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c0020b529a10450c8fbf8582b18e1de1cd23470f09c77ec0b7d8fff783067dac7eca91c9600000000
+endpacket
+
+# packet 19
+packet
+1c968400000000020000000004646f6e65076578616d706c6503636f6d000001000100000e100004010101010166c0110027000100000e10001101780166076578616d706c6503636f6d00
+endpacket
+call 1757420114 1
+check-packet
+1c968400000000020000000104646f6e65076578616d706c6503636f6d000001000100000e100004010101010166c0110027000100000e10001101780166076578616d706c6503636f6d000474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c00207742d4b6f182ff0f547a0f192ef85f5e7167739768a83a669816145995bd0be61c9600000000
+endpacket
+
+# packet 20
+packet
+1c9684000000000200000000026d78076578616d706c6503636f6d000001000100000e1000043ed26e07026e73c00f0001000100000e1000043ed26e07
+endpacket
+call 1757420114 1
+check-packet
+1c9684000000000200000001026d78076578616d706c6503636f6d000001000100000e1000043ed26e07026e73c00f0001000100000e1000043ed26e070474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c00203139787980ff264c8a9eec8b90abe2456b10177a72d2ebc929e23c90c7af555b1c9600000000
+endpacket
+
+# packet 21
+packet
+1c9684000000000200000000027274076578616d706c6503636f6d000010000100000e1000130261620263640665662267682202696a026b6c03727432c00f0010000100000e10000d06616263646566056768696a6b
+endpacket
+call 1757420114 1
+check-packet
+1c9684000000000200000001027274076578616d706c6503636f6d000010000100000e1000130261620263640665662267682202696a026b6c03727432c00f0010000100000e10000d06616263646566056768696a6b0474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c0020bfedd8e7dd2cf2cfa4dd0eb2229c4aefe6e6efc6856aca79b1f2dbbf140f9eee1c9600000000
+endpacket
+
+# packet 22
+packet
+1c968400000000020000000003727433076578616d706c6503636f6d000010000100000e10001202616202636402656602676802696a026b6c03727434c0100010000100000e10000d06616263646566056768696a6b
+endpacket
+call 1757420114 1
+check-packet
+1c968400000000020000000103727433076578616d706c6503636f6d000010000100000e10001202616202636402656602676802696a026b6c03727434c0100010000100000e10000d06616263646566056768696a6b0474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c0020915c444174214b9876cbbfc2d5a3039af0a7a6e5a93eb592fa46436d48c732a81c9600000000
+endpacket
+
+# packet 23
+packet
+1c96840000000002000000000178076578616d706c6503636f6d000027000100000e10000f0179076578616d706c6503636f6d0003666f6f0179c00e0005000100000e10000704646f6e65c00e
+endpacket
+call 1757420114 1
+check-packet
+1c96840000000002000000010178076578616d706c6503636f6d000027000100000e10000f0179076578616d706c6503636f6d0003666f6f0179c00e0005000100000e10000704646f6e65c00e0474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c0020011049e9d4ab4cc0af1717e56077ff8a2be5030cb6b7b4a42aabe212dd7f34701c9600000000
+endpacket
+
+# packet 24
+packet
+1c9684000000000100000000076578616d706c6503636f6d000006000100000e100023c00c0a686f73746d6173746572c00c5cd7fffe00000e10000003840012750000000708
+endpacket
+call 1757420114 1
+check-packet
+1c9684000000000100000001076578616d706c6503636f6d000006000100000e100023c00c0a686f73746d6173746572c00c5cd7fffe00000e100000038400127500000007080474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c0020b2559f077753cfb86c254c472dcfeb9010f5c924098bd12101006cd661926f951c9600000000
+endpacket
+# end of tsig-sign-reply-xfr test, example.com AXFR.
+
+# tsig-verify-reply-xfr test, example.com AXFR.
+# same output as the previous test.
+# the query packet.
+packet
+1c9600000001000000000001076578616d706c6503636f6d0000fc00010000291000000000000000
+endpacket
+#   <number of packets> <keyname> <time> <tsig-sign-query result>
+tsig-verify-reply-xfr 24 test.key 1757420114 1
+
+# packet 1
+packet
+1c9684000001000200000002076578616d706c6503636f6d0000fc0001c00c0006000100000e100023c00c0a686f73746d6173746572c00c5cd7fffe00000e10000003840012750000000708c00c0001000100000e1000043ed26e0700002904d00000000000000474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c00200fe349e19b5b3e952c097db0dfef9430734da92125ab1d4542d450774f352b4d1c9600000000
+endpacket
+#   <time> <last_packet> <function result>
+call 1757420114 0 1
+
+# packet 2
+packet
+1c9684000000000200000001076578616d706c6503636f6d000002000100000e100005026e73c00cc00c000f000100000e1000070005026d78c00c0474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c0020d03727ee94d091b5ae91ffb0b7aec23ad6f753571c66b958c0e5fca8ad49f9931c9600000000
+endpacket
+call 1757420114 0 1
+
+# packet 3
+packet
+1c96840000000002000000010131026161076578616d706c6503636f6d000001000100000e1000047f000001023130c00e0001000100000e1000047f0000010474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c0020e32db0e11c2084fbe37f0a7603ba35eca8ad24efeeea0a6ad0a9c5fac2d82fef1c9600000000
+endpacket
+call 1757420114 0 1
+
+# packet 4
+packet
+1c9684000000000200000001023131026161076578616d706c6503636f6d000001000100000e1000047f000001023132c00f0001000100000e1000047f0000010474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c0020e38f1b5ff94189c0f1e43d12002f72fedd04842b9562036a890e434b28b01a361c9600000000
+endpacket
+call 1757420114 0 1
+
+# packet 5
+packet
+1c9684000000000200000001023133026161076578616d706c6503636f6d000001000100000e1000047f000001023134c00f0001000100000e1000047f0000010474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c00209ec339cdb4ff11f704920aebc81decded09ddb6ff3e5181f3ef410fbc7074b201c9600000000
+endpacket
+call 1757420114 0 1
+
+# packet 6
+packet
+1c9684000000000200000001023135026161076578616d706c6503636f6d000001000100000e1000047f000001023136c00f0001000100000e1000047f0000010474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c00209d4fc84ad670d95791fd281d8465213ff95432d18d920d3bba819ef8ef39307a1c9600000000
+endpacket
+call 1757420114 0 1
+
+# packet 7
+packet
+1c9684000000000200000001023137026161076578616d706c6503636f6d000001000100000e1000047f000001023138c00f0001000100000e1000047f0000010474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c002085b43b7552da236e9e786a764797936dd35bf5b66240eda86b55b1401b7c89001c9600000000
+endpacket
+call 1757420114 0 1
+
+# packet 8
+packet
+1c9684000000000200000001023139026161076578616d706c6503636f6d000001000100000e1000047f0000010132c00f0001000100000e1000047f0000010474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c0020c509d9d88403cd38de55041c25df3918094d2ba58d7aef3421894375145c9b481c9600000000
+endpacket
+call 1757420114 0 1
+
+# packet 9
+packet
+1c9684000000000200000001023230026161076578616d706c6503636f6d000001000100000e1000047f000001023231c00f0001000100000e1000047f0000010474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c002035bb99b902597883326e520924197823afe67c16bc1277b76c0fe6a5c8df71481c9600000000
+endpacket
+call 1757420114 0 1
+
+# packet 10
+packet
+1c9684000000000200000001023232026161076578616d706c6503636f6d000001000100000e1000047f000001023233c00f0001000100000e1000047f0000010474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c002076cabe0adbfd33dc0de403b12eb4ab6760a01e309590b2fcbf1feb58d2b9d2d21c9600000000
+endpacket
+call 1757420114 0 1
+
+# packet 11
+packet
+1c9684000000000200000001023234026161076578616d706c6503636f6d000001000100000e1000047f000001023235c00f0001000100000e1000047f0000010474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c0020239b0438becc231a906e1b58871d708f8f2f6b4fa3d13d4c416e6a405261f7c11c9600000000
+endpacket
+call 1757420114 0 1
+
+# packet 12
+packet
+1c9684000000000200000001023236026161076578616d706c6503636f6d000001000100000e1000047f000001023237c00f0001000100000e1000047f0000010474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c0020f7f700322f917f820711b19d0737ea883ef1f84df10fe43768ddeb208436a2c71c9600000000
+endpacket
+call 1757420114 0 1
+
+# packet 13
+packet
+1c9684000000000200000001023238026161076578616d706c6503636f6d000001000100000e1000047f000001023239c00f0001000100000e1000047f0000010474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c0020734aeda53e0b3bba7adbc6f3107be3a1ca15c0519ef9bc4c358266b279e4a84c1c9600000000
+endpacket
+call 1757420114 0 1
+
+# packet 14
+packet
+1c96840000000002000000010133026161076578616d706c6503636f6d000001000100000e1000047f000001023330c00e0001000100000e1000047f0000010474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c00208bba7720eb76db59ca223e72e75161a51905ad7da75bfe87ea7e3f858e95a5e31c9600000000
+endpacket
+call 1757420114 0 1
+
+# packet 15
+packet
+1c96840000000002000000010134026161076578616d706c6503636f6d000001000100000e1000047f0000010135c00e0001000100000e1000047f0000010474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c0020bd18bd75f9b6073af2f0c2e3321530f18b48768881fc246e5485b7adf744e18f1c9600000000
+endpacket
+call 1757420114 0 1
+
+# packet 16
+packet
+1c96840000000002000000010136026161076578616d706c6503636f6d000001000100000e1000047f0000010137c00e0001000100000e1000047f0000010474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c00209bde6bd3ff63bcadc4987cb97056fefa57b6f2b62f0715d7f569ff2526c1cd7a1c9600000000
+endpacket
+call 1757420114 0 1
+
+# packet 17
+packet
+1c96840000000002000000010138026161076578616d706c6503636f6d000001000100000e1000047f0000010139c00e0001000100000e1000047f0000010474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c0020eb67e8b02e2e2464a688c420e5705e137ada69a9e56d65e1fb94fe4061a1bb091c9600000000
+endpacket
+call 1757420114 0 1
+
+# packet 18
+packet
+1c9684000000000200000001012a01630164076578616d706c6503636f6d000010000100000e1000222174657874207265636f72642077697468206d61696c207065726d697373696f6e73c00c000f000100000e1000070005026d78c0120474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c0020b529a10450c8fbf8582b18e1de1cd23470f09c77ec0b7d8fff783067dac7eca91c9600000000
+endpacket
+call 1757420114 0 1
+
+# packet 19
+packet
+1c968400000000020000000104646f6e65076578616d706c6503636f6d000001000100000e100004010101010166c0110027000100000e10001101780166076578616d706c6503636f6d000474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c00207742d4b6f182ff0f547a0f192ef85f5e7167739768a83a669816145995bd0be61c9600000000
+endpacket
+call 1757420114 0 1
+
+# packet 20
+packet
+1c9684000000000200000001026d78076578616d706c6503636f6d000001000100000e1000043ed26e07026e73c00f0001000100000e1000043ed26e070474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c00203139787980ff264c8a9eec8b90abe2456b10177a72d2ebc929e23c90c7af555b1c9600000000
+endpacket
+call 1757420114 0 1
+
+# packet 21
+packet
+1c9684000000000200000001027274076578616d706c6503636f6d000010000100000e1000130261620263640665662267682202696a026b6c03727432c00f0010000100000e10000d06616263646566056768696a6b0474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c0020bfedd8e7dd2cf2cfa4dd0eb2229c4aefe6e6efc6856aca79b1f2dbbf140f9eee1c9600000000
+endpacket
+call 1757420114 0 1
+
+# packet 22
+packet
+1c968400000000020000000103727433076578616d706c6503636f6d000010000100000e10001202616202636402656602676802696a026b6c03727434c0100010000100000e10000d06616263646566056768696a6b0474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c0020915c444174214b9876cbbfc2d5a3039af0a7a6e5a93eb592fa46436d48c732a81c9600000000
+endpacket
+call 1757420114 0 1
+
+# packet 23
+packet
+1c96840000000002000000010178076578616d706c6503636f6d000027000100000e10000f0179076578616d706c6503636f6d0003666f6f0179c00e0005000100000e10000704646f6e65c00e0474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c0020011049e9d4ab4cc0af1717e56077ff8a2be5030cb6b7b4a42aabe212dd7f34701c9600000000
+endpacket
+call 1757420114 0 1
+
+# packet 24
+packet
+1c9684000000000100000001076578616d706c6503636f6d000006000100000e100023c00c0a686f73746d6173746572c00c5cd7fffe00000e100000038400127500000007080474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c0020b2559f077753cfb86c254c472dcfeb9010f5c924098bd12101006cd661926f951c9600000000
+endpacket
+call 1757420114 0 1
+# end of tsig-verify-reply-xfr test, example.com AXFR.
+
+# tsig-verify-reply-xfr test, example.com AXFR with TSIG every couple packets.
+# NTH was set at 4.
+# the query packet.
+packet
+d12000000001000000000001076578616d706c6503636f6d0000fc00010000291000000000000000
+endpacket
+#   <number of packets> <keyname> <time> <tsig-sign-query result>
+tsig-verify-reply-xfr 24 test.key 1757421911 1
+
+# packet 1
+packet
+d12084000001000200000002076578616d706c6503636f6d0000fc0001c00c0006000100000e100023c00c0a686f73746d6173746572c00c5cd7fffe00000e10000003840012750000000708c00c0001000100000e1000043ed26e0700002904d00000000000000474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c02157012c0020dd29a8bc7e01c33fe6ddd1b95106a5bb13a2e27e35a8a9084f48da3b0ad595e0d12000000000
+endpacket
+#   <time> <last_packet> <function result>
+call 1757421911 0 1
+
+# packet 2
+packet
+d12084000000000200000000076578616d706c6503636f6d000002000100000e100005026e73c00cc00c000f000100000e1000070005026d78c00c
+endpacket
+call 1757421911 0 1
+
+# packet 3
+packet
+d120840000000002000000000131026161076578616d706c6503636f6d000001000100000e1000047f000001023130c00e0001000100000e1000047f000001
+endpacket
+call 1757421911 0 1
+
+# packet 4
+packet
+d12084000000000200000000023131026161076578616d706c6503636f6d000001000100000e1000047f000001023132c00f0001000100000e1000047f000001
+endpacket
+call 1757421911 0 1
+
+# packet 5
+packet
+d12084000000000200000000023133026161076578616d706c6503636f6d000001000100000e1000047f000001023134c00f0001000100000e1000047f000001
+endpacket
+call 1757421911 0 1
+
+# packet 6
+packet
+d12084000000000200000001023135026161076578616d706c6503636f6d000001000100000e1000047f000001023136c00f0001000100000e1000047f0000010474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c02157012c00209ba6411fd41c6403c1d0984f90c2079cae8f7c457e6a5559d1a1babd9eeef8b1d12000000000
+endpacket
+call 1757421911 0 1
+
+# packet 7
+packet
+d12084000000000200000001023137026161076578616d706c6503636f6d000001000100000e1000047f000001023138c00f0001000100000e1000047f0000010474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c02157012c002082c714bcedf96f49586620cf9e73d9984ac36a0a54c4bb1528e2cbd431ffe775d12000000000
+endpacket
+call 1757421911 0 1
+
+# packet 8
+packet
+d12084000000000200000000023139026161076578616d706c6503636f6d000001000100000e1000047f0000010132c00f0001000100000e1000047f000001
+endpacket
+call 1757421911 0 1
+
+# packet 9
+packet
+d12084000000000200000000023230026161076578616d706c6503636f6d000001000100000e1000047f000001023231c00f0001000100000e1000047f000001
+endpacket
+call 1757421911 0 1
+
+# packet 10
+packet
+d12084000000000200000000023232026161076578616d706c6503636f6d000001000100000e1000047f000001023233c00f0001000100000e1000047f000001
+endpacket
+call 1757421911 0 1
+
+# packet 11
+packet
+d12084000000000200000000023234026161076578616d706c6503636f6d000001000100000e1000047f000001023235c00f0001000100000e1000047f000001
+endpacket
+call 1757421911 0 1
+
+# packet 12
+packet
+d12084000000000200000001023236026161076578616d706c6503636f6d000001000100000e1000047f000001023237c00f0001000100000e1000047f0000010474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c02157012c0020a34b68ac7d56fdd4b3f1ed3a035dac989053bf5ed9f046d13eedb413a84fb844d12000000000
+endpacket
+call 1757421911 0 1
+
+# packet 13
+packet
+d12084000000000200000001023238026161076578616d706c6503636f6d000001000100000e1000047f000001023239c00f0001000100000e1000047f0000010474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c02157012c00205058797ab79952d0c22c44be790425bd298693daa1b2b5cc370ff761a41ed402d12000000000
+endpacket
+call 1757421911 0 1
+
+# packet 14
+packet
+d120840000000002000000000133026161076578616d706c6503636f6d000001000100000e1000047f000001023330c00e0001000100000e1000047f000001
+endpacket
+call 1757421911 0 1
+
+# packet 15
+packet
+d120840000000002000000000134026161076578616d706c6503636f6d000001000100000e1000047f0000010135c00e0001000100000e1000047f000001
+endpacket
+call 1757421911 0 1
+
+# packet 16
+packet
+d120840000000002000000000136026161076578616d706c6503636f6d000001000100000e1000047f0000010137c00e0001000100000e1000047f000001
+endpacket
+call 1757421911 0 1
+
+# packet 17
+packet
+d120840000000002000000000138026161076578616d706c6503636f6d000001000100000e1000047f0000010139c00e0001000100000e1000047f000001
+endpacket
+call 1757421911 0 1
+
+# packet 18
+packet
+d12084000000000200000001012a01630164076578616d706c6503636f6d000010000100000e1000222174657874207265636f72642077697468206d61696c207065726d697373696f6e73c00c000f000100000e1000070005026d78c0120474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c02157012c0020872a86dff1391f04c17b3f0c6913bb2b737b7cb1d3e89b14743a7b9903a99d78d12000000000
+endpacket
+call 1757421911 0 1
+
+# packet 19
+packet
+d1208400000000020000000104646f6e65076578616d706c6503636f6d000001000100000e100004010101010166c0110027000100000e10001101780166076578616d706c6503636f6d000474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c02157012c002072518cba3d7810f7896213c33824fab2bc3bb9b6328d82131c1e895bc5f2c37cd12000000000
+endpacket
+call 1757421911 0 1
+
+# packet 20
+packet
+d12084000000000200000000026d78076578616d706c6503636f6d000001000100000e1000043ed26e07026e73c00f0001000100000e1000043ed26e07
+endpacket
+call 1757421911 0 1
+
+# packet 21
+packet
+d12084000000000200000000027274076578616d706c6503636f6d000010000100000e1000130261620263640665662267682202696a026b6c03727432c00f0010000100000e10000d06616263646566056768696a6b
+endpacket
+call 1757421911 0 1
+
+# packet 22
+packet
+d1208400000000020000000003727433076578616d706c6503636f6d000010000100000e10001202616202636402656602676802696a026b6c03727434c0100010000100000e10000d06616263646566056768696a6b
+endpacket
+call 1757421911 0 1
+
+# packet 23
+packet
+d120840000000002000000000178076578616d706c6503636f6d000027000100000e10000f0179076578616d706c6503636f6d0003666f6f0179c00e0005000100000e10000704646f6e65c00e
+endpacket
+call 1757421911 0 1
+
+# packet 24
+packet
+d12084000000000100000001076578616d706c6503636f6d000006000100000e100023c00c0a686f73746d6173746572c00c5cd7fffe00000e100000038400127500000007080474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c02157012c00208f301dac503efaa87b5210d2246eae90089e2b134b905fa044490265ef16c41bd12000000000
+endpacket
+call 1757421911 0 1
+# end of tsig-verify-reply-xfr test, example.com AXFR with TSIG every couple packets.
+
+# tsig-verify-reply-xfr test, example.com AXFR with TSIG every couple packets.
+# NTH was set at 3.
+# the query packet.
+packet
+60cb00000001000000000001076578616d706c6503636f6d0000fc00010000291000000000000000
+endpacket
+
+#   <number of packets> <keyname> <time> <tsig-sign-query result>
+tsig-verify-reply-xfr 24 test.key 1757422133 1
+
+# packet 1
+packet
+60cb84000001000200000002076578616d706c6503636f6d0000fc0001c00c0006000100000e100023c00c0a686f73746d6173746572c00c5cd7fffe00000e10000003840012750000000708c00c0001000100000e1000043ed26e0700002904d00000000000000474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c02235012c00209c5a5fbab1cc5e4940bb35f68be7b7b036204d8cf491e44b8545b95cf722a2b960cb00000000
+endpacket
+#   <time> <last_packet> <function result>
+call 1757422133 0 1
+
+# packet 2
+packet
+60cb84000000000200000000076578616d706c6503636f6d000002000100000e100005026e73c00cc00c000f000100000e1000070005026d78c00c
+endpacket
+call 1757422133 0 1
+
+# packet 3
+packet
+60cb840000000002000000000131026161076578616d706c6503636f6d000001000100000e1000047f000001023130c00e0001000100000e1000047f000001
+endpacket
+call 1757422133 0 1
+
+# packet 4
+packet
+60cb84000000000200000000023131026161076578616d706c6503636f6d000001000100000e1000047f000001023132c00f0001000100000e1000047f000001
+endpacket
+call 1757422133 0 1
+
+# packet 5
+packet
+60cb84000000000200000001023133026161076578616d706c6503636f6d000001000100000e1000047f000001023134c00f0001000100000e1000047f0000010474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c02235012c002036cfa989289413f0af566a8242ff1545ee7f4af2b90b894d295f6aa24eea526860cb00000000
+endpacket
+call 1757422133 0 1
+
+# packet 6
+packet
+60cb84000000000200000001023135026161076578616d706c6503636f6d000001000100000e1000047f000001023136c00f0001000100000e1000047f0000010474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c02235012c002021b2eae8d7b7b625d8350188b1d0c06237676a3be141f2c093daebdb72c1fe3f60cb00000000
+endpacket
+call 1757422133 0 1
+
+# packet 7
+packet
+60cb84000000000200000000023137026161076578616d706c6503636f6d000001000100000e1000047f000001023138c00f0001000100000e1000047f000001
+endpacket
+call 1757422133 0 1
+
+# packet 8
+packet
+60cb84000000000200000000023139026161076578616d706c6503636f6d000001000100000e1000047f0000010132c00f0001000100000e1000047f000001
+endpacket
+call 1757422133 0 1
+
+# packet 9
+packet
+60cb84000000000200000000023230026161076578616d706c6503636f6d000001000100000e1000047f000001023231c00f0001000100000e1000047f000001
+endpacket
+call 1757422133 0 1
+
+# packet 10
+packet
+60cb84000000000200000001023232026161076578616d706c6503636f6d000001000100000e1000047f000001023233c00f0001000100000e1000047f0000010474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c02235012c00203ef7a79e0752f09cfdf6b1fd50852da3a4946c99d930cbba57a7dcb9cd9f110460cb00000000
+endpacket
+call 1757422133 0 1
+
+# packet 11
+packet
+60cb84000000000200000001023234026161076578616d706c6503636f6d000001000100000e1000047f000001023235c00f0001000100000e1000047f0000010474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c02235012c002083ebfe2afaf6ab432e36053936046b57690b12d646334e74a1a24667ad2a38c760cb00000000
+endpacket
+call 1757422133 0 1
+
+# packet 12
+packet
+60cb84000000000200000000023236026161076578616d706c6503636f6d000001000100000e1000047f000001023237c00f0001000100000e1000047f000001
+endpacket
+call 1757422133 0 1
+
+# packet 13
+packet
+60cb84000000000200000000023238026161076578616d706c6503636f6d000001000100000e1000047f000001023239c00f0001000100000e1000047f000001
+endpacket
+call 1757422133 0 1
+
+# packet 14
+packet
+60cb840000000002000000000133026161076578616d706c6503636f6d000001000100000e1000047f000001023330c00e0001000100000e1000047f000001
+endpacket
+call 1757422133 0 1
+
+# packet 15
+packet
+60cb840000000002000000010134026161076578616d706c6503636f6d000001000100000e1000047f0000010135c00e0001000100000e1000047f0000010474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c02235012c002045107173bcff37124b427d0925aab1cb4c9b1e165b09025817106736ebee5eca60cb00000000
+endpacket
+call 1757422133 0 1
+
+# packet 16
+packet
+60cb840000000002000000010136026161076578616d706c6503636f6d000001000100000e1000047f0000010137c00e0001000100000e1000047f0000010474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c02235012c002092d7758a412a63df161051f8681492b78ff3e0de255317d7a2b6ef8177ff019a60cb00000000
+endpacket
+call 1757422133 0 1
+
+# packet 17
+packet
+60cb840000000002000000000138026161076578616d706c6503636f6d000001000100000e1000047f0000010139c00e0001000100000e1000047f000001
+endpacket
+call 1757422133 0 1
+
+# packet 18
+packet
+60cb84000000000200000000012a01630164076578616d706c6503636f6d000010000100000e1000222174657874207265636f72642077697468206d61696c207065726d697373696f6e73c00c000f000100000e1000070005026d78c012
+endpacket
+call 1757422133 0 1
+
+# packet 19
+packet
+60cb8400000000020000000004646f6e65076578616d706c6503636f6d000001000100000e100004010101010166c0110027000100000e10001101780166076578616d706c6503636f6d00
+endpacket
+call 1757422133 0 1
+
+# packet 20
+packet
+60cb84000000000200000001026d78076578616d706c6503636f6d000001000100000e1000043ed26e07026e73c00f0001000100000e1000043ed26e070474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c02235012c0020c73191b8f4a1c2a4328785a3696a6dc5509afd34a5eabf9e42db809c3fbf172d60cb00000000
+endpacket
+call 1757422133 0 1
+
+# packet 21
+packet
+60cb84000000000200000001027274076578616d706c6503636f6d000010000100000e1000130261620263640665662267682202696a026b6c03727432c00f0010000100000e10000d06616263646566056768696a6b0474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c02235012c0020a0961cd562bf092b4b846ca0e311ef4efef99e2b6fd7d7f8b94f179bc6815b0a60cb00000000
+endpacket
+call 1757422133 0 1
+
+# packet 22
+packet
+60cb8400000000020000000003727433076578616d706c6503636f6d000010000100000e10001202616202636402656602676802696a026b6c03727434c0100010000100000e10000d06616263646566056768696a6b
+endpacket
+call 1757422133 0 1
+
+# packet 23
+packet
+60cb840000000002000000000178076578616d706c6503636f6d000027000100000e10000f0179076578616d706c6503636f6d0003666f6f0179c00e0005000100000e10000704646f6e65c00e
+endpacket
+call 1757422133 0 1
+
+# packet 24
+packet
+60cb84000000000100000001076578616d706c6503636f6d000006000100000e100023c00c0a686f73746d6173746572c00c5cd7fffe00000e100000038400127500000007080474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c02235012c002085759d01ac59c0edbbdac8a194155504c3bc1089b0d1b81ff714ed63bd64b2bc60cb00000000
+endpacket
+call 1757422133 0 1
+# end of tsig-verify-reply-xfr test, example.com AXFR with TSIG every couple packets, with NTH 3.
+
+# tsig-sign-reply-xfr test, with sign every NTH 4.
+# the incoming query, example.com AXFR
+packet
+1c9600000001000000000002076578616d706c6503636f6d0000fc000100002910000000000000000474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c00202f017432ef8f8ef3dab9be9f9c4765eda7939f0485dfe384206e97e13acbd8f91c9600000000
+endpacket
+#      <number of packets> <time> <rcode for query process> <every nth>
+tsig-sign-reply-xfr 24 1757420114 NOERROR 4
+# packet 1
+# unsigned input before the TSIG is added
+# (without TSIG so, ARcount 02->01, RR TSIG 0474657374036b657900.. deleted.)
+packet
+1c9684000001000200000001076578616d706c6503636f6d0000fc0001c00c0006000100000e100023c00c0a686f73746d6173746572c00c5cd7fffe00000e10000003840012750000000708c00c0001000100000e1000043ed26e0700002904d0000000000000
+endpacket
+# call information of the TSIG routine.
+#    <timepoint> <expected function return value>
+call 1757420114 1
+# check for output packet that is the result of TSIG signature.
+check-packet
+1c9684000001000200000002076578616d706c6503636f6d0000fc0001c00c0006000100000e100023c00c0a686f73746d6173746572c00c5cd7fffe00000e10000003840012750000000708c00c0001000100000e1000043ed26e0700002904d00000000000000474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c00200fe349e19b5b3e952c097db0dfef9430734da92125ab1d4542d450774f352b4d1c9600000000
+endpacket
+
+# packet 2
+packet
+1c9684000000000200000000076578616d706c6503636f6d000002000100000e100005026e73c00cc00c000f000100000e1000070005026d78c00c
+endpacket
+call 1757420114 1
+check-packet
+1c9684000000000200000000076578616d706c6503636f6d000002000100000e100005026e73c00cc00c000f000100000e1000070005026d78c00c
+endpacket
+
+# packet 3
+packet
+1c96840000000002000000000131026161076578616d706c6503636f6d000001000100000e1000047f000001023130c00e0001000100000e1000047f000001
+endpacket
+call 1757420114 1
+check-packet
+1c96840000000002000000000131026161076578616d706c6503636f6d000001000100000e1000047f000001023130c00e0001000100000e1000047f000001
+endpacket
+
+# packet 4
+packet
+1c9684000000000200000000023131026161076578616d706c6503636f6d000001000100000e1000047f000001023132c00f0001000100000e1000047f000001
+endpacket
+call 1757420114 1
+check-packet
+1c9684000000000200000000023131026161076578616d706c6503636f6d000001000100000e1000047f000001023132c00f0001000100000e1000047f000001
+endpacket
+
+# packet 5
+packet
+1c9684000000000200000000023133026161076578616d706c6503636f6d000001000100000e1000047f000001023134c00f0001000100000e1000047f000001
+endpacket
+call 1757420114 1
+check-packet
+1C9684000000000200000001023133026161076578616D706C6503636F6D000001000100000E1000047F000001023134C00F0001000100000E1000047F0000010474657374036B65790000FA00FF00000000003D0B686D61632D73686132353600000068C01A52012C0020EA1EA499445B22973D520C943E9C74862BC6199756C6EEEAEDB910B5B95F5DDE1C9600000000
+endpacket
+
+# packet 6
+packet
+1c9684000000000200000000023135026161076578616d706c6503636f6d000001000100000e1000047f000001023136c00f0001000100000e1000047f000001
+endpacket
+call 1757420114 1
+check-packet
+1c9684000000000200000000023135026161076578616d706c6503636f6d000001000100000e1000047f000001023136c00f0001000100000e1000047f000001
+endpacket
+
+# packet 7
+packet
+1c9684000000000200000000023137026161076578616d706c6503636f6d000001000100000e1000047f000001023138c00f0001000100000e1000047f000001
+endpacket
+call 1757420114 1
+check-packet
+1c9684000000000200000000023137026161076578616d706c6503636f6d000001000100000e1000047f000001023138c00f0001000100000e1000047f000001
+endpacket
+
+# packet 8
+packet
+1c9684000000000200000000023139026161076578616d706c6503636f6d000001000100000e1000047f0000010132c00f0001000100000e1000047f000001
+endpacket
+call 1757420114 1
+check-packet
+1c9684000000000200000000023139026161076578616d706c6503636f6d000001000100000e1000047f0000010132c00f0001000100000e1000047f000001
+endpacket
+
+# packet 9
+packet
+1c9684000000000200000000023230026161076578616d706c6503636f6d000001000100000e1000047f000001023231c00f0001000100000e1000047f000001
+endpacket
+call 1757420114 1
+check-packet
+1C9684000000000200000001023230026161076578616D706C6503636F6D000001000100000E1000047F000001023231C00F0001000100000E1000047F0000010474657374036B65790000FA00FF00000000003D0B686D61632D73686132353600000068C01A52012C00206BE65187F773EA73C625ADF32ECA31BD924B12BA2D5FAAB19E889D71D6E491F91C9600000000
+endpacket
+
+# packet 10
+packet
+1c9684000000000200000000023232026161076578616d706c6503636f6d000001000100000e1000047f000001023233c00f0001000100000e1000047f000001
+endpacket
+call 1757420114 1
+check-packet
+1c9684000000000200000000023232026161076578616d706c6503636f6d000001000100000e1000047f000001023233c00f0001000100000e1000047f000001
+endpacket
+
+# packet 11
+packet
+1c9684000000000200000000023234026161076578616d706c6503636f6d000001000100000e1000047f000001023235c00f0001000100000e1000047f000001
+endpacket
+call 1757420114 1
+check-packet
+1c9684000000000200000000023234026161076578616d706c6503636f6d000001000100000e1000047f000001023235c00f0001000100000e1000047f000001
+endpacket
+
+# packet 12
+packet
+1c9684000000000200000000023236026161076578616d706c6503636f6d000001000100000e1000047f000001023237c00f0001000100000e1000047f000001
+endpacket
+call 1757420114 1
+check-packet
+1c9684000000000200000000023236026161076578616d706c6503636f6d000001000100000e1000047f000001023237c00f0001000100000e1000047f000001
+endpacket
+
+# packet 13
+packet
+1c9684000000000200000000023238026161076578616d706c6503636f6d000001000100000e1000047f000001023239c00f0001000100000e1000047f000001
+endpacket
+call 1757420114 1
+check-packet
+1C9684000000000200000001023238026161076578616D706C6503636F6D000001000100000E1000047F000001023239C00F0001000100000E1000047F0000010474657374036B65790000FA00FF00000000003D0B686D61632D73686132353600000068C01A52012C00206B1322C8E58155267B7A4FBBEA955EAF6D9A84C64AC3DCC32F155823C6F76F111C9600000000
+endpacket
+
+# packet 14
+packet
+1c96840000000002000000000133026161076578616d706c6503636f6d000001000100000e1000047f000001023330c00e0001000100000e1000047f000001
+endpacket
+call 1757420114 1
+check-packet
+1c96840000000002000000000133026161076578616d706c6503636f6d000001000100000e1000047f000001023330c00e0001000100000e1000047f000001
+endpacket
+
+# packet 15
+packet
+1c96840000000002000000000134026161076578616d706c6503636f6d000001000100000e1000047f0000010135c00e0001000100000e1000047f000001
+endpacket
+call 1757420114 1
+check-packet
+1c96840000000002000000000134026161076578616d706c6503636f6d000001000100000e1000047f0000010135c00e0001000100000e1000047f000001
+endpacket
+
+# packet 16
+packet
+1c96840000000002000000000136026161076578616d706c6503636f6d000001000100000e1000047f0000010137c00e0001000100000e1000047f000001
+endpacket
+call 1757420114 1
+check-packet
+1c96840000000002000000000136026161076578616d706c6503636f6d000001000100000e1000047f0000010137c00e0001000100000e1000047f000001
+endpacket
+
+# packet 17
+packet
+1c96840000000002000000000138026161076578616d706c6503636f6d000001000100000e1000047f0000010139c00e0001000100000e1000047f000001
+endpacket
+call 1757420114 1
+check-packet
+1C96840000000002000000010138026161076578616D706C6503636F6D000001000100000E1000047F0000010139C00E0001000100000E1000047F0000010474657374036B65790000FA00FF00000000003D0B686D61632D73686132353600000068C01A52012C00209103348E4D403BCC1EC78E8CCAA664DCE265114FAD039BCC026A75C5F774924C1C9600000000
+endpacket
+
+# packet 18
+packet
+1c9684000000000200000000012a01630164076578616d706c6503636f6d000010000100000e1000222174657874207265636f72642077697468206d61696c207065726d697373696f6e73c00c000f000100000e1000070005026d78c012
+endpacket
+call 1757420114 1
+check-packet
+1c9684000000000200000000012a01630164076578616d706c6503636f6d000010000100000e1000222174657874207265636f72642077697468206d61696c207065726d697373696f6e73c00c000f000100000e1000070005026d78c012
+endpacket
+
+# packet 19
+packet
+1c968400000000020000000004646f6e65076578616d706c6503636f6d000001000100000e100004010101010166c0110027000100000e10001101780166076578616d706c6503636f6d00
+endpacket
+call 1757420114 1
+check-packet
+1c968400000000020000000004646f6e65076578616d706c6503636f6d000001000100000e100004010101010166c0110027000100000e10001101780166076578616d706c6503636f6d00
+endpacket
+
+# packet 20
+packet
+1c9684000000000200000000026d78076578616d706c6503636f6d000001000100000e1000043ed26e07026e73c00f0001000100000e1000043ed26e07
+endpacket
+call 1757420114 1
+check-packet
+1c9684000000000200000000026d78076578616d706c6503636f6d000001000100000e1000043ed26e07026e73c00f0001000100000e1000043ed26e07
+endpacket
+
+# packet 21
+packet
+1c9684000000000200000000027274076578616d706c6503636f6d000010000100000e1000130261620263640665662267682202696a026b6c03727432c00f0010000100000e10000d06616263646566056768696a6b
+endpacket
+call 1757420114 1
+check-packet
+1C9684000000000200000001027274076578616D706C6503636F6D000010000100000E1000130261620263640665662267682202696A026B6C03727432C00F0010000100000E10000D06616263646566056768696A6B0474657374036B65790000FA00FF00000000003D0B686D61632D73686132353600000068C01A52012C0020991A6D7C00BAF001961905D3977AEDB8205C0301EAE0B66D0E79580FD7E4AFBA1C9600000000
+endpacket
+
+# packet 22
+packet
+1c968400000000020000000003727433076578616d706c6503636f6d000010000100000e10001202616202636402656602676802696a026b6c03727434c0100010000100000e10000d06616263646566056768696a6b
+endpacket
+call 1757420114 1
+check-packet
+1c968400000000020000000003727433076578616d706c6503636f6d000010000100000e10001202616202636402656602676802696a026b6c03727434c0100010000100000e10000d06616263646566056768696a6b
+endpacket
+
+# packet 23
+packet
+1c96840000000002000000000178076578616d706c6503636f6d000027000100000e10000f0179076578616d706c6503636f6d0003666f6f0179c00e0005000100000e10000704646f6e65c00e
+endpacket
+call 1757420114 1
+check-packet
+1c96840000000002000000000178076578616d706c6503636f6d000027000100000e10000f0179076578616d706c6503636f6d0003666f6f0179c00e0005000100000e10000704646f6e65c00e
+endpacket
+
+# packet 24
+packet
+1c9684000000000100000000076578616d706c6503636f6d000006000100000e100023c00c0a686f73746d6173746572c00c5cd7fffe00000e10000003840012750000000708
+endpacket
+call 1757420114 1
+check-packet
+1C9684000000000100000001076578616D706C6503636F6D000006000100000E100023C00C0A686F73746D6173746572C00C5CD7FFFE00000E100000038400127500000007080474657374036B65790000FA00FF00000000003D0B686D61632D73686132353600000068C01A52012C002016157B504809CE8A6BD6E785C431A6D784787B41BEBC0FB3F83CEB7D5E2722F01C9600000000
+endpacket
+# end of tsig-sign-reply-xfr test, example.com AXFR, with sign every NTH 4.
+
+# tsig-verify-reply-xfr test, example.com AXFR with TSIG every NTH from
+# signed sequence
+# The signed sequence is from tsig-sign-reply-xfr.
+# the query packet.
+packet
+1c9600000001000000000001076578616d706c6503636f6d0000fc00010000291000000000000000
+endpacket
+
+#   <number of packets> <keyname> <time> <tsig-sign-query result>
+tsig-verify-reply-xfr 24 test.key 1757420114 1
+
+# packet 1
+packet
+1c9684000001000200000002076578616d706c6503636f6d0000fc0001c00c0006000100000e100023c00c0a686f73746d6173746572c00c5cd7fffe00000e10000003840012750000000708c00c0001000100000e1000043ed26e0700002904d00000000000000474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c00200fe349e19b5b3e952c097db0dfef9430734da92125ab1d4542d450774f352b4d1c9600000000
+endpacket
+#   <time> <last_packet> <function result>
+call 1757420114 0 1
+
+# packet 2
+packet
+1c9684000000000200000000076578616d706c6503636f6d000002000100000e100005026e73c00cc00c000f000100000e1000070005026d78c00c
+endpacket
+#   <time> <last_packet> <function result>
+call 1757420114 0 1
+
+# packet 3
+packet
+1c96840000000002000000000131026161076578616d706c6503636f6d000001000100000e1000047f000001023130c00e0001000100000e1000047f000001
+endpacket
+#   <time> <last_packet> <function result>
+call 1757420114 0 1
+
+# packet 4
+packet
+1c9684000000000200000000023131026161076578616d706c6503636f6d000001000100000e1000047f000001023132c00f0001000100000e1000047f000001
+endpacket
+#   <time> <last_packet> <function result>
+call 1757420114 0 1
+
+# packet 5
+packet
+1C9684000000000200000001023133026161076578616D706C6503636F6D000001000100000E1000047F000001023134C00F0001000100000E1000047F0000010474657374036B65790000FA00FF00000000003D0B686D61632D73686132353600000068C01A52012C0020EA1EA499445B22973D520C943E9C74862BC6199756C6EEEAEDB910B5B95F5DDE1C9600000000
+endpacket
+#   <time> <last_packet> <function result>
+call 1757420114 0 1
+
+# packet 6
+packet
+1c9684000000000200000000023135026161076578616d706c6503636f6d000001000100000e1000047f000001023136c00f0001000100000e1000047f000001
+endpacket
+#   <time> <last_packet> <function result>
+call 1757420114 0 1
+
+# packet 7
+packet
+1c9684000000000200000000023137026161076578616d706c6503636f6d000001000100000e1000047f000001023138c00f0001000100000e1000047f000001
+endpacket
+#   <time> <last_packet> <function result>
+call 1757420114 0 1
+
+# packet 8
+packet
+1c9684000000000200000000023139026161076578616d706c6503636f6d000001000100000e1000047f0000010132c00f0001000100000e1000047f000001
+endpacket
+#   <time> <last_packet> <function result>
+call 1757420114 0 1
+
+# packet 9
+packet
+1C9684000000000200000001023230026161076578616D706C6503636F6D000001000100000E1000047F000001023231C00F0001000100000E1000047F0000010474657374036B65790000FA00FF00000000003D0B686D61632D73686132353600000068C01A52012C00206BE65187F773EA73C625ADF32ECA31BD924B12BA2D5FAAB19E889D71D6E491F91C9600000000
+endpacket
+#   <time> <last_packet> <function result>
+call 1757420114 0 1
+
+# packet 10
+packet
+1c9684000000000200000000023232026161076578616d706c6503636f6d000001000100000e1000047f000001023233c00f0001000100000e1000047f000001
+endpacket
+#   <time> <last_packet> <function result>
+call 1757420114 0 1
+
+# packet 11
+packet
+1c9684000000000200000000023234026161076578616d706c6503636f6d000001000100000e1000047f000001023235c00f0001000100000e1000047f000001
+endpacket
+#   <time> <last_packet> <function result>
+call 1757420114 0 1
+
+# packet 12
+packet
+1c9684000000000200000000023236026161076578616d706c6503636f6d000001000100000e1000047f000001023237c00f0001000100000e1000047f000001
+endpacket
+#   <time> <last_packet> <function result>
+call 1757420114 0 1
+
+# packet 13
+packet
+1C9684000000000200000001023238026161076578616D706C6503636F6D000001000100000E1000047F000001023239C00F0001000100000E1000047F0000010474657374036B65790000FA00FF00000000003D0B686D61632D73686132353600000068C01A52012C00206B1322C8E58155267B7A4FBBEA955EAF6D9A84C64AC3DCC32F155823C6F76F111C9600000000
+endpacket
+#   <time> <last_packet> <function result>
+call 1757420114 0 1
+
+# packet 14
+packet
+1c96840000000002000000000133026161076578616d706c6503636f6d000001000100000e1000047f000001023330c00e0001000100000e1000047f000001
+endpacket
+#   <time> <last_packet> <function result>
+call 1757420114 0 1
+
+# packet 15
+packet
+1c96840000000002000000000134026161076578616d706c6503636f6d000001000100000e1000047f0000010135c00e0001000100000e1000047f000001
+endpacket
+#   <time> <last_packet> <function result>
+call 1757420114 0 1
+
+# packet 16
+packet
+1c96840000000002000000000136026161076578616d706c6503636f6d000001000100000e1000047f0000010137c00e0001000100000e1000047f000001
+endpacket
+#   <time> <last_packet> <function result>
+call 1757420114 0 1
+
+# packet 17
+packet
+1C96840000000002000000010138026161076578616D706C6503636F6D000001000100000E1000047F0000010139C00E0001000100000E1000047F0000010474657374036B65790000FA00FF00000000003D0B686D61632D73686132353600000068C01A52012C00209103348E4D403BCC1EC78E8CCAA664DCE265114FAD039BCC026A75C5F774924C1C9600000000
+endpacket
+#   <time> <last_packet> <function result>
+call 1757420114 0 1
+
+# packet 18
+packet
+1c9684000000000200000000012a01630164076578616d706c6503636f6d000010000100000e1000222174657874207265636f72642077697468206d61696c207065726d697373696f6e73c00c000f000100000e1000070005026d78c012
+endpacket
+#   <time> <last_packet> <function result>
+call 1757420114 0 1
+
+# packet 19
+packet
+1c968400000000020000000004646f6e65076578616d706c6503636f6d000001000100000e100004010101010166c0110027000100000e10001101780166076578616d706c6503636f6d00
+endpacket
+#   <time> <last_packet> <function result>
+call 1757420114 0 1
+
+# packet 20
+packet
+1c9684000000000200000000026d78076578616d706c6503636f6d000001000100000e1000043ed26e07026e73c00f0001000100000e1000043ed26e07
+endpacket
+#   <time> <last_packet> <function result>
+call 1757420114 0 1
+
+# packet 21
+packet
+1C9684000000000200000001027274076578616D706C6503636F6D000010000100000E1000130261620263640665662267682202696A026B6C03727432C00F0010000100000E10000D06616263646566056768696A6B0474657374036B65790000FA00FF00000000003D0B686D61632D73686132353600000068C01A52012C0020991A6D7C00BAF001961905D3977AEDB8205C0301EAE0B66D0E79580FD7E4AFBA1C9600000000
+endpacket
+#   <time> <last_packet> <function result>
+call 1757420114 0 1
+
+# packet 22
+packet
+1c968400000000020000000003727433076578616d706c6503636f6d000010000100000e10001202616202636402656602676802696a026b6c03727434c0100010000100000e10000d06616263646566056768696a6b
+endpacket
+#   <time> <last_packet> <function result>
+call 1757420114 0 1
+
+# packet 23
+packet
+1c96840000000002000000000178076578616d706c6503636f6d000027000100000e10000f0179076578616d706c6503636f6d0003666f6f0179c00e0005000100000e10000704646f6e65c00e
+endpacket
+#   <time> <last_packet> <function result>
+call 1757420114 0 1
+
+# packet 24
+packet
+1C9684000000000100000001076578616D706C6503636F6D000006000100000E100023C00C0A686F73746D6173746572C00C5CD7FFFE00000E100000038400127500000007080474657374036B65790000FA00FF00000000003D0B686D61632D73686132353600000068C01A52012C002016157B504809CE8A6BD6E785C431A6D784787B41BEBC0FB3F83CEB7D5E2722F01C9600000000
+endpacket
+#   <time> <last_packet> <function result>
+call 1757420114 1 1
+# end of tsig-verify-reply-xfr test, example.com AXFR with TSIG every NTH from
+# signed sequence
+
+# sign a notify packet for example.com.
+packet
+000020000001000000000000076578616D706C6503636F6D0000010001
+endpacket
+tsig-sign-query test.key 1757593030 1
+check-packet
+000020000001000000000001076578616d706c6503636f6d00000100010474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c2bdc6012c00209bdc68a4db494e6e9d9cd6c50a7925e237d02431f7330a574d32f49fb3862a7f000000000000
+endpacket
diff --git a/testdata/tsig_test.5 b/testdata/tsig_test.5
index 5cfcb59ce..ba9253a0f 100644
--- a/testdata/tsig_test.5
+++ b/testdata/tsig_test.5
@@ -46,3 +46,12 @@ endpacket
 check-packet
 aafc8400000100010000000203777777076578616d706c65036e65740000010001c00c0001000100000e1000040a141e2800002904d00000000000000474657374036b65790000fa00ff00000000004d0b686d61632d73686133383400000068555139012c00301e895712f5633d84e82afd7b1dcdd792c5d51532c7a5f52701c9bd464f0d8f6cc735530d16417e8bf3cf104808554642aafc00000000
 endpacket
+
+# www.example.net A
+packet
+aafc0000000100000000000103777777076578616d706c65036e657400000100010000291000000000000000
+endpacket
+
+tsig-verify-reply test.key 1750421817 1 1
+aafc8400000100010000000203777777076578616d706c65036e65740000010001c00c0001000100000e1000040a141e2800002904d00000000000000474657374036b65790000fa00ff00000000004d0b686d61632d73686133383400000068555139012c00301e895712f5633d84e82afd7b1dcdd792c5d51532c7a5f52701c9bd464f0d8f6cc735530d16417e8bf3cf104808554642aafc00000000
+endpacket
diff --git a/testdata/tsig_test.6 b/testdata/tsig_test.6
index e04a07f90..efe15d73b 100644
--- a/testdata/tsig_test.6
+++ b/testdata/tsig_test.6
@@ -46,3 +46,12 @@ endpacket
 check-packet
 e74d8400000100010000000203777777076578616d706c65036e65740000010001c00c0001000100000e1000040a141e2800002904d00000000000000474657374036b65790000fa00ff00000000005d0b686d61632d7368613531320000006855516b012c0040690c00d5e01a382b7a4c07739e0faab1a3c98f5bae1b49213032b7da070c4b985056894e1ebc88468d5d070d0589ea8032fb88f3a1902fa91211d2b4989bbb93e74d00000000
 endpacket
+
+# www.example.net A
+packet
+e74d0000000100000000000103777777076578616d706c65036e657400000100010000291000000000000000
+endpacket
+
+tsig-verify-reply test.key 1750421867 1 1
+e74d8400000100010000000203777777076578616d706c65036e65740000010001c00c0001000100000e1000040a141e2800002904d00000000000000474657374036b65790000fa00ff00000000005d0b686d61632d7368613531320000006855516b012c0040690c00d5e01a382b7a4c07739e0faab1a3c98f5bae1b49213032b7da070c4b985056894e1ebc88468d5d070d0589ea8032fb88f3a1902fa91211d2b4989bbb93e74d00000000
+endpacket
diff --git a/testdata/ttl_zero_cacherep.rpl b/testdata/ttl_zero_cacherep.rpl
new file mode 100644
index 000000000..fe6f9dcc7
--- /dev/null
+++ b/testdata/ttl_zero_cacherep.rpl
@@ -0,0 +1,269 @@
+; config options
+server:
+	target-fetch-policy: "0 0 0 0 0"
+	prefetch: no
+	serve-expired: no
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test TTL for the last zero second of cached messages.
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN A
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+a.gtld-servers.net.	IN A
+SECTION ANSWER
+a.gtld-servers.net.	IN A	192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+K.ROOT-SERVERS.NET.	IN	A
+SECTION ANSWER
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+a.gtld-servers.net.	IN AAAA
+SECTION AUTHORITY
+. 86400 IN SOA . . 20070304 28800 7200 604800 86400
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+K.ROOT-SERVERS.NET.	IN	AAAA
+SECTION AUTHORITY
+. 86400 IN SOA . . 20070304 28800 7200 604800 86400
+ENTRY_END
+
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 300
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. 10	IN A 1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com
+RANGE_BEGIN 100 300
+	ADDRESS 1.2.3.4
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA REFUSED
+SECTION QUESTION
+example.com. IN NS
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA REFUSED
+SECTION QUESTION
+ns.example.com. IN A
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA REFUSED
+SECTION QUESTION
+ns.example.com. IN AAAA
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR REFUSED
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+RANGE_END
+
+STEP 1 TIME_PASSES ELAPSE 10
+
+STEP 10 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+STEP 20 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ttl
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. 10 IN A 1.2.3.4
+ENTRY_END
+
+STEP 30 TIME_PASSES ELAPSE 5
+
+STEP 40 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+STEP 50 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ttl
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. 5 IN A 1.2.3.4
+ENTRY_END
+
+STEP 60 TIME_PASSES ELAPSE 3
+
+STEP 70 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+STEP 80 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ttl
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. 2 IN A 1.2.3.4
+ENTRY_END
+
+STEP 90 TIME_PASSES ELAPSE 1
+
+STEP 100 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+STEP 110 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ttl
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. 1 IN A 1.2.3.4
+ENTRY_END
+
+STEP 120 TIME_PASSES ELAPSE 1
+
+STEP 130 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+STEP 140 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ttl
+REPLY QR RD RA SERVFAIL
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+ENTRY_END
+
+SCENARIO_END
diff --git a/util/config_file.c b/util/config_file.c
index 53d90bee6..c328c147a 100644
--- a/util/config_file.c
+++ b/util/config_file.c
@@ -129,6 +129,7 @@ config_create(void)
 	cfg->tls_cert_bundle = NULL;
 	cfg->tls_win_cert = 0;
 	cfg->tls_use_sni = 1;
+	cfg->tls_use_system_policy_versions = 0;
 	cfg->https_port = UNBOUND_DNS_OVER_HTTPS_PORT;
 	if(!(cfg->http_endpoint = strdup("/dns-query"))) goto error_exit;
 	cfg->http_max_streams = 100;
@@ -632,6 +633,7 @@ int config_set_option(struct config_file* cfg, const char* opt,
 	else S_STR("tls-ciphers:", tls_ciphers)
 	else S_STR("tls-ciphersuites:", tls_ciphersuites)
 	else S_YNO("tls-use-sni:", tls_use_sni)
+	else S_YNO("tls-use-system-policy-versions:", tls_use_system_policy_versions)
 	else S_NUMBER_NONZERO("https-port:", https_port)
 	else S_STR("http-endpoint:", http_endpoint)
 	else S_NUMBER_NONZERO("http-max-streams:", http_max_streams)
@@ -1185,6 +1187,7 @@ config_get_option(struct config_file* cfg, const char* opt,
 	else O_STR(opt, "tls-ciphers", tls_ciphers)
 	else O_STR(opt, "tls-ciphersuites", tls_ciphersuites)
 	else O_YNO(opt, "tls-use-sni", tls_use_sni)
+	else O_YNO(opt, "tls-use-system-policy-versions", tls_use_system_policy_versions)
 	else O_DEC(opt, "https-port", https_port)
 	else O_STR(opt, "http-endpoint", http_endpoint)
 	else O_UNS(opt, "http-max-streams", http_max_streams)
@@ -1646,6 +1649,8 @@ config_delauth(struct config_auth* p)
 	config_delstrlist(p->masters);
 	config_delstrlist(p->urls);
 	config_delstrlist(p->allow_notify);
+	config_deldblstrlist(p->masters_tsig);
+	config_deldblstrlist(p->allow_notify_tsig);
 	free(p->zonefile);
 	free(p->rpz_taglist);
 	free(p->rpz_action_override);
diff --git a/util/config_file.h b/util/config_file.h
index 813226344..99500ab3d 100644
--- a/util/config_file.h
+++ b/util/config_file.h
@@ -149,6 +149,8 @@ struct config_file {
 	char* tls_ciphersuites;
 	/** if SNI is to be used */
 	int tls_use_sni;
+	/** if all TLS versions can be used; based on system policy (if any) */
+	int tls_use_system_policy_versions;
 
 	/** port on which to provide DNS over HTTPS service */
 	int https_port;
@@ -856,6 +858,10 @@ struct config_auth {
 	struct config_strlist* urls;
 	/** list of allow-notify */
 	struct config_strlist* allow_notify;
+	/** list of masters with tsig key */
+	struct config_str2list* masters_tsig;
+	/** list of allow-notify with tsig key */
+	struct config_str2list* allow_notify_tsig;
 	/** zonefile (or NULL) */
 	char* zonefile;
 	/** provide downstream answers */
diff --git a/util/configlexer.lex b/util/configlexer.lex
index de84b18c1..2268e3e65 100644
--- a/util/configlexer.lex
+++ b/util/configlexer.lex
@@ -262,6 +262,7 @@ tls-session-ticket-keys{COLON}	{ YDVAR(1, VAR_TLS_SESSION_TICKET_KEYS) }
 tls-ciphers{COLON}		{ YDVAR(1, VAR_TLS_CIPHERS) }
 tls-ciphersuites{COLON}		{ YDVAR(1, VAR_TLS_CIPHERSUITES) }
 tls-use-sni{COLON}		{ YDVAR(1, VAR_TLS_USE_SNI) }
+tls-use-system-policy-versions{COLON}		{ YDVAR(1, VAR_TLS_USE_SYSTEM_POLICY_VERSIONS) }
 https-port{COLON}		{ YDVAR(1, VAR_HTTPS_PORT) }
 http-endpoint{COLON}		{ YDVAR(1, VAR_HTTP_ENDPOINT) }
 http-max-streams{COLON}		{ YDVAR(1, VAR_HTTP_MAX_STREAMS) }
@@ -363,8 +364,11 @@ rpz-signal-nxdomain-ra{COLON}	{ YDVAR(1, VAR_RPZ_SIGNAL_NXDOMAIN_RA) }
 zonefile{COLON}			{ YDVAR(1, VAR_ZONEFILE) }
 master{COLON}			{ YDVAR(1, VAR_MASTER) }
 primary{COLON}			{ YDVAR(1, VAR_MASTER) }
+master-tsig{COLON}		{ YDVAR(2, VAR_MASTER_TSIG) }
+primary-tsig{COLON}		{ YDVAR(2, VAR_MASTER_TSIG) }
 url{COLON}			{ YDVAR(1, VAR_URL) }
 allow-notify{COLON}		{ YDVAR(1, VAR_ALLOW_NOTIFY) }
+allow-notify-tsig{COLON}	{ YDVAR(2, VAR_ALLOW_NOTIFY_TSIG) }
 for-downstream{COLON}		{ YDVAR(1, VAR_FOR_DOWNSTREAM) }
 for-upstream{COLON}		{ YDVAR(1, VAR_FOR_UPSTREAM) }
 fallback-enabled{COLON}		{ YDVAR(1, VAR_FALLBACK_ENABLED) }
diff --git a/util/configparser.y b/util/configparser.y
index 40db4a1bc..732212a37 100644
--- a/util/configparser.y
+++ b/util/configparser.y
@@ -193,6 +193,7 @@ extern struct config_parser_state* cfg_parser;
 %token VAR_CACHEDB_REDISCONNECTTIMEOUT VAR_CACHEDB_REDISREPLICACONNECTTIMEOUT
 %token VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM VAR_FOR_UPSTREAM
 %token VAR_AUTH_ZONE VAR_ZONEFILE VAR_MASTER VAR_URL VAR_FOR_DOWNSTREAM
+%token VAR_MASTER_TSIG VAR_ALLOW_NOTIFY_TSIG
 %token VAR_FALLBACK_ENABLED VAR_TLS_ADDITIONAL_PORT VAR_LOW_RTT VAR_LOW_RTT_PERMIL
 %token VAR_FAST_SERVER_PERMIL VAR_FAST_SERVER_NUM
 %token VAR_ALLOW_NOTIFY VAR_TLS_WIN_CERT VAR_TCP_CONNECTION_LIMIT
@@ -202,6 +203,7 @@ extern struct config_parser_state* cfg_parser;
 %token VAR_DISCARD_TIMEOUT VAR_WAIT_LIMIT VAR_WAIT_LIMIT_COOKIE
 %token VAR_WAIT_LIMIT_NETBLOCK VAR_WAIT_LIMIT_COOKIE_NETBLOCK
 %token VAR_STREAM_WAIT_SIZE VAR_TLS_CIPHERS VAR_TLS_CIPHERSUITES VAR_TLS_USE_SNI
+%token VAR_TLS_USE_SYSTEM_POLICY_VERSIONS
 %token VAR_IPSET VAR_IPSET_NAME_V4 VAR_IPSET_NAME_V6
 %token VAR_TLS_SESSION_TICKET_KEYS VAR_RPZ VAR_TAGS VAR_RPZ_ACTION_OVERRIDE
 %token VAR_RPZ_CNAME_OVERRIDE VAR_RPZ_LOG VAR_RPZ_LOG_NAME
@@ -351,6 +353,7 @@ content_server: server_num_threads | server_verbosity | server_port |
 	server_tls_ciphersuites | server_tls_session_ticket_keys |
 	server_answer_cookie | server_cookie_secret | server_ip_ratelimit_cookie |
 	server_tls_use_sni | server_edns_client_string |
+	server_tls_use_system_policy_versions |
 	server_edns_client_string_opcode | server_nsid |
 	server_zonemd_permissive_mode | server_max_reuse_tcp_queries |
 	server_tcp_reuse_timeout | server_tcp_auth_query_timeout |
@@ -467,9 +470,10 @@ authstart: VAR_AUTH_ZONE
 	;
 contents_auth: contents_auth content_auth
 	| ;
-content_auth: auth_name | auth_zonefile | auth_master | auth_url |
-	auth_for_downstream | auth_for_upstream | auth_fallback_enabled |
-	auth_allow_notify | auth_zonemd_check | auth_zonemd_reject_absence
+content_auth: auth_name | auth_zonefile | auth_master | auth_master_tsig |
+	auth_url | auth_for_downstream | auth_for_upstream |
+	auth_fallback_enabled | auth_allow_notify | auth_allow_notify_tsig |
+	auth_zonemd_check | auth_zonemd_reject_absence
 	;
 
 rpz_tag: VAR_TAGS STRING_ARG
@@ -564,9 +568,10 @@ rpzstart: VAR_RPZ
 	;
 contents_rpz: contents_rpz content_rpz
 	| ;
-content_rpz: auth_name | auth_zonefile | rpz_tag | auth_master | auth_url |
-	   auth_allow_notify | rpz_action_override | rpz_cname_override |
-	   rpz_log | rpz_log_name | rpz_signal_nxdomain_ra | auth_for_downstream
+content_rpz: auth_name | auth_zonefile | rpz_tag | auth_master |
+	auth_master_tsig | auth_url | auth_allow_notify |
+	auth_allow_notify_tsig | rpz_action_override | rpz_cname_override |
+	rpz_log | rpz_log_name | rpz_signal_nxdomain_ra | auth_for_downstream
 	;
 server_num_threads: VAR_NUM_THREADS STRING_ARG
 	{
@@ -979,7 +984,7 @@ server_tcp_mss: VAR_TCP_MSS STRING_ARG
 	{
 		OUTYY(("P(server_tcp_mss:%s)\n", $2));
 		if(atoi($2) == 0 && strcmp($2, "0") != 0)
-				yyerror("number expected");
+			yyerror("number expected");
 		else cfg_parser->cfg->tcp_mss = atoi($2);
 		free($2);
 	}
@@ -1179,6 +1184,15 @@ server_tls_use_sni: VAR_TLS_USE_SNI STRING_ARG
 		free($2);
 	}
 	;
+server_tls_use_system_policy_versions: VAR_TLS_USE_SYSTEM_POLICY_VERSIONS STRING_ARG
+	{
+		OUTYY(("P(server_tls_use_system_policy_versions:%s)\n", $2));
+		if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
+			yyerror("expected yes or no.");
+		else cfg_parser->cfg->tls_use_system_policy_versions = (strcmp($2, "yes")==0);
+		free($2);
+	}
+	;
 server_https_port: VAR_HTTPS_PORT STRING_ARG
 	{
 		OUTYY(("P(server_https_port:%s)\n", $2));
@@ -1193,11 +1207,13 @@ server_http_endpoint: VAR_HTTP_ENDPOINT STRING_ARG
 		free(cfg_parser->cfg->http_endpoint);
 		if($2 && $2[0] != '/') {
 			cfg_parser->cfg->http_endpoint = malloc(strlen($2)+2);
-			if(!cfg_parser->cfg->http_endpoint)
+			if(cfg_parser->cfg->http_endpoint) {
+				cfg_parser->cfg->http_endpoint[0] = '/';
+				memmove(cfg_parser->cfg->http_endpoint+1, $2,
+					strlen($2)+1);
+			} else {
 				yyerror("out of memory");
-			cfg_parser->cfg->http_endpoint[0] = '/';
-			memmove(cfg_parser->cfg->http_endpoint+1, $2,
-				strlen($2)+1);
+			}
 			free($2);
 		} else {
 			cfg_parser->cfg->http_endpoint = $2;
@@ -3274,6 +3290,14 @@ auth_master: VAR_MASTER STRING_ARG
 			yyerror("out of memory");
 	}
 	;
+auth_master_tsig: VAR_MASTER_TSIG STRING_ARG STRING_ARG
+	{
+		OUTYY(("P(master-tsig:%s)\n", $2));
+		if(!cfg_str2list_insert(&cfg_parser->cfg->auths->masters_tsig,
+			$2, $3))
+			yyerror("out of memory");
+	}
+	;
 auth_url: VAR_URL STRING_ARG
 	{
 		OUTYY(("P(url:%s)\n", $2));
@@ -3289,6 +3313,14 @@ auth_allow_notify: VAR_ALLOW_NOTIFY STRING_ARG
 			yyerror("out of memory");
 	}
 	;
+auth_allow_notify_tsig: VAR_ALLOW_NOTIFY_TSIG STRING_ARG STRING_ARG
+	{
+		OUTYY(("P(allow-notify-tsig:%s)\n", $2));
+		if(!cfg_str2list_insert(
+			&cfg_parser->cfg->auths->allow_notify_tsig, $2, $3))
+			yyerror("out of memory");
+	}
+	;
 auth_zonemd_check: VAR_ZONEMD_CHECK STRING_ARG
 	{
 		OUTYY(("P(zonemd-check:%s)\n", $2));
diff --git a/util/data/dname.c b/util/data/dname.c
index 7d368377c..c417fb676 100644
--- a/util/data/dname.c
+++ b/util/data/dname.c
@@ -644,20 +644,22 @@ void dname_str(uint8_t* dname, char* str)
 	if(!dname || !*dname) {
 		*s++ = '.';
 		*s = 0;
-		goto out;
+		return;
 	}
 	lablen = *dname++;
 	while(lablen) {
+		len += lablen+1;
+		if(len >= LDNS_MAX_DOMAINLEN) {
+			if ((s-str) >= (LDNS_MAX_DOMAINLEN-1))
+				s = str + LDNS_MAX_DOMAINLEN - 2;
+			*s++ = '&';
+			*s = 0;
+			return;
+		}
 		if(lablen > LDNS_MAX_LABELLEN) {
 			*s++ = '#';
 			*s = 0;
-			goto out;
-		}
-		len += lablen+1;
-		if(len >= LDNS_MAX_DOMAINLEN) {
-			*s++ = '&';
-			*s = 0;
-			goto out;
+			return;
 		}
 		while(lablen--) {
 			if(isalnum((unsigned char)*dname)
@@ -673,10 +675,6 @@ void dname_str(uint8_t* dname, char* str)
 		lablen = *dname++;
 	}
 	*s = 0;
-
-out:
-	log_assert(s - str < LDNS_MAX_DOMAINLEN);
-	return;
 }
 
 int 
diff --git a/util/data/msgencode.c b/util/data/msgencode.c
index 84aa3b9e7..019da7253 100644
--- a/util/data/msgencode.c
+++ b/util/data/msgencode.c
@@ -496,10 +496,18 @@ packed_rrset_encode(struct ub_packed_rrset_key* key, sldns_buffer* pkt,
 				return r;
 			sldns_buffer_write(pkt, &key->rk.type, 2);
 			sldns_buffer_write(pkt, &key->rk.rrset_class, 2);
-			if(data->rr_ttl[j] < adjust)
+			if(key->rk.flags & PACKED_RRSET_UPSTREAM_0TTL) {
+				sldns_buffer_write_u32(pkt, 0);
+			} else if(adjust == 0) {
+				sldns_buffer_write_u32(pkt, data->rr_ttl[j]);
+			} else if(TTL_IS_EXPIRED(data->rr_ttl[j], adjust)) {
 				sldns_buffer_write_u32(pkt,
-					SERVE_EXPIRED?SERVE_EXPIRED_REPLY_TTL:0);
-			else	sldns_buffer_write_u32(pkt, data->rr_ttl[j]-adjust);
+					EXPIRED_REPLY_TTL_CALC(
+					    data->rr_ttl[j], data->ttl_add));
+			} else {
+				sldns_buffer_write_u32(pkt,
+					data->rr_ttl[j] - adjust);
+			}
 			if(c) {
 				if((r=compress_rdata(pkt, data->rr_data[j],
 					data->rr_len[j], region, tree, c,
@@ -533,10 +541,18 @@ packed_rrset_encode(struct ub_packed_rrset_key* key, sldns_buffer* pkt,
 			}
 			sldns_buffer_write_u16(pkt, LDNS_RR_TYPE_RRSIG);
 			sldns_buffer_write(pkt, &key->rk.rrset_class, 2);
-			if(data->rr_ttl[i] < adjust)
+			if(key->rk.flags & PACKED_RRSET_UPSTREAM_0TTL) {
+				sldns_buffer_write_u32(pkt, 0);
+			} else if(adjust == 0) {
+				sldns_buffer_write_u32(pkt, data->rr_ttl[i]);
+			} else if(TTL_IS_EXPIRED(data->rr_ttl[i], adjust)) {
 				sldns_buffer_write_u32(pkt,
-					SERVE_EXPIRED?SERVE_EXPIRED_REPLY_TTL:0);
-			else	sldns_buffer_write_u32(pkt, data->rr_ttl[i]-adjust);
+					EXPIRED_REPLY_TTL_CALC(
+					    data->rr_ttl[i], data->ttl_add));
+			} else {
+				sldns_buffer_write_u32(pkt,
+					data->rr_ttl[i] - adjust);
+			}
 			/* rrsig rdata cannot be compressed, perform 100+ byte
 			 * memcopy. */
 			sldns_buffer_write(pkt, data->rr_data[i],
@@ -993,10 +1009,10 @@ attach_edns_record(sldns_buffer* pkt, struct edns_data* edns)
 	attach_edns_record_max_msg_sz(pkt, edns, edns->udp_size);
 }
 
-int 
-reply_info_answer_encode(struct query_info* qinf, struct reply_info* rep, 
+int
+reply_info_answer_encode(struct query_info* qinf, struct reply_info* rep,
 	uint16_t id, uint16_t qflags, sldns_buffer* pkt, time_t timenow,
-	int cached, struct regional* region, uint16_t udpsize, 
+	int cached, struct regional* region, uint16_t udpsize,
 	struct edns_data* edns, int dnssec, int secure)
 {
 	uint16_t flags;
diff --git a/util/data/msgencode.h b/util/data/msgencode.h
index 08fcb59b8..0363a90bf 100644
--- a/util/data/msgencode.h
+++ b/util/data/msgencode.h
@@ -66,9 +66,9 @@ struct edns_data;
  * @param secure: if 1, the AD bit is set in the reply.
  * @return: 0 on error (server failure).
  */
-int reply_info_answer_encode(struct query_info* qinf, struct reply_info* rep, 
+int reply_info_answer_encode(struct query_info* qinf, struct reply_info* rep,
 	uint16_t id, uint16_t qflags, struct sldns_buffer* dest, time_t timenow,
-	int cached, struct regional* region, uint16_t udpsize, 
+	int cached, struct regional* region, uint16_t udpsize,
 	struct edns_data* edns, int dnssec, int secure);
 
 /**
diff --git a/util/data/msgparse.c b/util/data/msgparse.c
index 6963d8501..ca1ead05d 100644
--- a/util/data/msgparse.c
+++ b/util/data/msgparse.c
@@ -1282,10 +1282,32 @@ parse_edns_from_query_pkt(sldns_buffer* pkt, struct edns_data* edns,
 			return LDNS_RCODE_FORMERR;
 	}
 	/* check edns section is present */
-	if(LDNS_ARCOUNT(sldns_buffer_begin(pkt)) > 1) {
-		return LDNS_RCODE_FORMERR;
-	}
-	if(LDNS_ARCOUNT(sldns_buffer_begin(pkt)) == 0) {
+	if(LDNS_ARCOUNT(sldns_buffer_begin(pkt)) > 0) {
+		int i, edns_found = 0;
+		for(i=0; i<(int)LDNS_ARCOUNT(sldns_buffer_begin(pkt)); i++) {
+			if(sldns_buffer_remaining(pkt) < 1)
+				return LDNS_RCODE_FORMERR;
+			if(sldns_buffer_current(pkt)[0] == 0) {
+				/* The domain name is the root of length 1. */
+				/* See if the RR Type is OPT. */
+				if(sldns_buffer_remaining(pkt) < 3)
+					return LDNS_RCODE_FORMERR;
+				if(sldns_buffer_read_u16_at(pkt,
+					sldns_buffer_position(pkt)+1) ==
+					LDNS_RR_TYPE_OPT) {
+					/* This is the EDNS OPT record */
+					edns_found = 1;
+					break;
+				}
+			}
+			if(!skip_pkt_rrs(pkt, 1))
+				return LDNS_RCODE_FORMERR;
+		}
+		if(!edns_found) {
+			edns->udp_size = 512;
+			return 0;
+		}
+	} else if(LDNS_ARCOUNT(sldns_buffer_begin(pkt)) == 0) {
 		edns->udp_size = 512;
 		return 0;
 	}
@@ -1361,3 +1383,13 @@ msgparse_rrset_remove_rr(const char* str, sldns_buffer* pkt, struct rrset_parse*
 	 * the rr->next works fine to continue. */
 	return rrset->rr_count == 0;
 }
+
+#ifdef UNBOUND_DEBUG
+time_t debug_expired_reply_ttl_calc(time_t ttl, time_t ttl_add) {
+	/* Check that we are serving expired when this is called */
+	/* ttl (absolute) should be later than ttl_add */
+	log_assert(SERVE_EXPIRED && ttl_add <= ttl);
+	return (SERVE_EXPIRED_REPLY_TTL < (ttl) - (ttl_add) ?
+		SERVE_EXPIRED_REPLY_TTL : (ttl) - (ttl_add));
+}
+#endif
diff --git a/util/data/msgparse.h b/util/data/msgparse.h
index 7de4e394f..373de677d 100644
--- a/util/data/msgparse.h
+++ b/util/data/msgparse.h
@@ -98,6 +98,31 @@ extern time_t SERVE_EXPIRED_REPLY_TTL;
 /** If we serve the original TTL or decrementing TTLs */
 extern int SERVE_ORIGINAL_TTL;
 
+/** calculate the prefetch TTL as 90% of original. Calculation
+ * without numerical overflow (uin32_t) */
+#define PREFETCH_TTL_CALC(ttl) ((ttl) - (ttl)/10)
+
+/*  caclulate the TTL used for expired answers to somewhat make sense wrt the
+ *  original TTL; don't reply with higher TTL than the original */
+#ifdef UNBOUND_DEBUG
+time_t debug_expired_reply_ttl_calc(time_t ttl, time_t ttl_add);
+#define EXPIRED_REPLY_TTL_CALC(ttl, ttl_add)		\
+    debug_expired_reply_ttl_calc(ttl, ttl_add)
+#else
+#define EXPIRED_REPLY_TTL_CALC(ttl, ttl_add)		\
+	(SERVE_EXPIRED_REPLY_TTL < (ttl) - (ttl_add) ?	\
+	SERVE_EXPIRED_REPLY_TTL : (ttl) - (ttl_add))
+#endif
+
+/** Update the reply_info TTL from an RRSet's TTL, essentially keeping the TTL
+ *  sane with all the (progressively added) rrsets to the message */
+#define UPDATE_TTL_FROM_RRSET(ttl, rrsetttl) \
+	((ttl) = ((ttl) < (rrsetttl)) ? (ttl) : (rrsetttl))
+
+/** Check if TTL is expired. 0 TTL is considered expired.
+ *  Used mainly to identify parts of the code that do this comparison. */
+#define TTL_IS_EXPIRED(ttl, now) ((ttl) <= (now))
+
 /**
  * Data stored in scratch pad memory during parsing.
  * Stores the data that will enter into the msgreply and packet result.
diff --git a/util/data/msgreply.c b/util/data/msgreply.c
index 6b65e1eb1..dc82a7dec 100644
--- a/util/data/msgreply.c
+++ b/util/data/msgreply.c
@@ -178,9 +178,9 @@ reply_info_alloc_rrset_keys(struct reply_info* rep, struct alloc_cache* alloc,
 int
 reply_info_can_answer_expired(struct reply_info* rep, time_t timenow)
 {
-	log_assert(rep->ttl < timenow);
+	log_assert(TTL_IS_EXPIRED(rep->ttl, timenow));
 	/* Really expired */
-	if(SERVE_EXPIRED_TTL && rep->serve_expired_ttl < timenow) return 0;
+	if(SERVE_EXPIRED_TTL && TTL_IS_EXPIRED(rep->serve_expired_ttl, timenow)) return 0;
 	/* Ignore expired failure answers */
 	if(FLAGS_GET_RCODE(rep->flags) != LDNS_RCODE_NOERROR &&
 		FLAGS_GET_RCODE(rep->flags) != LDNS_RCODE_NXDOMAIN &&
@@ -188,12 +188,13 @@ reply_info_can_answer_expired(struct reply_info* rep, time_t timenow)
 	return 1;
 }
 
-int reply_info_could_use_expired(struct reply_info* rep, time_t timenow)
+int
+reply_info_could_use_expired(struct reply_info* rep, time_t timenow)
 {
-	log_assert(rep->ttl < timenow);
+	log_assert(TTL_IS_EXPIRED(rep->ttl, timenow));
 	/* Really expired */
-	if(SERVE_EXPIRED_TTL && rep->serve_expired_ttl < timenow &&
-		!SERVE_EXPIRED_TTL_RESET) return 0;
+	if(SERVE_EXPIRED_TTL && TTL_IS_EXPIRED(rep->serve_expired_ttl, timenow)
+		&& !SERVE_EXPIRED_TTL_RESET) return 0;
 	/* Ignore expired failure answers */
 	if(FLAGS_GET_RCODE(rep->flags) != LDNS_RCODE_NOERROR &&
 		FLAGS_GET_RCODE(rep->flags) != LDNS_RCODE_NXDOMAIN &&
@@ -229,7 +230,7 @@ make_new_reply_info(const struct reply_info* rep, struct regional* region,
 }
 
 /** find the minimumttl in the rdata of SOA record */
-static time_t
+static uint32_t
 soa_find_minttl(struct rr_parse* rr)
 {
 	uint16_t rlen = sldns_read_uint16(rr->ttl_data+4);
@@ -237,7 +238,7 @@ soa_find_minttl(struct rr_parse* rr)
 		return 0; /* rdata too small for SOA (dname, dname, 5*32bit) */
 	/* minimum TTL is the last 32bit value in the rdata of the record */
 	/* at position ttl_data + 4(ttl) + 2(rdatalen) + rdatalen - 4(timeval)*/
-	return (time_t)sldns_read_uint32(rr->ttl_data+6+rlen-4);
+	return sldns_read_uint32(rr->ttl_data+6+rlen-4);
 }
 
 /** do the rdata copy */
@@ -247,37 +248,40 @@ rdata_copy(sldns_buffer* pkt, struct packed_rrset_data* data, uint8_t* to,
 	sldns_pkt_section section)
 {
 	uint16_t pkt_len;
+	uint32_t ttl;
 	const sldns_rr_descriptor* desc;
 
-	*rr_ttl = sldns_read_uint32(rr->ttl_data);
+	ttl = sldns_read_uint32(rr->ttl_data);
 	/* RFC 2181 Section 8. if msb of ttl is set treat as if zero. */
-	if((*rr_ttl & 0x80000000U))
-		*rr_ttl = 0;
+	/* RFC 8767 Section 4. values with high-order bit as positive, not 0.
++	 *	As such, it will be capped by MAX_TTL below. */
 	if(type == LDNS_RR_TYPE_SOA && section == LDNS_SECTION_AUTHORITY) {
 		/* negative response. see if TTL of SOA record larger than the
 		 * minimum-ttl in the rdata of the SOA record */
-		if(*rr_ttl > soa_find_minttl(rr)) *rr_ttl = soa_find_minttl(rr);
+		if(ttl > soa_find_minttl(rr)) ttl = soa_find_minttl(rr);
 		if(!SERVE_ORIGINAL_TTL) {
 			/* If MIN_NEG_TTL is configured skip setting MIN_TTL */
-			if(MIN_NEG_TTL <= 0 && *rr_ttl < MIN_TTL) {
-				*rr_ttl = MIN_TTL;
+			if(MIN_NEG_TTL <= 0 && ttl < MIN_TTL) {
+				ttl = MIN_TTL;
 			}
-			if(*rr_ttl > MAX_TTL) *rr_ttl = MAX_TTL;
+			if(ttl > MAX_TTL) ttl = MAX_TTL;
 		}
 		/* MAX_NEG_TTL overrides the min and max ttl of everything
 		 * else; it is for a more specific record */
-		if(*rr_ttl > MAX_NEG_TTL) *rr_ttl = MAX_NEG_TTL;
+		if(ttl > MAX_NEG_TTL) ttl = MAX_NEG_TTL;
 		/* MIN_NEG_TTL overrides the min and max ttl of everything
 		 * else if configured; it is for a more specific record */
-		if(MIN_NEG_TTL > 0 && *rr_ttl < MIN_NEG_TTL) {
-			*rr_ttl = MIN_NEG_TTL;
+		if(MIN_NEG_TTL > 0 && ttl < MIN_NEG_TTL) {
+			ttl = MIN_NEG_TTL;
 		}
 	} else if(!SERVE_ORIGINAL_TTL) {
-		if(*rr_ttl < MIN_TTL) *rr_ttl = MIN_TTL;
-		if(*rr_ttl > MAX_TTL) *rr_ttl = MAX_TTL;
+		if(ttl < MIN_TTL) ttl = MIN_TTL;
+		if(ttl > MAX_TTL) ttl = MAX_TTL;
 	}
-	if(*rr_ttl < data->ttl)
-		data->ttl = *rr_ttl;
+	if(ttl < data->ttl)
+		data->ttl = ttl;
+	/* We have concluded the TTL checks */
+	*rr_ttl = (time_t)ttl;
 
 	if(rr->outside_packet) {
 		/* uncompressed already, only needs copy */
@@ -481,6 +485,7 @@ parse_copy_decompress_rrset(sldns_buffer* pkt, struct msg_parse* msg,
 	pk->entry.key = (void*)pk;
 	pk->entry.hash = pset->hash;
 	data->trust = get_rrset_trust(msg, pset);
+	pk->rk.flags |= (data->ttl == 0) ? PACKED_RRSET_UPSTREAM_0TTL : 0;
 	return 1;
 }
 
@@ -617,6 +622,29 @@ reply_info_set_ttls(struct reply_info* rep, time_t timenow)
 	}
 }
 
+void
+reply_info_absolute_ttls(struct reply_info* rep, time_t ttl, time_t ttl_add)
+{
+	size_t i, j;
+	rep->ttl = ttl;
+	rep->prefetch_ttl = PREFETCH_TTL_CALC(ttl);
+	rep->serve_expired_ttl = ttl + SERVE_EXPIRED_TTL;
+	/* Don't set rep->serve_expired_norec_ttl; this should only be set
+	 * on cached records when encountering an error */
+	log_assert(rep->serve_expired_norec_ttl == 0);
+	for(i=0; i<rep->rrset_count; i++) {
+		struct packed_rrset_data* data = (struct packed_rrset_data*)
+			rep->ref[i].key->entry.data;
+		if(i>0 && rep->ref[i].key == rep->ref[i-1].key)
+			continue;
+		data->ttl = ttl;
+		for(j=0; j<data->count + data->rrsig_count; j++) {
+			data->rr_ttl[j] = ttl;
+		}
+		data->ttl_add = ttl_add;
+	}
+}
+
 void 
 reply_info_parsedelete(struct reply_info* rep, struct alloc_cache* alloc)
 {
@@ -1129,7 +1157,7 @@ int edns_opt_list_append_ede(struct edns_option** list, struct regional* region,
 	prevp = list;
 	while(*prevp != NULL)
 		prevp = &((*prevp)->next);
-	verbose(VERB_ALGO, "attached EDE code: %d with message: %s", code, (txt?txt:"\"\""));
+	verbose(VERB_ALGO, "attached EDE code: %d with message: '%s'", code, (txt?txt:""));
 	*prevp = opt;
 	return 1;
 }
diff --git a/util/data/msgreply.h b/util/data/msgreply.h
index b65abd922..87eebb2b9 100644
--- a/util/data/msgreply.h
+++ b/util/data/msgreply.h
@@ -60,10 +60,6 @@ struct local_rrset;
 struct dns_msg;
 enum comm_point_type;
 
-/** calculate the prefetch TTL as 90% of original. Calculation
- * without numerical overflow (uin32_t) */
-#define PREFETCH_TTL_CALC(ttl) ((ttl) - (ttl)/10)
-
 /**
  * Structure to store query information that makes answers to queries
  * different.
@@ -340,6 +336,15 @@ void reply_info_sortref(struct reply_info* rep);
  */
 void reply_info_set_ttls(struct reply_info* rep, time_t timenow);
 
+/**
+ * Set TTLs inside the replyinfo to the given absolute values.
+ * @param rep: reply info. rrsets must be filled in.
+ *	Also refs must be filled in.
+ * @param ttl: absolute ttl value to be set.
+ * @param ttl_add: the current time to be used verbatim for ttl_add in the rrsets.
+ */
+void reply_info_absolute_ttls(struct reply_info* rep, time_t ttl, time_t ttl_add);
+
 /** 
  * Delete reply_info and packed_rrsets (while they are not yet added to the
  * hashtables.). Returns rrsets to the alloc cache.
@@ -572,7 +577,7 @@ void log_query_info(enum verbosity_value v, const char* str,
 	struct query_info* qinf);
 
 /**
- * Append edns option to edns option list
+ * Append edns option to edns option list.
  * @param list: the edns option list to append the edns option to.
  * @param code: the edns option's code.
  * @param len: the edns option's length.
@@ -584,20 +589,23 @@ int edns_opt_list_append(struct edns_option** list, uint16_t code, size_t len,
         uint8_t* data, struct regional* region);
 
 /**
- * Append edns EDE option to edns options list
+ * Append edns EDE option to edns options list.
+ * We need ATTR_NONSTRING because we are trimming the trailing \0 of static
+ * string (TXT) when assigning to ede.text; it silences compiler nonstring
+ * warnings.
  * @param LIST: the edns option list to append the edns option to.
  * @param REGION: region to allocate the new edns option.
  * @param CODE: the EDE code.
- * @param TXT: Additional text for the option
+ * @param TXT: Additional text for the option.
  */
 #define EDNS_OPT_LIST_APPEND_EDE(LIST, REGION, CODE, TXT) 		\
 	do {								\
 		struct {						\
 			uint16_t code;					\
-			char text[sizeof(TXT) - 1];			\
+			char ATTR_NONSTRING(text[sizeof(TXT) - 1]) ;	\
 		} ede = { htons(CODE), TXT };				\
                 verbose(VERB_ALGO, "attached EDE code: %d with"		\
-                        " message: %s", CODE, TXT);			\
+                        " message: '%s'", CODE, TXT);			\
 		edns_opt_list_append((LIST), LDNS_EDNS_EDE, 		\
 			sizeof(uint16_t) + sizeof(TXT) - 1,		\
 			(void *)&ede, (REGION));			\
diff --git a/util/data/packed_rrset.c b/util/data/packed_rrset.c
index d18486cc5..89ece3c03 100644
--- a/util/data/packed_rrset.c
+++ b/util/data/packed_rrset.c
@@ -336,10 +336,9 @@ packed_rrset_copy_region(struct ub_packed_rrset_key* key,
 	struct ub_packed_rrset_key* ck = regional_alloc(region, 
 		sizeof(struct ub_packed_rrset_key));
 	struct packed_rrset_data* d;
-	struct packed_rrset_data* data = (struct packed_rrset_data*)
-		key->entry.data;
+	struct packed_rrset_data* data = key->entry.data;
 	size_t dsize, i;
-	time_t adjust = 0;
+	time_t now_control;
 	if(!ck)
 		return NULL;
 	ck->id = key->id;
@@ -352,22 +351,31 @@ packed_rrset_copy_region(struct ub_packed_rrset_key* key,
 	if(!ck->rk.dname)
 		return NULL;
 	dsize = packed_rrset_sizeof(data);
-	d = (struct packed_rrset_data*)regional_alloc_init(region, data, dsize);
+	d = regional_alloc_init(region, data, dsize);
 	if(!d)
 		return NULL;
 	ck->entry.data = d;
 	packed_rrset_ptr_fixup(d);
-	/* make TTLs relative - once per rrset */
-	adjust = SERVE_ORIGINAL_TTL ? data->ttl_add : now;
-	for(i=0; i<d->count + d->rrsig_count; i++) {
-		if(d->rr_ttl[i] < adjust)
-			d->rr_ttl[i] = SERVE_EXPIRED?SERVE_EXPIRED_REPLY_TTL:0;
-		else	d->rr_ttl[i] -= adjust;
+	/* make TTLs relative - once per rr */
+	if(now > 0) {
+		/* NS RRSets may be here with ttl_add higher than now because
+		 * of the novel ghost attack mitigation i.e., using the
+		 * qstarttime for NS RRSets. In that case make sure that the
+		 * returned TTL is not higher than the original one. */
+		log_assert(d->ttl_add <= now ||
+			(ntohs(key->rk.type) == LDNS_RR_TYPE_NS));
+		now_control = SERVE_ORIGINAL_TTL ? data->ttl_add
+			: (d->ttl_add > now ? d->ttl_add : now );
+		for(i=0; i<d->count + d->rrsig_count; i++) {
+			if(TTL_IS_EXPIRED(d->rr_ttl[i], now_control)) {
+				d->rr_ttl[i] = EXPIRED_REPLY_TTL_CALC(d->rr_ttl[i], data->ttl_add);
+			} else	d->rr_ttl[i] -= now_control;
+		}
+		if(TTL_IS_EXPIRED(d->ttl, now_control)) {
+			d->ttl = EXPIRED_REPLY_TTL_CALC(d->ttl, data->ttl_add);
+		} else	d->ttl -= now_control;
+		d->ttl_add = 0; /* TTLs have been made relative */
 	}
-	if(d->ttl < adjust)
-		d->ttl = SERVE_EXPIRED?SERVE_EXPIRED_REPLY_TTL:0;
-	else	d->ttl -= adjust;
-	d->ttl_add = 0; /* TTLs have been made relative */
 	return ck;
 }
 
diff --git a/util/data/packed_rrset.h b/util/data/packed_rrset.h
index 776e8d092..4e0911ccf 100644
--- a/util/data/packed_rrset.h
+++ b/util/data/packed_rrset.h
@@ -70,6 +70,8 @@ typedef uint64_t rrset_id_type;
 #define PACKED_RRSET_RPZ 0x8
 /** this rrset is A/AAAA and is an unverified glue record */
 #define PACKED_RRSET_UNVERIFIED_GLUE 0x10
+/** this rrset has a 0TTL from upstream */
+#define PACKED_RRSET_UPSTREAM_0TTL 0x20
 
 /** number of rrs and rrsets for integer overflow protection.  More than
  * this is not really possible (64K packet has much less RRs and RRsets) in
@@ -99,6 +101,7 @@ struct packed_rrset_key {
 	 * 	o PACKED_RRSET_FIXEDTTL (not supposed to be cached)
 	 * 	o PACKED_RRSET_RPZ
 	 * 	o PACKED_RRSET_UNVERIFIED_GLUE
+	 * 	o PACKED_RRSET_UPSTREAM_0TTL (not supposed to be cached)
 	 */
 	uint32_t flags;
 	/** the rrset type in network format */
diff --git a/util/fptr_wlist.c b/util/fptr_wlist.c
index 464ab0138..101f7ca57 100644
--- a/util/fptr_wlist.c
+++ b/util/fptr_wlist.c
@@ -382,7 +382,8 @@ fptr_whitelist_modenv_detach_subs(void (*fptr)(
 int 
 fptr_whitelist_modenv_attach_sub(int (*fptr)(
         struct module_qstate* qstate, struct query_info* qinfo,
-        uint16_t qflags, int prime, int valrec, struct module_qstate** newq))
+	struct respip_client_info* cinfo, uint16_t qflags, int prime,
+	int valrec, struct module_qstate** newq))
 {
 	if(fptr == &mesh_attach_sub) return 1;
 	return 0;
@@ -391,8 +392,8 @@ fptr_whitelist_modenv_attach_sub(int (*fptr)(
 int 
 fptr_whitelist_modenv_add_sub(int (*fptr)(
         struct module_qstate* qstate, struct query_info* qinfo,
-        uint16_t qflags, int prime, int valrec, struct module_qstate** newq,
-	struct mesh_state** sub))
+	struct respip_client_info* cinfo, uint16_t qflags, int prime,
+	int valrec, struct module_qstate** newq, struct mesh_state** sub))
 {
 	if(fptr == &mesh_add_sub) return 1;
 	return 0;
diff --git a/util/fptr_wlist.h b/util/fptr_wlist.h
index fb2475cce..a1a75625d 100644
--- a/util/fptr_wlist.h
+++ b/util/fptr_wlist.h
@@ -233,7 +233,8 @@ int fptr_whitelist_modenv_detach_subs(void (*fptr)(
  */
 int fptr_whitelist_modenv_attach_sub(int (*fptr)(
 	struct module_qstate* qstate, struct query_info* qinfo, 
-	uint16_t qflags, int prime, int valrec, struct module_qstate** newq));
+	struct respip_client_info* cinfo, uint16_t qflags, int prime,
+	int valrec, struct module_qstate** newq));
 
 /**
  * Check function pointer whitelist for module_env add_sub callback values.
@@ -242,8 +243,9 @@ int fptr_whitelist_modenv_attach_sub(int (*fptr)(
  * @return false if not in whitelist.
  */
 int fptr_whitelist_modenv_add_sub(int (*fptr)(struct module_qstate* qstate,
-	struct query_info* qinfo, uint16_t qflags, int prime, int valrec,
-	struct module_qstate** newq, struct mesh_state** sub));
+	struct query_info* qinfo, struct respip_client_info* cinfo,
+	uint16_t qflags, int prime, int valrec, struct module_qstate** newq,
+	struct mesh_state** sub));
 /**
  * Check function pointer whitelist for module_env kill_sub callback values.
  *
diff --git a/util/module.h b/util/module.h
index aa7508ac2..e3a1693d4 100644
--- a/util/module.h
+++ b/util/module.h
@@ -412,6 +412,8 @@ struct module_env {
 	 * @param qstate: the state to find mesh state, and that wants to 
 	 * 	receive the results from the new subquery.
 	 * @param qinfo: what to query for (copied).
+	 * @param cinfo: if non-NULL client specific info that may affect
+	 *	IP-based actions that apply to the query result.
 	 * @param qflags: what flags to use (RD, CD flag or not).
 	 * @param prime: if it is a (stub) priming query.
 	 * @param valrec: validation lookup recursion, does not need validation
@@ -420,8 +422,9 @@ struct module_env {
 	 * @return: false on error, true if success (and init may be needed).
 	 */ 
 	int (*attach_sub)(struct module_qstate* qstate, 
-		struct query_info* qinfo, uint16_t qflags, int prime, 
-		int valrec, struct module_qstate** newq);
+		struct query_info* qinfo, struct respip_client_info* cinfo,
+		uint16_t qflags, int prime, int valrec,
+		struct module_qstate** newq);
 
 	/**
 	 * Add detached query.
@@ -441,6 +444,8 @@ struct module_env {
 	 * @param qstate: the state to find mesh state, and that wants to receive
 	 * 	the results from the new subquery.
 	 * @param qinfo: what to query for (copied).
+	 * @param cinfo: if non-NULL client specific info that may affect
+	 *	IP-based actions that apply to the query result.
 	 * @param qflags: what flags to use (RD / CD flag or not).
 	 * @param prime: if it is a (stub) priming query.
 	 * @param valrec: if it is a validation recursion query (lookup of key, DS).
@@ -450,9 +455,9 @@ struct module_env {
 	 * @return: false on error, true if success (and init may be needed).
 	 */
 	int (*add_sub)(struct module_qstate* qstate, 
-		struct query_info* qinfo, uint16_t qflags, int prime, 
-		int valrec, struct module_qstate** newq,
-		struct mesh_state** sub);
+		struct query_info* qinfo, struct respip_client_info* cinfo,
+		uint16_t qflags, int prime, int valrec,
+		struct module_qstate** newq, struct mesh_state** sub);
 
 	/**
 	 * Kill newly attached sub. If attach_sub returns newq for 
diff --git a/util/net_help.c b/util/net_help.c
index 6ce0d9131..426ace934 100644
--- a/util/net_help.c
+++ b/util/net_help.c
@@ -1226,7 +1226,7 @@ setup_ticket_keys_cb(void* sslctx)
 #endif /* HAVE_SSL */
 
 int
-listen_sslctx_setup(void* ctxt)
+listen_sslctx_setup(void* ctxt, int use_system_versions)
 {
 #ifdef HAVE_SSL
 	SSL_CTX* ctx = (SSL_CTX*)ctxt;
@@ -1238,35 +1238,37 @@ listen_sslctx_setup(void* ctxt)
 		return 0;
 	}
 #endif
-	if((SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv3) & SSL_OP_NO_SSLv3)
-		!= SSL_OP_NO_SSLv3){
-		log_crypto_err("could not set SSL_OP_NO_SSLv3");
-		return 0;
-	}
+	if(!use_system_versions) {
+		if((SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv3) & SSL_OP_NO_SSLv3)
+			!= SSL_OP_NO_SSLv3){
+			log_crypto_err("could not set SSL_OP_NO_SSLv3");
+			return 0;
+		}
 #if defined(SSL_OP_NO_TLSv1) && defined(SSL_OP_NO_TLSv1_1)
-	/* if we have tls 1.1 disable 1.0 */
-	if((SSL_CTX_set_options(ctx, SSL_OP_NO_TLSv1) & SSL_OP_NO_TLSv1)
-		!= SSL_OP_NO_TLSv1){
-		log_crypto_err("could not set SSL_OP_NO_TLSv1");
-		return 0;
-	}
+		/* if we have tls 1.1 disable 1.0 */
+		if((SSL_CTX_set_options(ctx, SSL_OP_NO_TLSv1) & SSL_OP_NO_TLSv1)
+			!= SSL_OP_NO_TLSv1){
+			log_crypto_err("could not set SSL_OP_NO_TLSv1");
+			return 0;
+		}
 #endif
 #if defined(SSL_OP_NO_TLSv1_1) && defined(SSL_OP_NO_TLSv1_2)
-	/* if we have tls 1.2 disable 1.1 */
-	if((SSL_CTX_set_options(ctx, SSL_OP_NO_TLSv1_1) & SSL_OP_NO_TLSv1_1)
-		!= SSL_OP_NO_TLSv1_1){
-		log_crypto_err("could not set SSL_OP_NO_TLSv1_1");
-		return 0;
-	}
+		/* if we have tls 1.2 disable 1.1 */
+		if((SSL_CTX_set_options(ctx, SSL_OP_NO_TLSv1_1) & SSL_OP_NO_TLSv1_1)
+			!= SSL_OP_NO_TLSv1_1){
+			log_crypto_err("could not set SSL_OP_NO_TLSv1_1");
+			return 0;
+		}
 #endif
 #if defined(SSL_OP_NO_TLSv1_2) && defined(SSL_OP_NO_TLSv1_3)
-	/* if we have tls 1.3 disable 1.2 */
-	if((SSL_CTX_set_options(ctx, SSL_OP_NO_TLSv1_2) & SSL_OP_NO_TLSv1_2)
-		!= SSL_OP_NO_TLSv1_2){
-		log_crypto_err("could not set SSL_OP_NO_TLSv1_2");
-		return 0;
-	}
+		/* if we have tls 1.3 disable 1.2 */
+		if((SSL_CTX_set_options(ctx, SSL_OP_NO_TLSv1_2) & SSL_OP_NO_TLSv1_2)
+			!= SSL_OP_NO_TLSv1_2){
+			log_crypto_err("could not set SSL_OP_NO_TLSv1_2");
+			return 0;
+		}
 #endif
+	}
 #if defined(SSL_OP_NO_RENEGOTIATION)
 	/* disable client renegotiation */
 	if((SSL_CTX_set_options(ctx, SSL_OP_NO_RENEGOTIATION) &
@@ -1341,7 +1343,7 @@ listen_sslctx_setup_2(void* ctxt)
 void* listen_sslctx_create(const char* key, const char* pem,
 	const char* verifypem, const char* tls_ciphers,
 	const char* tls_ciphersuites, int set_ticket_keys_cb,
-	int is_dot, int is_doh)
+	int is_dot, int is_doh, int use_system_versions)
 {
 #ifdef HAVE_SSL
 	SSL_CTX* ctx = SSL_CTX_new(SSLv23_server_method());
@@ -1359,7 +1361,7 @@ void* listen_sslctx_create(const char* key, const char* pem,
 		SSL_CTX_free(ctx);
 		return NULL;
 	}
-	if(!listen_sslctx_setup(ctx)) {
+	if(!listen_sslctx_setup(ctx, use_system_versions)) {
 		SSL_CTX_free(ctx);
 		return NULL;
 	}
diff --git a/util/net_help.h b/util/net_help.h
index 278e370a2..7b8a20642 100644
--- a/util/net_help.h
+++ b/util/net_help.h
@@ -478,9 +478,11 @@ void log_cert(unsigned level, const char* str, void* cert);
 /**
  * Set SSL_OP_NOxxx options on SSL context to disable bad crypto
  * @param ctxt: SSL_CTX*
+ * @param use_system_versions: rely on the system policy (if any) for allowed
+ *	TLS versions
  * @return false on failure.
  */
-int listen_sslctx_setup(void* ctxt);
+int listen_sslctx_setup(void* ctxt, int use_system_versions);
 
 /**
  * Further setup of listening SSL context, after keys loaded.
@@ -499,12 +501,14 @@ void listen_sslctx_setup_2(void* ctxt);
  *	to be set.
  * @param is_dot: if the TLS connection is for DoT to set the appropriate ALPN.
  * @param is_doh: if the TLS connection is for DoH to set the appropriate ALPN.
+ * @param use_system_versions: rely on the system policy (if any) for allowed
+ *	TLS versions
  * return SSL_CTX* or NULL on failure (logged).
  */
 void* listen_sslctx_create(const char* key, const char* pem,
 	const char* verifypem, const char* tls_ciphers,
 	const char* tls_ciphersuites, int set_ticket_keys_cb,
-	int is_dot, int is_doh);
+	int is_dot, int is_doh, int use_system_versions);
 
 /**
  * create SSL connect context
diff --git a/util/netevent.c b/util/netevent.c
index 8d6445abf..aedcb5e07 100644
--- a/util/netevent.c
+++ b/util/netevent.c
@@ -3218,6 +3218,9 @@ comm_point_tcp_accept_callback(int fd, short event, void* arg)
 	}
 	/* accept incoming connection. */
 	c_hdl = c->tcp_free;
+	/* Should not happen: inconsistent tcp_free state in
+	 * accept_callback. */
+	log_assert(c_hdl->is_in_tcp_free);
 	/* clear leftover flags from previous use, and then set the
 	 * correct event base for the event structure for libevent */
 	ub_event_free(c_hdl->ev->ev);
@@ -3292,10 +3295,15 @@ comm_point_tcp_accept_callback(int fd, short event, void* arg)
 #endif
 	}
 
+	/* Paranoia: Check that the state has not changed from above: */
+	/* Should not happen: tcp_free state changed within accept_callback. */
+	log_assert(c_hdl == c->tcp_free);
+	log_assert(c_hdl->is_in_tcp_free);
 	/* grab the tcp handler buffers */
 	c->cur_tcp_count++;
 	c->tcp_free = c_hdl->tcp_free;
 	c_hdl->tcp_free = NULL;
+	c_hdl->is_in_tcp_free = 0;
 	if(!c->tcp_free) {
 		/* stop accepting incoming queries for now. */
 		comm_point_stop_listening(c);
@@ -3316,12 +3324,14 @@ reclaim_tcp_handler(struct comm_point* c)
 #endif
 	}
 	comm_point_close(c);
-	if(c->tcp_parent) {
-		if(c != c->tcp_parent->tcp_free) {
-			c->tcp_parent->cur_tcp_count--;
-			c->tcp_free = c->tcp_parent->tcp_free;
-			c->tcp_parent->tcp_free = c;
-		}
+	if(c->tcp_parent && !c->is_in_tcp_free) {
+		/* Should not happen: bad tcp_free state in reclaim_tcp. */
+		log_assert(c->tcp_free == NULL);
+		log_assert(c->tcp_parent->cur_tcp_count > 0);
+		c->tcp_parent->cur_tcp_count--;
+		c->tcp_free = c->tcp_parent->tcp_free;
+		c->tcp_parent->tcp_free = c;
+		c->is_in_tcp_free = 1;
 		if(!c->tcp_free) {
 			/* re-enable listening on accept socket */
 			comm_point_start_listening(c->tcp_parent, -1, -1);
@@ -4707,12 +4717,14 @@ reclaim_http_handler(struct comm_point* c)
 #endif
 	}
 	comm_point_close(c);
-	if(c->tcp_parent) {
-		if(c != c->tcp_parent->tcp_free) {
-			c->tcp_parent->cur_tcp_count--;
-			c->tcp_free = c->tcp_parent->tcp_free;
-			c->tcp_parent->tcp_free = c;
-		}
+	if(c->tcp_parent && !c->is_in_tcp_free) {
+		/* Should not happen: bad tcp_free state in reclaim_http. */
+		log_assert(c->tcp_free == NULL);
+		log_assert(c->tcp_parent->cur_tcp_count > 0);
+		c->tcp_parent->cur_tcp_count--;
+		c->tcp_free = c->tcp_parent->tcp_free;
+		c->tcp_parent->tcp_free = c;
+		c->is_in_tcp_free = 1;
 		if(!c->tcp_free) {
 			/* re-enable listening on accept socket */
 			comm_point_start_listening(c->tcp_parent, -1, -1);
@@ -5149,6 +5161,15 @@ ssize_t http2_recv_cb(nghttp2_session* ATTR_UNUSED(session), uint8_t* buf,
 
 	log_assert(h2_session->c->type == comm_http);
 	log_assert(h2_session->c->h2_session);
+	if(++h2_session->reads_count > h2_session->c->http2_max_streams) {
+		/* We are somewhat arbitrarily capping the amount of
+		 * consecutive reads on the HTTP2 session to the number of max
+		 * allowed streams.
+		 * When we reach the cap, error out with NGHTTP2_ERR_WOULDBLOCK
+		 * to signal nghttp2_session_recv() to stop reading for now. */
+		h2_session->reads_count = 0;
+		return NGHTTP2_ERR_WOULDBLOCK;
+	}
 
 #ifdef HAVE_SSL
 	if(h2_session->c->ssl) {
@@ -5182,7 +5203,7 @@ ssize_t http2_recv_cb(nghttp2_session* ATTR_UNUSED(session), uint8_t* buf,
 	}
 #endif /* HAVE_SSL */
 
-	ret = recv(h2_session->c->fd, buf, len, MSG_DONTWAIT);
+	ret = recv(h2_session->c->fd, (void*)buf, len, MSG_DONTWAIT);
 	if(ret == 0) {
 		return NGHTTP2_ERR_EOF;
 	} else if(ret < 0) {
@@ -5510,7 +5531,7 @@ ssize_t http2_send_cb(nghttp2_session* ATTR_UNUSED(session), const uint8_t* buf,
 	}
 #endif /* HAVE_SSL */
 
-	ret = send(h2_session->c->fd, buf, len, 0);
+	ret = send(h2_session->c->fd, (void*)buf, len, 0);
 	if(ret == 0) {
 		return NGHTTP2_ERR_CALLBACK_FAILURE;
 	} else if(ret < 0) {
@@ -5748,6 +5769,7 @@ comm_point_create_udp(struct comm_base *base, int fd, sldns_buffer* buffer,
 	c->cur_tcp_count = 0;
 	c->tcp_handlers = NULL;
 	c->tcp_free = NULL;
+	c->is_in_tcp_free = 0;
 	c->type = comm_udp;
 	c->tcp_do_close = 0;
 	c->do_not_close = 0;
@@ -5812,6 +5834,7 @@ comm_point_create_udp_ancil(struct comm_base *base, int fd,
 	c->cur_tcp_count = 0;
 	c->tcp_handlers = NULL;
 	c->tcp_free = NULL;
+	c->is_in_tcp_free = 0;
 	c->type = comm_udp;
 	c->tcp_do_close = 0;
 	c->do_not_close = 0;
@@ -5879,6 +5902,7 @@ comm_point_create_doq(struct comm_base *base, int fd, sldns_buffer* buffer,
 	c->cur_tcp_count = 0;
 	c->tcp_handlers = NULL;
 	c->tcp_free = NULL;
+	c->is_in_tcp_free = 0;
 	c->type = comm_doq;
 	c->tcp_do_close = 0;
 	c->do_not_close = 0;
@@ -5979,6 +6003,7 @@ comm_point_create_tcp_handler(struct comm_base *base,
 	c->cur_tcp_count = 0;
 	c->tcp_handlers = NULL;
 	c->tcp_free = NULL;
+	c->is_in_tcp_free = 0;
 	c->type = comm_tcp;
 	c->tcp_do_close = 0;
 	c->do_not_close = 0;
@@ -6016,6 +6041,7 @@ comm_point_create_tcp_handler(struct comm_base *base,
 	/* add to parent free list */
 	c->tcp_free = parent->tcp_free;
 	parent->tcp_free = c;
+	c->is_in_tcp_free = 1;
 	/* ub_event stuff */
 	evbits = UB_EV_PERSIST | UB_EV_READ | UB_EV_TIMEOUT;
 	c->ev->ev = ub_event_new(base->eb->base, c->fd, evbits,
@@ -6078,6 +6104,7 @@ comm_point_create_http_handler(struct comm_base *base,
 	c->cur_tcp_count = 0;
 	c->tcp_handlers = NULL;
 	c->tcp_free = NULL;
+	c->is_in_tcp_free = 0;
 	c->type = comm_http;
 	c->tcp_do_close = 1;
 	c->do_not_close = 0;
@@ -6136,6 +6163,7 @@ comm_point_create_http_handler(struct comm_base *base,
 	/* add to parent free list */
 	c->tcp_free = parent->tcp_free;
 	parent->tcp_free = c;
+	c->is_in_tcp_free = 1;
 	/* ub_event stuff */
 	evbits = UB_EV_PERSIST | UB_EV_READ | UB_EV_TIMEOUT;
 	c->ev->ev = ub_event_new(base->eb->base, c->fd, evbits,
@@ -6197,6 +6225,7 @@ comm_point_create_tcp(struct comm_base *base, int fd, int num,
 		return NULL;
 	}
 	c->tcp_free = NULL;
+	c->is_in_tcp_free = 0;
 	c->type = comm_tcp_accept;
 	c->tcp_do_close = 0;
 	c->do_not_close = 0;
@@ -6291,6 +6320,7 @@ comm_point_create_tcp_out(struct comm_base *base, size_t bufsize,
 	c->cur_tcp_count = 0;
 	c->tcp_handlers = NULL;
 	c->tcp_free = NULL;
+	c->is_in_tcp_free = 0;
 	c->type = comm_tcp;
 	c->tcp_do_close = 0;
 	c->do_not_close = 0;
@@ -6355,6 +6385,7 @@ comm_point_create_http_out(struct comm_base *base, size_t bufsize,
 	c->cur_tcp_count = 0;
 	c->tcp_handlers = NULL;
 	c->tcp_free = NULL;
+	c->is_in_tcp_free = 0;
 	c->type = comm_http;
 	c->tcp_do_close = 0;
 	c->do_not_close = 0;
@@ -6425,6 +6456,7 @@ comm_point_create_local(struct comm_base *base, int fd, size_t bufsize,
 	c->cur_tcp_count = 0;
 	c->tcp_handlers = NULL;
 	c->tcp_free = NULL;
+	c->is_in_tcp_free = 0;
 	c->type = comm_local;
 	c->tcp_do_close = 0;
 	c->do_not_close = 1;
@@ -6488,6 +6520,7 @@ comm_point_create_raw(struct comm_base* base, int fd, int writing,
 	c->cur_tcp_count = 0;
 	c->tcp_handlers = NULL;
 	c->tcp_free = NULL;
+	c->is_in_tcp_free = 0;
 	c->type = comm_raw;
 	c->tcp_do_close = 0;
 	c->do_not_close = 1;
diff --git a/util/netevent.h b/util/netevent.h
index 96de0032c..c5114bbbe 100644
--- a/util/netevent.h
+++ b/util/netevent.h
@@ -238,6 +238,8 @@ struct comm_point {
 	/** linked list of free tcp_handlers to use for new queries.
 	    For tcp_accept the first entry, for tcp_handlers the next one. */
 	struct comm_point* tcp_free;
+	/** Whether this struct is in its parent's tcp_free list */
+	int is_in_tcp_free;
 
 	/* -------- SSL TCP DNS ------- */
 	/** the SSL object with rw bio (owned) or for commaccept ctx ref */
@@ -937,6 +939,8 @@ struct http2_session {
 	/** comm point containing buffer used to build answer in worker or
 	 * module */
 	struct comm_point* c;
+	/** count the number of consecutive reads on the session */
+	uint32_t reads_count;
 	/** session is instructed to get dropped (comm port will be closed) */
 	int is_drop;
 	/** postpone dropping the session, can be used to prevent dropping
diff --git a/util/tsig.c b/util/tsig.c
index 23075c536..d5f2ff29a 100644
--- a/util/tsig.c
+++ b/util/tsig.c
@@ -60,6 +60,9 @@
 
 /** Fudge time to allow in signed time for TSIG records. In seconds. */
 #define TSIG_FUDGE_TIME 300
+/** Maximum number of unsigned TSIG packets. +3 for interoperability, off by
+ * one errors. */
+#define TSIG_MAX_UNSIGNED 103
 
 /**
  * The list of TSIG algorithms. It has short_name, wireformat_name,
@@ -76,6 +79,10 @@ static struct tsig_algorithm tsig_algorithm_table[] = {
 	{ "hmac-sha512", (uint8_t*)"\x0Bhmac-sha512\x00", 13, "sha512", 64 }
 };
 
+/** Delete the tsig calc state. */
+static void tsig_calc_state_delete(
+	struct tsig_calc_state_crypto* calc_state_crypto);
+
 int
 tsig_key_compare(const void* v1, const void* v2)
 {
@@ -252,6 +259,44 @@ tsig_key_table_search(struct tsig_key_table* key_table, uint8_t* name,
 	return (struct tsig_key*)node->key;
 }
 
+struct tsig_key*
+tsig_key_table_search_fromstr(struct tsig_key_table* key_table, char* name)
+{
+	uint8_t buf[LDNS_MAX_DOMAINLEN+1];
+	size_t len = sizeof(buf);
+	if(sldns_str2wire_dname_buf(name, buf, &len) != 0) {
+		log_err("could not parse '%s'", name);
+		return NULL;
+	}
+	return tsig_key_table_search(key_table, buf, len);
+}
+
+size_t
+tsig_key_table_get_mem(struct tsig_key_table* tsig_key_table)
+{
+	size_t s;
+	struct tsig_key* p;
+	if(!tsig_key_table)
+		return 0;
+	lock_rw_rdlock(&tsig_key_table->lock);
+	s = sizeof(*tsig_key_table) + sizeof(rbtree_type);
+	RBTREE_FOR(p, struct tsig_key*, tsig_key_table->tree) {
+		s += sizeof(*p) + strlen(p->name_str)+1
+			+ p->name_len + p->data_len;
+	}
+	lock_rw_unlock(&tsig_key_table->lock);
+	return s;
+}
+
+void
+tsig_key_table_swap_tree(struct tsig_key_table* tsig_key_table,
+	struct tsig_key_table* data)
+{
+	rbtree_type* oldtree = tsig_key_table->tree;
+	tsig_key_table->tree = data->tree;
+	data->tree = oldtree;
+}
+
 void tsig_key_delete(struct tsig_key* key)
 {
 	if(!key)
@@ -455,6 +500,7 @@ tsig_create(struct tsig_key_table* key_table, uint8_t* name, size_t namelen)
 	tsig->error = 0;
 	tsig->other_len = 0;
 	tsig->other_time = 0;
+	tsig->every_nth = 1;
 	return tsig;
 }
 
@@ -474,12 +520,24 @@ void
 tsig_delete(struct tsig_data* tsig)
 {
 	if(!tsig) return;
+	if(tsig->calc_state) {
+		tsig_calc_state_delete(tsig->calc_state);
+		tsig->calc_state = NULL;
+	}
 	free(tsig->key_name);
 	free(tsig->algo_name);
 	free(tsig->mac);
 	free(tsig);
 }
 
+size_t tsig_get_mem(struct tsig_data* tsig)
+{
+	if(!tsig)
+		return 0;
+	return sizeof(*tsig) + tsig->key_name_len + tsig->algo_name_len
+		+ tsig->mac_size;
+}
+
 size_t
 tsig_reserved_space(struct tsig_data* tsig)
 {
@@ -1385,6 +1443,7 @@ tsig_lookup_key(struct tsig_key_table* key_table,
 	}
 	tsig->fudge = TSIG_FUDGE_TIME; /* seconds */
 	tsig->klass = LDNS_RR_CLASS_ANY;
+	tsig->every_nth = 1;
 	if(region)
 		tsig->key_name = regional_alloc(region, rr->key_name_len);
 	else
@@ -1592,6 +1651,51 @@ tsig_find_rr(struct sldns_buffer* pkt)
 	return 1;
 }
 
+int tsig_in_packet(struct sldns_buffer* pkt)
+{
+	size_t end_pos, n_rrs;
+	if(sldns_buffer_limit(pkt) < LDNS_HEADER_SIZE) {
+		return 0;
+	}
+	if(LDNS_ARCOUNT(sldns_buffer_begin(pkt)) < 1) {
+		return 0;
+	}
+	n_rrs = LDNS_ANCOUNT(sldns_buffer_begin(pkt))
+	      + LDNS_NSCOUNT(sldns_buffer_begin(pkt))
+	      + LDNS_ARCOUNT(sldns_buffer_begin(pkt))
+	      - 1;
+
+	sldns_buffer_rewind(pkt);
+	sldns_buffer_skip(pkt, LDNS_HEADER_SIZE);
+
+	/* Skip qnames. */
+	if(!skip_pkt_query_rrs(pkt, LDNS_QDCOUNT(sldns_buffer_begin(pkt)))) {
+		return 0;
+	}
+	/* Skip all rrs. */
+	if(!skip_pkt_rrs(pkt, n_rrs)) {
+		return 0;
+	}
+	end_pos = sldns_buffer_position(pkt);
+
+	/* The tsig owner name, the key name */
+	if(sldns_buffer_remaining(pkt) < 1) {
+		return 0;
+	}
+	if(!pkt_dname_len(pkt)) {
+		return 0;
+	}
+	if(sldns_buffer_remaining(pkt) < 2+2+4+2) {
+		return 0;
+	}
+	if(sldns_buffer_read_u16(pkt) != LDNS_RR_TYPE_TSIG) {
+		return 0;
+	}
+
+	sldns_buffer_set_position(pkt, end_pos);
+	return 1;
+}
+
 int
 tsig_sign_reply(struct tsig_data* tsig, struct sldns_buffer* pkt,
 	struct tsig_key_table* key_table, uint64_t now)
@@ -1984,3 +2088,376 @@ tsig_sign_shared(sldns_buffer* pkt, const uint8_t* name, const uint8_t* alg,
 		key.algo->wireformat_name_len, tsig.mac, tsig.mac_size);
 	return 0;
 }
+
+int
+tsig_sign_reply_xfr(struct tsig_data* tsig, struct sldns_buffer* pkt,
+	struct tsig_key_table* key_table, uint64_t now, int last_packet)
+{
+	size_t aftername_pos;
+	uint16_t current_query_id;
+	uint8_t timers_var_buf[64];
+	struct sldns_buffer timers_var;
+	struct tsig_key* key;
+
+	sldns_buffer_init_frm_data(&timers_var, timers_var_buf,
+		sizeof(timers_var_buf));
+
+	if(!tsig) {
+		/* For some rcodes, like FORMERR, no tsig data is returned,
+		 * and also no TSIG is needed on the reply. */
+		verbose(VERB_ALGO, "tsig_sign_reply: no TSIG on error reply");
+		return 1;
+	}
+	if(LDNS_RCODE_WIRE(sldns_buffer_begin(pkt)) == LDNS_RCODE_SERVFAIL ||
+	   LDNS_RCODE_WIRE(sldns_buffer_begin(pkt)) == LDNS_RCODE_FORMERR ||
+	   LDNS_RCODE_WIRE(sldns_buffer_begin(pkt)) == LDNS_RCODE_NOTIMPL ||
+	   (LDNS_RCODE_WIRE(sldns_buffer_begin(pkt)) == LDNS_RCODE_NOTAUTH &&
+	    tsig->error != LDNS_TSIG_ERROR_BADTIME)) {
+		uint8_t* algo_name;
+		size_t algo_name_len;
+		/* No TSIG calculation on error reply. */
+		if(tsig->error == 0)
+			return 1; /* No TSIG needed for the error. Also,
+			copying in possible formerr contents is not desired. */
+		if(tsig->algo_name) {
+			/* For errors, the tsig->algo_name is allocated. */
+			algo_name = tsig->algo_name;
+			algo_name_len = tsig->algo_name_len;
+		} else {
+			/* Robust code in case there is algo name. */
+			algo_name = (uint8_t*)"\000";
+			algo_name_len = 1;
+		}
+
+		/* The TSIG can be written straight away */
+		sldns_buffer_write(pkt, tsig->key_name, tsig->key_name_len);
+		aftername_pos = sldns_buffer_position(pkt);
+		tsig_append_rr(tsig, pkt, aftername_pos, algo_name,
+			algo_name_len, NULL, 0);
+		return 1;
+	}
+
+	if(!tsig->later_packet) {
+		/* First packet is signed as usual */
+		int ret;
+		ret = tsig_sign_reply(tsig, pkt, key_table, now);
+		tsig->later_packet = 1;
+		return ret;
+	}
+
+	if(tsig->num_updates == 0) {
+		/* Init the calc state for the new packet, or for the new
+		 * packet sequence. */
+		if(tsig->calc_state) {
+			tsig_calc_state_delete(tsig->calc_state);
+			tsig->calc_state = NULL;
+		}
+		lock_rw_rdlock(&key_table->lock);
+		key = tsig_key_table_search(key_table, tsig->key_name,
+			tsig->key_name_len);
+		if(!key) {
+			/* The tsig key has disappeared from the key table. */
+			lock_rw_unlock(&key_table->lock);
+			verbose(VERB_ALGO, "tsig_sign_reply_xfr: key not in table");
+			return 0;
+		}
+
+		tsig->calc_state = tsig_calc_state_init(key);
+		lock_rw_unlock(&key_table->lock);
+		if(!tsig->calc_state) {
+			verbose(VERB_ALGO, "tsig_sign_reply_xfr: out of memory");
+			return 0;
+		}
+
+		/* Update with the prior mac. */
+		if(tsig->mac_size != 0 && tsig->mac) {
+			uint8_t prior_buf[1024];
+			struct sldns_buffer prior;
+			sldns_buffer_init_frm_data(&prior, prior_buf,
+				sizeof(prior_buf));
+			if(sldns_buffer_remaining(&prior) <
+				2 /* mac_size */ + tsig->mac_size) {
+				verbose(VERB_ALGO, "tsig_sign_reply_xfr: prior buffer too small");
+				return 0;
+			}
+			sldns_buffer_write_u16(&prior, tsig->mac_size);
+			sldns_buffer_write(&prior, tsig->mac, tsig->mac_size);
+			if(!tsig_calc_state_update(tsig->calc_state, &prior)) {
+				verbose(VERB_ALGO, "tsig_sign_reply_xfr: failed to update tsig crypto");
+				return 0;
+			}
+		}
+	}
+
+	if(tsig->every_nth != 1 && tsig->num_updates+1 < tsig->every_nth &&
+		!last_packet) {
+		/* Update with the packet contents. */
+		current_query_id = sldns_buffer_read_u16_at(pkt, 0);
+		sldns_buffer_write_u16_at(pkt, 0, tsig->original_query_id);
+		if(!tsig_calc_state_update(tsig->calc_state, pkt)) {
+			sldns_buffer_write_u16_at(pkt, 0, current_query_id);
+			verbose(VERB_ALGO, "tsig_sign_reply_xfr: failed to update tsig crypto");
+			return 0;
+		}
+		sldns_buffer_write_u16_at(pkt, 0, current_query_id);
+		tsig->num_updates++;
+		return 1;
+	}
+
+	/* Update with the packet contents. */
+	current_query_id = sldns_buffer_read_u16_at(pkt, 0);
+	sldns_buffer_write_u16_at(pkt, 0, tsig->original_query_id);
+	if(!tsig_calc_state_update(tsig->calc_state, pkt)) {
+		sldns_buffer_write_u16_at(pkt, 0, current_query_id);
+		verbose(VERB_ALGO, "tsig_sign_reply_xfr: failed to update tsig crypto");
+		return 0;
+	}
+	sldns_buffer_write_u16_at(pkt, 0, current_query_id);
+
+	/* Update with the timers part of the variables. */
+	tsig->time_signed = now;
+	sldns_buffer_write_u48(&timers_var, tsig->time_signed);
+	sldns_buffer_write_u16(&timers_var, tsig->fudge);
+	if(!tsig_calc_state_update(tsig->calc_state, &timers_var)) {
+		verbose(VERB_ALGO, "tsig_sign_reply_xfr: failed to update tsig crypto");
+		return 0;
+	}
+
+	/* Finalize the calculation. */
+	if(!tsig_calc_state_final(tsig->calc_state, tsig)) {
+		verbose(VERB_ALGO, "tsig_sign_reply_xfr: failed to make final tsig crypto");
+		return 0;
+	}
+
+	/* Append TSIG record. */
+	if(sldns_buffer_remaining(pkt) < tsig_reserved_space(tsig)) {
+		/* Not enough space in buffer for packet and TSIG. */
+		verbose(VERB_ALGO, "tsig_sign_reply: not enough buffer space");
+		return 0;
+	}
+	sldns_buffer_write_u16_at(pkt, 0, current_query_id);
+	sldns_buffer_write(pkt, tsig->key_name, tsig->key_name_len);
+	aftername_pos = sldns_buffer_position(pkt);
+
+	/* Get the key for the algorithm name. */
+	lock_rw_rdlock(&key_table->lock);
+	key = tsig_key_table_search(key_table, tsig->key_name,
+		tsig->key_name_len);
+	if(!key) {
+		/* The tsig key has disappeared from the key table. */
+		lock_rw_unlock(&key_table->lock);
+		verbose(VERB_ALGO, "tsig_sign_reply_xfr: key not in table");
+		return 0;
+	}
+	tsig_append_rr(tsig, pkt, aftername_pos, key->algo->wireformat_name,
+		key->algo->wireformat_name_len, tsig->mac, tsig->mac_size);
+	lock_rw_unlock(&key_table->lock);
+	tsig->num_updates = 0;
+	return 1;
+}
+
+int
+tsig_verify_reply_xfr(struct tsig_data* tsig, struct sldns_buffer* pkt,
+	struct tsig_record* rr, uint64_t now)
+{
+	uint8_t timers_var_buf[64];
+	struct sldns_buffer timers_var;
+	uint16_t current_query_id;
+
+	sldns_buffer_init_frm_data(&timers_var, timers_var_buf,
+		sizeof(timers_var_buf));
+
+	/* packet with original query ID and ARCOUNT without TSIG. */
+	current_query_id = sldns_buffer_read_u16_at(pkt, 0);
+	sldns_buffer_write_u16_at(pkt, 0, rr->original_query_id);
+	LDNS_ARCOUNT_SET( sldns_buffer_begin(pkt)
+			, LDNS_ARCOUNT(sldns_buffer_begin(pkt)) - 1);
+	sldns_buffer_set_position(pkt, rr->tsig_pos);
+
+	/* Update with packet */
+	if(!tsig_calc_state_update(tsig->calc_state, pkt)) {
+		sldns_buffer_write_u16_at(pkt, 0, current_query_id);
+		verbose(VERB_ALGO, "tsig_verify_reply_xfr: failed to update tsig crypto");
+		return 0;
+	}
+
+	/* Update with the timers part of the variables. */
+	sldns_buffer_write_u48(&timers_var, rr->signed_time);
+	sldns_buffer_write_u16(&timers_var, rr->fudge_time);
+	if(!tsig_calc_state_update(tsig->calc_state, &timers_var)) {
+		sldns_buffer_write_u16_at(pkt, 0, current_query_id);
+		verbose(VERB_ALGO, "tsig_verify_reply_xfr: failed to update tsig crypto");
+		return 0;
+	}
+
+	/* Finalize the calculation. */
+	if(!tsig_calc_state_final(tsig->calc_state, tsig)) {
+		sldns_buffer_write_u16_at(pkt, 0, current_query_id);
+		verbose(VERB_ALGO, "tsig_verify_reply_xfr: failed to make final tsig crypto");
+		return 0;
+	}
+
+	if(CRYPTO_memcmp(rr->mac_data, tsig->mac, tsig->mac_size) != 0) {
+		/* TSIG has wrong digest. */
+		sldns_buffer_write_u16_at(pkt, 0, current_query_id);
+		if(verbosity >= VERB_ALGO) {
+			char keynm[256];
+			dname_str(tsig->key_name, keynm);
+			verbose(VERB_ALGO, "tsig_verify_reply_xfr: TSIG %s has wrong digest",
+				keynm);
+		}
+		return 0;
+	}
+	/* The TSIG digest has verified */
+	sldns_buffer_write_u16_at(pkt, 0, current_query_id);
+
+	/* Check the TSIG timestamp. */
+	/* Time is checked after the MAC is verified */
+	if( (now > rr->signed_time && now - rr->signed_time > rr->fudge_time) ||
+	    (now < rr->signed_time && rr->signed_time - now > rr->fudge_time)) {
+		/* TSIG has wrong timestamp. */
+		if(verbosity >= VERB_ALGO) {
+			char keynm[256];
+			dname_str(tsig->key_name, keynm);
+			verbose(VERB_ALGO, "tsig_verify_reply_xfr: TSIG %s has wrong timestamp, now=%llu packet time=%llu fudge time=%d",
+				keynm, (unsigned long long)now,
+				(unsigned long long)rr->signed_time,
+				(int)rr->fudge_time);
+			if(rr->other_size == 6)
+				verbose(VERB_ALGO, "tsig_verify_reply_xfr: other time is reported at %llu",
+					(unsigned long long)rr->other_time);
+		}
+		return 0;
+	}
+
+	return 1;
+}
+
+int
+tsig_parse_verify_reply_xfr(struct tsig_data* tsig, struct sldns_buffer* pkt,
+	struct tsig_key_table* key_table, uint64_t now, int last_packet)
+{
+	struct tsig_key* key;
+	struct tsig_record rr;
+	int ret;
+
+	if(!tsig->later_packet) {
+		/* First packet verifies like normal. */
+		int ret;
+		ret = tsig_parse_verify_reply(tsig, pkt, key_table, now);
+		tsig->later_packet = 1;
+		return ret;
+	}
+
+	/* Init if needed. */
+	if(tsig->num_updates == 0) {
+		/* Init the calc state for the new packet, or for the new
+		 * packet sequence. */
+		struct tsig_key* key;
+		if(tsig->calc_state) {
+			tsig_calc_state_delete(tsig->calc_state);
+			tsig->calc_state = NULL;
+		}
+		lock_rw_rdlock(&key_table->lock);
+		key = tsig_key_table_search(key_table, tsig->key_name,
+			tsig->key_name_len);
+		if(!key) {
+			/* The tsig key has disappeared from the key table. */
+			lock_rw_unlock(&key_table->lock);
+			verbose(VERB_ALGO, "tsig_parse_verify_reply_xfr: key not in table");
+			return 0;
+		}
+
+		tsig->calc_state = tsig_calc_state_init(key);
+		lock_rw_unlock(&key_table->lock);
+		if(!tsig->calc_state) {
+			verbose(VERB_ALGO, "tsig_parse_verify_reply_xfr: out of memory");
+			return 0;
+		}
+
+		/* Update with the prior mac. */
+		if(tsig->mac_size != 0 && tsig->mac) {
+			uint8_t prior_buf[1024];
+			struct sldns_buffer prior;
+			sldns_buffer_init_frm_data(&prior, prior_buf,
+				sizeof(prior_buf));
+			if(sldns_buffer_remaining(&prior) <
+				2 /* mac_size */ + tsig->mac_size) {
+				verbose(VERB_ALGO, "tsig_parse_verify_reply_xfr: prior buffer too small");
+				return 0;
+			}
+			sldns_buffer_write_u16(&prior, tsig->mac_size);
+			sldns_buffer_write(&prior, tsig->mac, tsig->mac_size);
+			if(!tsig_calc_state_update(tsig->calc_state, &prior)) {
+				verbose(VERB_ALGO, "tsig_parse_verify_reply_xfr: failed to update tsig crypto");
+				return 0;
+			}
+		}
+	}
+
+	/* If there is no TSIG, that is okay, for every_nth. Update
+	 * the counters. */
+	/* The ARCOUNT is 0 or we are at end of packet without TSIG. */
+	if(LDNS_ARCOUNT(sldns_buffer_begin(pkt)) < 1 ||
+		sldns_buffer_remaining(pkt) < 1) {
+		uint16_t current_query_id;
+		tsig->num_updates++;
+		if(last_packet) {
+			verbose(VERB_ALGO, "tsig_parse_verify_reply_xfr: last packet missing TSIG.");
+			return 0;
+		}
+		if(tsig->num_updates > TSIG_MAX_UNSIGNED) {
+			verbose(VERB_ALGO, "tsig_parse_verify_reply_xfr: too many packets without TSIG.");
+			return 0;
+		}
+		/* Update with the packet contents. */
+		current_query_id = sldns_buffer_read_u16_at(pkt, 0);
+		sldns_buffer_write_u16_at(pkt, 0, tsig->original_query_id);
+		if(!tsig_calc_state_update(tsig->calc_state, pkt)) {
+			sldns_buffer_write_u16_at(pkt, 0, current_query_id);
+			verbose(VERB_ALGO, "tsig_parse_verify_reply_xfr: failed to update tsig crypto");
+			return 0;
+		}
+		sldns_buffer_write_u16_at(pkt, 0, current_query_id);
+		return 1;
+	}
+
+	/* Parse the TSIG RR from the query. */
+	ret = tsig_parse(pkt, &rr);
+	if(ret != 0)
+		return 0;
+
+	/* Check it is the same key, same algo, same digest_size */
+	if(dname_pkt_compare(pkt, tsig->key_name, rr.key_name) != 0) {
+		verbose(VERB_ALGO, "tsig_parse_verify_reply_xfr: key name wrong");
+		return 0;
+	}
+
+	lock_rw_rdlock(&key_table->lock);
+	key = tsig_key_table_search(key_table, tsig->key_name,
+		tsig->key_name_len);
+	if(!key) {
+		/* The tsig key has disappeared from the key table. */
+		lock_rw_unlock(&key_table->lock);
+		verbose(VERB_ALGO, "tsig_parse_verify_reply_xfr: key not in table");
+		return 0;
+	}
+
+	if(query_dname_compare(key->algo->wireformat_name,
+		rr.algorithm_name) != 0) {
+		lock_rw_unlock(&key_table->lock);
+		verbose(VERB_ALGO, "tsig_parse_verify_reply_xfr: algorithm wrong");
+		return 0;
+	}
+	if(tsig->mac_size != rr.mac_size) {
+		lock_rw_unlock(&key_table->lock);
+		verbose(VERB_ALGO, "tsig_parse_verify_reply_xfr: mac size wrong");
+		return 0;
+	}
+	lock_rw_unlock(&key_table->lock);
+	tsig->num_updates = 0;
+
+	/* Verify the TSIG. */
+	ret = tsig_verify_reply_xfr(tsig, pkt, &rr, now);
+	return ret;
+}
diff --git a/util/tsig.h b/util/tsig.h
index 06a63f5bb..2b5fbab6e 100644
--- a/util/tsig.h
+++ b/util/tsig.h
@@ -47,6 +47,7 @@ struct sldns_buffer;
 struct config_file;
 struct config_tsig_key;
 struct regional;
+struct tsig_calc_state_crypto;
 
 /**
  * TSIG record, the RR that is in the packet.
@@ -118,6 +119,17 @@ struct tsig_data {
 	uint16_t other_len;
 	/** if other len 6, this is 48bit time of error. */
 	uint64_t other_time;
+	/** For zone transfers, there are several packets and TSIGs,
+	 * this keeps track of the tsig calculation state. It is malloced,
+	 * and the tsig has to be deleted to free it. */
+	struct tsig_calc_state_crypto* calc_state;
+	/** For the first packet it is 0, for later packets 1. */
+	int later_packet;
+	/** The number of update only packets without a tsig. */
+	int num_updates;
+	/** The number of packets after which to sign with TSIG, 1 is every
+	 * time. */
+	int every_nth;
 };
 
 /**
@@ -171,7 +183,8 @@ struct tsig_key {
  * They are read from config.
  */
 struct tsig_key_table {
-	/* Lock on the tsig key table and all keys. */
+	/* Lock on the tsig key table and all keys.
+	 * This lock is after the forwards, hints and anchor locks. */
 	lock_rw_type lock;
 	/* Tree of tsig keys, by wireformat name. */
 	struct rbtree_type* tree;
@@ -217,6 +230,33 @@ int tsig_key_table_apply_cfg(struct tsig_key_table* key_table,
 struct tsig_key* tsig_key_table_search(struct tsig_key_table* key_table,
 	uint8_t* name, size_t namelen);
 
+/**
+ * Find key in key table. Caller must hold lock on the table.
+ * @param key_table: the tsig key table.
+ * @param name: the name in string format, it is parsed to wireformat.
+ * @return the found key or NULL if not found or NULL on parse error of the
+ * key name as a domain name. The item is locked by the key_table lock.
+ */
+struct tsig_key* tsig_key_table_search_fromstr(
+	struct tsig_key_table* key_table, char* name);
+
+/**
+ * Get memory usage of tsig key table.
+ * @param tsig_key_table: the tsig key table.
+ * @return memory use.
+ */
+size_t tsig_key_table_get_mem(struct tsig_key_table* tsig_key_table);
+
+/**
+ * Swap internal tree with preallocated entries. Caller should manage
+ * the locks.
+ * @param tsig_key_table: the tsig_key_table data structure.
+ * @param data: the data structure used to take elements from. This contains
+ * 	the old elements on return.
+ */
+void tsig_key_table_swap_tree(struct tsig_key_table* tsig_key_table,
+	struct tsig_key_table* data);
+
 /**
  * Delete TSIG key.
  * @param key: to delete
@@ -295,6 +335,13 @@ struct tsig_data* tsig_create_fromstr(struct tsig_key_table* key_table,
  */
 void tsig_delete(struct tsig_data* tsig);
 
+/**
+ * Get memory usage of tsig data.
+ * @param rsig: the tsig data.
+ * @return memory use.
+ */
+size_t tsig_get_mem(struct tsig_data* tsig);
+
 /**
  * Sign a query with TSIG. Appends the TSIG record.
  * @param tsig: the tsig data, keeps state to verify reply.
@@ -417,4 +464,54 @@ size_t tsig_reserved_space(struct tsig_data* tsig);
  */
 int tsig_find_rr(struct sldns_buffer* pkt);
 
+/**
+ * See if the packet as a TSIG, or not. Like tsig_find_rr, but it logs
+ * no error for absence of a TSIG.
+ * @param pkt: the packet
+ * @return false if malformed, and false if no tsig. true if tsig,
+ *	and the position is just before the TSIG record. So it can be parsed.
+ */
+int tsig_in_packet(struct sldns_buffer* pkt);
+
+/**
+ * Sign XFR reply with TSIG. Appends the TSIG record. Call for later
+ * packets too.
+ * @param tsig: the tsig data. It must be malloced for the crypto state.
+ * @param pkt: the packet to sign.
+ * @param key_table: the tsig key table is used to fetch the key details.
+ * @param now: time to sign the query, the current time.
+ * @param last_packet: set to true for the last packet, that needs to be
+ *	TSIG signed.
+ * @return false on failure.
+ */
+int tsig_sign_reply_xfr(struct tsig_data* tsig, struct sldns_buffer* pkt,
+	struct tsig_key_table* key_table, uint64_t now, int last_packet);
+
+/**
+ * Verify XFR reply with TSIG.
+ * @param tsig: the tsig data.
+ * @param pkt: the reply to verify.
+ * @param rr: the tsig record parsed from the reply.
+ * @param now: time to sign the query, the current time.
+ * @return false on failure, like
+ *	alloc failure, wireformat malformed, did not verify.
+ */
+int tsig_verify_reply_xfr(struct tsig_data* tsig, struct sldns_buffer* pkt,
+	struct tsig_record* rr, uint64_t now);
+
+/**
+ * Parse and verify XFR reply with TSIG. Position at the TSIG record, or
+ * at end of packet if no TSIG record.
+ * @param tsig: the tsig data.
+ * @param pkt: the reply to verify.
+ * @param key_table: the tsig key table is used to fetch the key details.
+ * @param now: time to sign the query, the current time.
+ * @param last_packet: set true for the last packet, it must have a TSIG.
+ * @return false on failure, like
+ *	alloc failure, wireformat malformed, did not verify.
+ */
+int tsig_parse_verify_reply_xfr(struct tsig_data* tsig,
+	struct sldns_buffer* pkt, struct tsig_key_table* key_table,
+	uint64_t now, int last_packet);
+
 #endif /* UTIL_TSIG_H */
diff --git a/validator/val_neg.c b/validator/val_neg.c
index bc3a83aeb..7817d56fc 100644
--- a/validator/val_neg.c
+++ b/validator/val_neg.c
@@ -1066,11 +1066,7 @@ grab_nsec(struct rrset_cache* rrset_cache, uint8_t* qname, size_t qname_len,
 		qname, qname_len, qtype, qclass, flags, now, 0);
 	struct packed_rrset_data* d;
 	if(!k) return NULL;
-	d = (struct packed_rrset_data*)k->entry.data;
-	if(d->ttl < now) {
-		lock_rw_unlock(&k->entry.lock);
-		return NULL;
-	}
+	d = k->entry.data;
 	/* only secure or unchecked records that have signatures. */
 	if( ! ( d->security == sec_status_secure ||
 		(d->security == sec_status_unchecked &&
diff --git a/validator/val_utils.c b/validator/val_utils.c
index 549264d76..1a5f19673 100644
--- a/validator/val_utils.c
+++ b/validator/val_utils.c
@@ -1310,6 +1310,7 @@ val_find_DS(struct module_env* env, uint8_t* nm, size_t nmlen, uint16_t c,
 		/* DS rrset exists. Return it to the validator immediately*/
 		struct ub_packed_rrset_key* copy = packed_rrset_copy_region(
 			rrset, region, *env->now);
+		struct packed_rrset_data* d = copy->entry.data;
 		lock_rw_unlock(&rrset->entry.lock);
 		if(!copy)
 			return NULL;
@@ -1319,6 +1320,7 @@ val_find_DS(struct module_env* env, uint8_t* nm, size_t nmlen, uint16_t c,
 		msg->rep->rrsets[0] = copy;
 		msg->rep->rrset_count++;
 		msg->rep->an_numrrsets++;
+		UPDATE_TTL_FROM_RRSET(msg->rep->ttl, d->ttl);
 		return msg;
 	}
 	/* lookup in rrset and negative cache for NSEC/NSEC3 */
diff --git a/validator/validator.c b/validator/validator.c
index 5817fc808..c129df920 100644
--- a/validator/validator.c
+++ b/validator/validator.c
@@ -496,7 +496,7 @@ generate_request(struct module_qstate* qstate, int id, uint8_t* name,
 		struct mesh_state* sub = NULL;
 		fptr_ok(fptr_whitelist_modenv_add_sub(
 			qstate->env->add_sub));
-		if(!(*qstate->env->add_sub)(qstate, &ask, 
+		if(!(*qstate->env->add_sub)(qstate, &ask, NULL,
 			(uint16_t)(BIT_RD|flags), 0, valrec, newq, &sub)){
 			log_err("Could not generate request: out of memory");
 			return 0;
@@ -505,7 +505,7 @@ generate_request(struct module_qstate* qstate, int id, uint8_t* name,
 	else {
 		fptr_ok(fptr_whitelist_modenv_attach_sub(
 			qstate->env->attach_sub));
-		if(!(*qstate->env->attach_sub)(qstate, &ask, 
+		if(!(*qstate->env->attach_sub)(qstate, &ask, NULL,
 			(uint16_t)(BIT_RD|flags), 0, valrec, newq)){
 			log_err("Could not generate request: out of memory");
 			return 0;
diff --git a/winrc/win_svc.c b/winrc/win_svc.c
index 429b045dc..6fca0c7d5 100644
--- a/winrc/win_svc.c
+++ b/winrc/win_svc.c
@@ -369,7 +369,7 @@ service_init(int r, struct daemon** d, struct config_file** c)
 			cfg->tls_ciphers, cfg->tls_ciphersuites,
 			(cfg->tls_session_ticket_keys.first &&
 			cfg->tls_session_ticket_keys.first->str[0] != 0),
-			1, 0))) {
+			1, 0, cfg->tls_use_system_policy_versions))) {
 			fatal_exit("could not set up listen SSL_CTX");
 		}
 #ifdef HAVE_NGHTTP2_NGHTTP2_H
@@ -379,7 +379,7 @@ service_init(int r, struct daemon** d, struct config_file** c)
 				cfg->tls_ciphers, cfg->tls_ciphersuites,
 				(cfg->tls_session_ticket_keys.first &&
 				cfg->tls_session_ticket_keys.first->str[0] != 0),
-				0, 1))) {
+				0, 1, cfg->tls_use_system_policy_versions))) {
 				fatal_exit("could not set up listen doh SSL_CTX");
 			}
 		}