Merge branch 'master' into auth-load-thread

- Fix #1526 : Root Server h.root-servers.net has been included for Zone
Transfer Service by including it in the example configuration.
2026-10-14 12:35:11 +02:00 · 2026-10-13 15:56:17 +02:00 · 2026-10-13 14:49:39 +02:00 · 2026-10-13 09:51:19 +02:00 · 2026-10-09 15:55:21 +02:00 · 2026-10-09 09:47:13 +02:00
127 changed files with 8825 additions and 1361 deletions
@@ -1,380 +0,0 @@
-language: c
-
-git:
-  depth: 5
-
-addons:
-  apt:
-    packages:
-    - libssl-dev
-    - libevent-dev
-    - libexpat-dev
-    - clang
-  homebrew:
-    packages:
-      - openssl
-      - libevent
-      - expat
-    # homebrew update takes 20min or hangs, so disable update
-    #update: true
-
-jobs:
-  include:
-    - os: linux
-      name: GCC on Linux, Amd64
-      compiler: gcc
-      arch: amd64
-      env:
-        - CONFIG_OPTS="--enable-debug --disable-flto"
-    - os: linux
-      name: Clang on Linux, Amd64, clang-analysis
-      compiler: clang
-      arch: amd64
-      env:
-        - CONFIG_OPTS="--enable-debug --disable-flto"
-        - TEST_ANALYZER=yes
-    - os: osx
-      osx_image: xcode12.2
-      name: Clang on OS X, Amd64, clang-analysis
-      compiler: clang
-      arch: amd64
-      env:
-        - TEST_OSX=yes
-        - CONFIG_OPTS="--enable-debug --disable-flto --with-ssl=/usr/local/opt/openssl --with-libexpat=/usr/local/opt/expat"
-        - TEST_ANALYZER=yes
-        - HOMEBREW_NO_AUTO_UPDATE=1
-    - os: linux
-      name: Libevent, GCC on Linux, Amd64
-      compiler: gcc
-      arch: amd64
-      env:
-        - TEST_LIBEVENT=yes
-        - CONFIG_OPTS="--with-libevent"
-    - os: linux
-      name: Libevent, Clang on Linux, Amd64
-      compiler: clang
-      arch: amd64
-      env:
-        - TEST_LIBEVENT=yes
-        - CONFIG_OPTS="--with-libevent"
-    - os: osx
-      osx_image: xcode12.2
-      name: Libevent, Clang on OS X, Amd64
-      compiler: clang
-      arch: amd64
-      env:
-        - TEST_OSX=yes
-        - TEST_LIBEVENT=yes
-        - CONFIG_OPTS="--disable-flto --with-ssl=/usr/local/opt/openssl --with-libevent=/usr/local/opt/libevent --with-libexpat=/usr/local/opt/expat"
-        - HOMEBREW_NO_AUTO_UPDATE=1
-    - os: linux
-      name: UBsan, GCC on Linux, Amd64
-      compiler: gcc
-      arch: amd64
-      dist: bionic
-      env:
-        - TEST_UBSAN=yes
-    - os: linux
-      name: UBsan, Clang on Linux, Amd64
-      compiler: clang
-      arch: amd64
-      dist: bionic
-      env:
-        - TEST_UBSAN=yes
-    - os: linux
-      name: Asan, GCC on Linux, Amd64
-      compiler: gcc
-      arch: amd64
-      dist: bionic
-      env:
-        - TEST_ASAN=yes
-    - os: linux
-      name: Asan, Clang on Linux, Amd64
-      compiler: clang
-      arch: amd64
-      dist: bionic
-      env:
-        - TEST_ASAN=yes
-    - os: linux
-      name: GCC on Linux, Aarch64
-      compiler: gcc
-      arch: arm64
-      dist: bionic
-      env:
-        - CONFIG_OPTS="--enable-debug --disable-flto"
-    - os: linux
-      name: Clang on Linux, Aarch64
-      compiler: clang
-      arch: arm64
-      dist: bionic
-      env:
-        - CONFIG_OPTS="--enable-debug --disable-flto"
-    - os: linux
-      name: GCC on Linux, PowerPC64
-      compiler: gcc
-      arch: ppc64le
-      dist: bionic
-      env:
-        - CONFIG_OPTS="--enable-debug --disable-flto"
-    - os: linux
-      name: Clang on Linux, PowerPC64
-      compiler: clang
-      arch: ppc64le
-      dist: bionic
-      env:
-        - CONFIG_OPTS="--enable-debug --disable-flto"
-    - os: linux
-      name: GCC on Linux, s390x
-      compiler: gcc
-      arch: s390x
-      dist: bionic
-      env:
-        - CONFIG_OPTS="--enable-debug --disable-flto"
-    - os: linux
-      name: Clang on Linux, s390x
-      compiler: clang
-      arch: s390x
-      dist: bionic
-      env:
-        - CONFIG_OPTS="--enable-debug --disable-flto"
-    - os: osx
-      osx_image: xcode12.2
-      name: Apple iPhone on iOS, armv7
-      compiler: clang
-      env:
-        - TEST_IOS=yes
-        - AUTOTOOLS_HOST=armv7-apple-ios
-        - OPENSSL_HOST=ios-cross
-        - IOS_SDK=iPhoneOS
-        - IOS_CPU=armv7s
-        - IOS_PREFIX="$HOME/$IOS_SDK-$IOS_CPU"
-        - HOMEBREW_NO_AUTO_UPDATE=1
-    - os: osx
-      osx_image: xcode12.2
-      name: Apple iPhone on iOS, arm64
-      compiler: clang
-      env:
-        - TEST_IOS=yes
-        - AUTOTOOLS_HOST=aarch64-apple-ios
-        - OPENSSL_HOST=ios64-cross
-        - IOS_SDK=iPhoneOS
-        - IOS_CPU=arm64
-        - IOS_PREFIX="$HOME/$IOS_SDK-$IOS_CPU"
-        - HOMEBREW_NO_AUTO_UPDATE=1
-    - os: osx
-      osx_image: xcode12.2
-      name: Apple TV on iOS, arm64
-      compiler: clang
-      env:
-        - TEST_IOS=yes
-        - AUTOTOOLS_HOST=aarch64-apple-ios
-        - OPENSSL_HOST=ios64-cross
-        - IOS_SDK=AppleTVOS
-        - IOS_CPU=arm64
-        - IOS_PREFIX="$HOME/$IOS_SDK-$IOS_CPU"
-        - HOMEBREW_NO_AUTO_UPDATE=1
-    - os: osx
-      osx_image: xcode12.2
-      name: Apple Watch on iOS, armv7
-      compiler: clang
-      env:
-        - TEST_IOS=yes
-        - AUTOTOOLS_HOST=armv7-apple-ios
-        - OPENSSL_HOST=ios-cross
-        - IOS_SDK=WatchOS
-        - IOS_CPU=armv7k
-        - IOS_PREFIX="$HOME/$IOS_SDK-$IOS_CPU"
-        - HOMEBREW_NO_AUTO_UPDATE=1
-    - os: osx
-      osx_image: xcode12.2
-      name: iPhoneSimulator on OS X, i386
-      env:
-        - TEST_IOS=yes
-        - AUTOTOOLS_HOST=i386-apple-ios
-        - OPENSSL_HOST=iphoneos-cross
-        - IOS_CPU=i386
-        - IOS_SDK=iPhoneSimulator
-        - IOS_PREFIX="$HOME/$IOS_SDK-$IOS_CPU"
-        - HOMEBREW_NO_AUTO_UPDATE=1
-    - os: osx
-      osx_image: xcode12.2
-      name: iPhoneSimulator on OS X, x86_64
-      env:
-        - TEST_IOS=yes
-        - AUTOTOOLS_HOST=x86_64-apple-ios
-        - OPENSSL_HOST=iphoneos-cross
-        - IOS_CPU=x86_64
-        - IOS_SDK=iPhoneSimulator
-        - IOS_PREFIX="$HOME/$IOS_SDK-$IOS_CPU"
-        - HOMEBREW_NO_AUTO_UPDATE=1
-    - os: osx
-      osx_image: xcode12.2
-      name: AppleTVSimulator on OS X, x86_64
-      env:
-        - TEST_IOS=yes
-        - AUTOTOOLS_HOST=x86_64-apple-ios
-        - OPENSSL_HOST=iphoneos-cross
-        - IOS_CPU=x86_64
-        - IOS_SDK=AppleTVSimulator
-        - IOS_PREFIX="$HOME/$IOS_SDK-$IOS_CPU"
-        - HOMEBREW_NO_AUTO_UPDATE=1
-    - os: osx
-      osx_image: xcode12.2
-      name: WatchSimulator on OS X, i386
-      env:
-        - TEST_IOS=yes
-        - AUTOTOOLS_HOST=i386-apple-ios
-        - OPENSSL_HOST=iphoneos-cross
-        - IOS_CPU=i386
-        - IOS_SDK=WatchSimulator
-        - IOS_PREFIX="$HOME/$IOS_SDK-$IOS_CPU"
-        - HOMEBREW_NO_AUTO_UPDATE=1
-    - os: linux
-      name: Android armv7a, Linux, Amd64
-      compiler: clang
-      arch: amd64
-      dist: bionic
-      env:
-        - TEST_ANDROID=yes
-        - AUTOTOOLS_HOST=armv7a-linux-androideabi
-        - OPENSSL_HOST=android-arm
-        - ANDROID_CPU=armv7a
-        - ANDROID_API=23
-        - ANDROID_PREFIX="$HOME/android$ANDROID_API-$ANDROID_CPU"
-        - ANDROID_SDK_ROOT="$HOME/android-sdk"
-        - ANDROID_NDK_ROOT="$HOME/android-ndk"
-    - os: linux
-      name: Android aarch64, Linux, Amd64
-      compiler: clang
-      arch: amd64
-      dist: bionic
-      env:
-        - TEST_ANDROID=yes
-        - AUTOTOOLS_HOST=aarch64-linux-android
-        - OPENSSL_HOST=android-arm64
-        - ANDROID_CPU=aarch64
-        - ANDROID_API=23
-        - ANDROID_PREFIX="$HOME/android$ANDROID_API-$ANDROID_CPU"
-        - ANDROID_SDK_ROOT="$HOME/android-sdk"
-        - ANDROID_NDK_ROOT="$HOME/android-ndk"
-    - os: linux
-      name: Android x86, Linux, Amd64
-      compiler: clang
-      arch: amd64
-      dist: bionic
-      env:
-        - TEST_ANDROID=yes
-        - AUTOTOOLS_HOST=i686-linux-android
-        - OPENSSL_HOST=android-x86
-        - ANDROID_CPU=x86
-        - ANDROID_API=23
-        - ANDROID_PREFIX="$HOME/android$ANDROID_API-$ANDROID_CPU"
-        - ANDROID_SDK_ROOT="$HOME/android-sdk"
-        - ANDROID_NDK_ROOT="$HOME/android-ndk"
-    - os: linux
-      name: Android x86_64, Linux, Amd64
-      compiler: clang
-      arch: amd64
-      dist: bionic
-      env:
-        - TEST_ANDROID=yes
-        - AUTOTOOLS_HOST=x86_64-linux-android
-        - OPENSSL_HOST=android-x86_64
-        - ANDROID_CPU=x86_64
-        - ANDROID_API=23
-        - ANDROID_PREFIX="$HOME/android$ANDROID_API-$ANDROID_CPU"
-        - ANDROID_SDK_ROOT="$HOME/android-sdk"
-        - ANDROID_NDK_ROOT="$HOME/android-ndk"
-
-  allow_failures:
-    - os: osx
-      name: Apple iPhone on iOS, armv7
-    - os: osx
-      name: Apple iPhone on iOS, arm64
-    - os: osx
-      name: Apple TV on iOS, arm64
-    - os: osx
-      name: Apple Watch on iOS, armv7
-    - os: osx
-      name: iPhoneSimulator on OS X, i386
-    - os: osx
-      name: iPhoneSimulator on OS X, x86_64
-    - os: osx
-      name: AppleTVSimulator on OS X, x86_64
-    - os: osx
-      name: WatchSimulator on OS X, i386
-    - os: linux
-      name: Android armv7a, Linux, Amd64
-    - os: linux
-      name: Android aarch64, Linux, Amd64
-    - os: linux
-      name: Android x86, Linux, Amd64
-    - os: linux
-      name: Android x86_64, Linux, Amd64
-
-before_script:
-  - |
-    if [ "$TEST_ANDROID" = "yes" ]; then
-      ./contrib/android/install_tools.sh
-    elif [ "$TEST_IOS" = "yes" ]; then
-      ./contrib/ios/install_tools.sh
-    fi
-
-# The Travis docs say to avoid calling exit in the script. It leads to
-# some code duplication to avoid failures in cross-compiles. Also see
-# https://docs.travis-ci.com/user/job-lifecycle/ in the Travis docs.
-script:
-  - |
-    export MAKE_TEST="yes"
-    if [ "$TEST_UBSAN" = "yes" ]; then
-      export CFLAGS="-DNDEBUG -g2 -O3 -fsanitize=undefined -fno-sanitize-recover=all"
-    elif [ "$TEST_ASAN" = "yes" ]; then
-      export CFLAGS="-DNDEBUG -g2 -O3 -fsanitize=address"
-    fi
-  - |
-    if [ "$TEST_IOS" = "yes" ]; then
-      export AUTOTOOLS_BUILD="$(./config.guess)"
-      export PKG_CONFIG_PATH="$IOS_PREFIX/lib/pkgconfig"
-      source ./contrib/ios/setenv_ios.sh
-      ./contrib/ios/install_openssl.sh
-      ./contrib/ios/install_expat.sh
-      export CONFIG_OPTS="\
-        --build=$AUTOTOOLS_BUILD --host=$AUTOTOOLS_HOST \
-        --prefix=$IOS_PREFIX \
-        --with-ssl=$IOS_PREFIX --disable-gost \
-        --with-libexpat=$IOS_PREFIX "
-      echo CONFIG_OPTS ${CONFIG_OPTS}
-      export MAKE_TEST=no
-      export TEST_INSTALL=yes
-    fi
-  - |
-    if [ "$TEST_ANDROID" = "yes" ]; then
-      export AUTOTOOLS_BUILD="$(./config.guess)"
-      export PKG_CONFIG_PATH="$ANDROID_PREFIX/lib/pkgconfig"
-      ./contrib/android/install_ndk.sh
-      source ./contrib/android/setenv_android.sh
-      ./contrib/android/install_openssl.sh
-      ./contrib/android/install_expat.sh
-      export CONFIG_OPTS="\
-        --build=$AUTOTOOLS_BUILD --host=$AUTOTOOLS_HOST \
-        --prefix=$ANDROID_PREFIX \
-        --with-ssl=$ANDROID_PREFIX --disable-gost \
-        --with-libexpat=$ANDROID_PREFIX "
-      echo CONFIG_OPTS ${CONFIG_OPTS}
-      export MAKE_TEST=no
-      export TEST_INSTALL=yes
-    fi
-  - ./configure ${CONFIG_OPTS}
-  - make -j 2
-  - |
-    if [ "$MAKE_TEST" = "yes" ]; then
-      make test
-    fi
-  - |
-    if [ "$TEST_INSTALL" = "yes" ]; then
-      make install
-    fi
-  - |
-    if [ "$TEST_ANALYZER" = "yes" ]; then
-      (cd testdata/clang-analysis.tdir; bash clang-analysis.test)
-    fi
@@ -125,7 +125,7 @@ services/localzone.c services/mesh.c services/modstack.c services/view.c \
 services/rpz.c util/rfc_1982.c \
 services/outbound_list.c services/outside_network.c util/alloc.c \
 util/config_file.c util/configlexer.c util/configparser.c \
-util/shm_side/shm_main.c services/authzone.c \
+util/shm_side/shm_main.c services/authzone.c services/authload.c \
 util/fptr_wlist.c util/locks.c util/log.c util/mini_event.c util/module.c \
 util/netevent.c util/net_help.c util/random.c util/rbtree.c util/regional.c \
 util/rtt.c util/siphash.c util/edns.c util/storage/dnstree.c util/storage/lookup3.c \
@@ -152,7 +152,8 @@ autotrust.lo val_anchor.lo rpz.lo rfc_1982.lo proxy_protocol.lo \
 validator.lo val_kcache.lo val_kentry.lo val_neg.lo val_nsec3.lo val_nsec.lo \
 val_secalgo.lo val_sigcrypt.lo val_utils.lo dns64.lo $(CACHEDB_OBJ) authzone.lo \
 $(SUBNET_OBJ) $(PYTHONMOD_OBJ) $(CHECKLOCK_OBJ) $(DNSTAP_OBJ) $(DNSCRYPT_OBJ) \
-$(IPSECMOD_OBJ) $(IPSET_OBJ) $(DYNLIBMOD_OBJ) respip.lo timeval_func.lo
+$(IPSECMOD_OBJ) $(IPSET_OBJ) $(DYNLIBMOD_OBJ) respip.lo timeval_func.lo \
+authload.lo
 COMMON_OBJ_WITHOUT_UB_EVENT=$(COMMON_OBJ_WITHOUT_NETCALL) netevent.lo listen_dnsport.lo \
 outside_network.lo
 COMMON_OBJ=$(COMMON_OBJ_WITHOUT_UB_EVENT) ub_event.lo
@@ -721,6 +722,7 @@ depend:
 ipset.lo ipset.o: $(srcdir)/ipset/ipset.c
 doqclient.lo doqclient.o: $(srcdir)/testcode/doqclient.c
 unitdoq.lo unitdoq.o: $(srcdir)/testcode/unitdoq.c
+authload.lo authload.o: $(srcdir)/services/authload.c

 # Dependencies
 dns.lo dns.o: $(srcdir)/services/cache/dns.c config.h $(srcdir)/iterator/iter_delegpt.h $(srcdir)/util/log.h \
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.71 for unbound 1.26.0.
+# Generated by GNU Autoconf 2.71 for unbound 1.26.2.
 #
 # Report bugs to <unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues>.
 #
@@ -622,8 +622,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='unbound'
 PACKAGE_TARNAME='unbound'
-PACKAGE_VERSION='1.26.0'
-PACKAGE_STRING='unbound 1.26.0'
+PACKAGE_VERSION='1.26.2'
+PACKAGE_STRING='unbound 1.26.2'
 PACKAGE_BUGREPORT='unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues'
 PACKAGE_URL=''

@@ -1513,7 +1513,7 @@ if test "$ac_init_help" = "long"; then
  # Omit some internal or obsolete options to make the list less imposing.
  # This message is too long to be a string in the A/UX 3.1 sh.
  cat <<_ACEOF
-\`configure' configures unbound 1.26.0 to adapt to many kinds of systems.
+\`configure' configures unbound 1.26.2 to adapt to many kinds of systems.

 Usage: $0 [OPTION]... [VAR=VALUE]...

@@ -1579,7 +1579,7 @@ fi

 if test -n "$ac_init_help"; then
  case $ac_init_help in
-     short | recursive ) echo "Configuration of unbound 1.26.0:";;
+     short | recursive ) echo "Configuration of unbound 1.26.2:";;
   esac
  cat <<\_ACEOF

@@ -1832,7 +1832,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
  cat <<\_ACEOF
-unbound configure 1.26.0
+unbound configure 1.26.2
 generated by GNU Autoconf 2.71

 Copyright (C) 2021 Free Software Foundation, Inc.
@@ -2489,7 +2489,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.

-It was created by unbound $as_me 1.26.0, which was
+It was created by unbound $as_me 1.26.2, which was
 generated by GNU Autoconf 2.71.  Invocation command line was

  $ $0$ac_configure_args_raw
@@ -3253,11 +3253,11 @@ UNBOUND_VERSION_MAJOR=1

 UNBOUND_VERSION_MINOR=26

-UNBOUND_VERSION_MICRO=0
+UNBOUND_VERSION_MICRO=2


 LIBUNBOUND_CURRENT=9
-LIBUNBOUND_REVISION=39
+LIBUNBOUND_REVISION=41
 LIBUNBOUND_AGE=1
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -3364,6 +3364,8 @@ LIBUNBOUND_AGE=1
 # 1.25.1 had 9:37:1
 # 1.25.2 had 9:38:1
 # 1.26.0 had 9:39:1
+# 1.26.1 had 9:40:1
+# 1.26.2 had 9:41:1

 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -25711,7 +25713,7 @@ printf "%s\n" "#define MAXSYSLOGMSGLEN 10240" >>confdefs.h



-version=1.26.0
+version=1.26.2

 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for build time" >&5
 printf %s "checking for build time... " >&6; }
@@ -26241,7 +26243,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by unbound $as_me 1.26.0, which was
+This file was extended by unbound $as_me 1.26.2, which was
 generated by GNU Autoconf 2.71.  Invocation command line was

  CONFIG_FILES    = $CONFIG_FILES
@@ -26309,7 +26311,7 @@ ac_cs_config_escaped=`printf "%s\n" "$ac_cs_config" | sed "s/^ //; s/'/'\\\\\\\\
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config='$ac_cs_config_escaped'
 ac_cs_version="\\
-unbound config.status 1.26.0
+unbound config.status 1.26.2
 configured by $0, generated by GNU Autoconf 2.71,
  with options \\"\$ac_cs_config\\"

@@ -12,14 +12,14 @@ sinclude(dnscrypt/dnscrypt.m4)
 # must be numbers. ac_defun because of later processing
 m4_define([VERSION_MAJOR],[1])
 m4_define([VERSION_MINOR],[26])
-m4_define([VERSION_MICRO],[0])
+m4_define([VERSION_MICRO],[2])
 AC_INIT([unbound],m4_defn([VERSION_MAJOR]).m4_defn([VERSION_MINOR]).m4_defn([VERSION_MICRO]),[unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues],[unbound])
 AC_SUBST(UNBOUND_VERSION_MAJOR, [VERSION_MAJOR])
 AC_SUBST(UNBOUND_VERSION_MINOR, [VERSION_MINOR])
 AC_SUBST(UNBOUND_VERSION_MICRO, [VERSION_MICRO])

 LIBUNBOUND_CURRENT=9
-LIBUNBOUND_REVISION=39
+LIBUNBOUND_REVISION=41
 LIBUNBOUND_AGE=1
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -126,6 +126,8 @@ LIBUNBOUND_AGE=1
 # 1.25.1 had 9:37:1
 # 1.25.2 had 9:38:1
 # 1.26.0 had 9:39:1
+# 1.26.1 had 9:40:1
+# 1.26.2 had 9:41:1

 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -554,7 +554,7 @@ move_into_cache(struct ub_packed_rrset_key* k,

 	ref.key = ak;
 	ref.id = ak->id;
-	(void)rrset_cache_update(worker->env.rrset_cache, &ref,
+	rrset_cache_update_unlock(worker->env.rrset_cache, &ref,
 		worker->alloc, *worker->env.now);

 	return 1;
@@ -86,6 +86,7 @@
 #include "services/view.h"
 #include "services/modstack.h"
 #include "services/authzone.h"
+#include "services/authload.h"
 #include "util/module.h"
 #include "util/random.h"
 #include "util/tube.h"
@@ -590,6 +591,17 @@ daemon_init(void)
 		free(daemon);
 		return NULL;
 	}
+	if(!(daemon->auth_load_info = auth_load_info_create())) {
+		edns_strings_delete(daemon->env->edns_strings);
+		auth_zones_delete(daemon->env->auth_zones);
+		acl_list_delete(daemon->acl_interface);
+		acl_list_delete(daemon->acl);
+		tcl_list_delete(daemon->tcl);
+		edns_known_options_delete(daemon->env);
+		free(daemon->env);
+		free(daemon);
+		return NULL;
+	}
 	return daemon;	
 }

@@ -1164,6 +1176,7 @@ daemon_fork(struct daemon* daemon)

 	/* we exited! a signal happened! Stop other threads */
 	daemon_stop_others(daemon);
+	auth_load_stop_threads(daemon);

 	/* Shutdown SHM */
 	shm_main_shutdown(daemon);
@@ -1262,6 +1275,7 @@ daemon_delete(struct daemon* daemon)
 		edns_strings_delete(daemon->env->edns_strings);
 		auth_zones_delete(daemon->env->auth_zones);
 	}
+	auth_load_info_delete(daemon->auth_load_info);
 	ub_randfree(daemon->rand);
 	alloc_clear(&daemon->superalloc);
 	acl_list_delete(daemon->acl);
@@ -62,6 +62,7 @@ struct doq_table;
 struct cookie_secrets;
 struct fast_reload_thread;
 struct fast_reload_printq;
+struct auth_load_general_info;
 struct shared_ports;

 #include "dnstap/dnstap_config.h"
@@ -191,6 +192,8 @@ struct daemon {
 	int fast_reload_tcl_has_changes;
 	/** config file name */
 	char* cfgfile;
+	/** Auth load threads, the number of active threads. */
+	struct auth_load_general_info* auth_load_info;
 };

 /**
@@ -73,6 +73,7 @@
 #include "services/mesh.h"
 #include "services/localzone.h"
 #include "services/authzone.h"
+#include "services/authload.h"
 #include "services/rpz.h"
 #include "util/storage/slabhash.h"
 #include "util/fptr_wlist.h"
@@ -115,9 +116,6 @@
 #ifdef HAVE_NETDB_H
 #include <netdb.h>
 #endif
-#ifdef HAVE_POLL_H
-#include <poll.h>
-#endif

 /* just for portability */
 #ifdef SQ
@@ -2681,7 +2679,7 @@ static int
 ssl_print_name_dp(RES* ssl, const char* str, uint8_t* nm, uint16_t dclass,
 	struct delegpt* dp)
 {
-	char buf[LDNS_MAX_DOMAINLEN];
+	char buf[LDNS_MAX_DOMAINLEN], portstr[128], tls_auth_name[256];
 	struct delegpt_ns* ns;
 	struct delegpt_addr* a;
 	int f = 0;
@@ -2696,13 +2694,32 @@ ssl_print_name_dp(RES* ssl, const char* str, uint8_t* nm, uint16_t dclass,
 	}
 	for(ns = dp->nslist; ns; ns = ns->next) {
 		dname_str(ns->name, buf);
-		if(!ssl_printf(ssl, "%s%s", (f?" ":""), buf))
+		if(ns->port != UNBOUND_DNS_PORT)
+			snprintf(portstr, sizeof(portstr), "@%d", ns->port);
+		else	portstr[0]=0;
+		if(ns->tls_auth_name)
+			snprintf(tls_auth_name, sizeof(tls_auth_name), "#%s",
+				ns->tls_auth_name);
+		else	tls_auth_name[0]=0;
+		if(!ssl_printf(ssl, "%s%s%s%s", (f?" ":""), buf, portstr,
+			tls_auth_name))
 			return 0;
 		f = 1;
 	}
 	for(a = dp->target_list; a; a = a->next_target) {
+		int port = (unsigned)((a->addr.ss_family == AF_INET) ?
+			ntohs(((struct sockaddr_in*)&a->addr)->sin_port) :
+			ntohs(((struct sockaddr_in6*)&a->addr)->sin6_port));
 		addr_to_str(&a->addr, a->addrlen, buf, sizeof(buf));
-		if(!ssl_printf(ssl, "%s%s", (f?" ":""), buf))
+		if(port != UNBOUND_DNS_PORT)
+			snprintf(portstr, sizeof(portstr), "@%d", port);
+		else	portstr[0]=0;
+		if(a->tls_auth_name)
+			snprintf(tls_auth_name, sizeof(tls_auth_name), "#%s",
+				a->tls_auth_name);
+		else	tls_auth_name[0]=0;
+		if(!ssl_printf(ssl, "%s%s%s%s", (f?" ":""), buf, portstr,
+			tls_auth_name))
 			return 0;
 		f = 1;
 	}
@@ -4447,92 +4464,6 @@ int remote_control_callback(struct comm_point* c, void* arg, int err,
 	return 0;
 }

-/**
- * This routine polls a socket for readiness.
- * @param fd: file descriptor, -1 uses no fd for a timer only.
- * @param timeout: time in msec to wait. 0 means nonblocking test,
- * 	-1 waits blocking for events.
- * @param pollin: check for input event.
- * @param pollout: check for output event.
- * @param event: output variable, set to true if the event happens.
- * 	It is false if there was an error or timeout.
- * @return false is system call failure, also logged.
- */
-static int
-sock_poll_timeout(int fd, int timeout, int pollin, int pollout, int* event)
-{
-	int loopcount = 0;
-	/* Loop if the system call returns an errno to do so, like EINTR. */
-	log_assert(pollin || pollout);
-	while(1) {
-		struct pollfd p, *fds;
-		int nfds, ret;
-		if(++loopcount > IPC_LOOP_MAX) {
-			log_err("sock_poll_timeout: loop");
-			if(event)
-				*event = 0;
-			return 0;
-		}
-		if(fd == -1) {
-			fds = NULL;
-			nfds = 0;
-		} else {
-			fds = &p;
-			nfds = 1;
-			memset(&p, 0, sizeof(p));
-			p.fd = fd;
-#ifndef USE_WINSOCK
-			p.events = POLLERR
-				| POLLHUP
-				;
-#endif
-			if(pollin)
-				p.events |= POLLIN;
-			if(pollout)
-				p.events |= POLLOUT;
-		}
-#ifndef USE_WINSOCK
-		ret = poll(fds, nfds, timeout);
-#else
-		if(fds == NULL) {
-			Sleep(timeout);
-			ret = 0;
-		} else {
-			ret = WSAPoll(fds, nfds, timeout);
-		}
-#endif
-		if(ret == -1) {
-#ifndef USE_WINSOCK
-			if(
-				errno == EINTR || errno == EAGAIN
-#  ifdef EWOULDBLOCK
-				|| errno == EWOULDBLOCK
-#  endif
-			) continue; /* Try again. */
-#endif
-			/* For WSAPoll we only get errors here:
-			 * o WSAENETDOWN
-			 * o WSAEFAULT
-			 * o WSAEINVAL
-			 * o WSAENOBUFS
-			 */
-			log_err("poll: %s", sock_strerror(errno));
-			if(event)
-				*event = 0;
-			return 0;
-		} else if(ret == 0) {
-			/* Timeout */
-			if(event)
-				*event = 0;
-			return 1;
-		}
-		break;
-	}
-	if(event)
-		*event = 1;
-	return 1;
-}
-
 /** fast reload convert fast reload notification status to string */
 static const char*
 fr_notification_to_string(enum fast_reload_notification status)
@@ -6346,6 +6277,7 @@ fr_atomic_copy_cfg(struct config_file* oldcfg, struct config_file* cfg,
 	COPY_VAR_ptr(acls);
 	COPY_VAR_int(donotquery_localhost);
 	COPY_VAR_ptr(tcp_connection_limits);
+	COPY_VAR_int(auth_task_threads);
 	COPY_VAR_int(harden_short_bufsize);
 	COPY_VAR_int(harden_large_queries);
 	COPY_VAR_int(harden_glue);
@@ -6354,6 +6286,7 @@ fr_atomic_copy_cfg(struct config_file* oldcfg, struct config_file* cfg,
 	COPY_VAR_int(harden_referral_path);
 	COPY_VAR_int(harden_algo_downgrade);
 	COPY_VAR_int(harden_unknown_additional);
+	COPY_VAR_int(harden_cname_follow);
 	COPY_VAR_int(use_caps_bits_for_id);
 	COPY_VAR_ptr(caps_whitelist);
 	COPY_VAR_ptr(private_address);
@@ -6590,6 +6523,8 @@ fr_atomic_copy_cfg(struct config_file* oldcfg, struct config_file* cfg,
 	COPY_VAR_ptr(ipset_name_v6);
 #endif
 	COPY_VAR_int(ede);
+	COPY_VAR_int(val_validation_attempts);
+	COPY_VAR_int(val_hash_attempts);
 	COPY_VAR_int(iter_scrub_ns);
 	COPY_VAR_int(iter_scrub_cname);
 	COPY_VAR_int(iter_scrub_rrsig);
@@ -7134,286 +7069,6 @@ done_error:
 }
 #endif /* !THREADS_DISABLED */

-/** create a socketpair for bidirectional communication, false on failure */
-static int
-create_socketpair(int* pair, struct ub_randstate* rand)
-{
-#ifndef USE_WINSOCK
-	if(socketpair(AF_UNIX, SOCK_STREAM, 0, pair) == -1) {
-		log_err("socketpair: %s", strerror(errno));
-		return 0;
-	}
-	(void)rand;
-#else
-	struct sockaddr_in addr, baddr, accaddr, connaddr;
-	socklen_t baddrlen, accaddrlen, connaddrlen;
-	uint8_t localhost[] = {127, 0, 0, 1};
-	uint8_t nonce[16], recvnonce[16];
-	size_t i;
-	int lst, pollin_event, bcount, loopcount;
-	int connect_poll_timeout = 200; /* msec to wait for connection */
-	ssize_t ret;
-	pair[0] = -1;
-	pair[1] = -1;
-	for(i=0; i<sizeof(nonce); i++) {
-		nonce[i] = ub_random_max(rand, 256);
-	}
-	lst = socket(AF_INET, SOCK_STREAM, 0);
-	if(lst == -1) {
-		log_err("create_socketpair: socket: %s", sock_strerror(errno));
-		return 0;
-	}
-	memset(&addr, 0, sizeof(addr));
-	addr.sin_family = AF_INET;
-	addr.sin_port = 0;
-	memcpy(&addr.sin_addr, localhost, 4);
-	if(bind(lst, (struct sockaddr*)&addr, (socklen_t)sizeof(addr))
-		== -1) {
-		log_err("create socketpair: bind: %s", sock_strerror(errno));
-		sock_close(lst);
-		return 0;
-	}
-	if(listen(lst, 12) == -1) {
-		log_err("create socketpair: listen: %s", sock_strerror(errno));
-		sock_close(lst);
-		return 0;
-	}
-
-	pair[1] = socket(AF_INET, SOCK_STREAM, 0);
-	if(pair[1] == -1) {
-		log_err("create socketpair: socket: %s", sock_strerror(errno));
-		sock_close(lst);
-		return 0;
-	}
-	baddrlen = (socklen_t)sizeof(baddr);
-	if(getsockname(lst, (struct sockaddr*)&baddr, &baddrlen) == -1) {
-		log_err("create socketpair: getsockname: %s",
-			sock_strerror(errno));
-		sock_close(lst);
-		sock_close(pair[1]);
-		pair[1] = -1;
-		return 0;
-	}
-	if(baddrlen > (socklen_t)sizeof(baddr)) {
-		log_err("create socketpair: getsockname returned addr too big");
-		sock_close(lst);
-		sock_close(pair[1]);
-		pair[1] = -1;
-		return 0;
-	}
-	/* the socket is blocking */
-	if(connect(pair[1], (struct sockaddr*)&baddr, baddrlen) == -1) {
-		log_err("create socketpair: connect: %s",
-			sock_strerror(errno));
-		sock_close(lst);
-		sock_close(pair[1]);
-		pair[1] = -1;
-		return 0;
-	}
-	if(!sock_poll_timeout(lst, connect_poll_timeout, 1, 0, &pollin_event)) {
-		log_err("create socketpair: poll for accept failed: %s",
-			sock_strerror(errno));
-		sock_close(lst);
-		sock_close(pair[1]);
-		pair[1] = -1;
-		return 0;
-	}
-	if(!pollin_event) {
-		log_err("create socketpair: poll timeout for accept");
-		sock_close(lst);
-		sock_close(pair[1]);
-		pair[1] = -1;
-		return 0;
-	}
-	accaddrlen = (socklen_t)sizeof(accaddr);
-	pair[0] = accept(lst, (struct sockaddr*)&accaddr, &accaddrlen);
-	if(pair[0] == -1) {
-		log_err("create socketpair: accept: %s", sock_strerror(errno));
-		sock_close(lst);
-		sock_close(pair[1]);
-		pair[1] = -1;
-		return 0;
-	}
-	if(accaddrlen > (socklen_t)sizeof(accaddr)) {
-		log_err("create socketpair: accept returned addr too big");
-		sock_close(lst);
-		sock_close(pair[0]);
-		sock_close(pair[1]);
-		pair[0] = -1;
-		pair[1] = -1;
-		return 0;
-	}
-	if(accaddr.sin_family != AF_INET ||
-	   memcmp(localhost, &accaddr.sin_addr, 4) != 0) {
-		log_err("create socketpair: accept from wrong address");
-		sock_close(lst);
-		sock_close(pair[0]);
-		sock_close(pair[1]);
-		pair[0] = -1;
-		pair[1] = -1;
-		return 0;
-	}
-	connaddrlen = (socklen_t)sizeof(connaddr);
-	if(getsockname(pair[1], (struct sockaddr*)&connaddr, &connaddrlen)
-		== -1) {
-		log_err("create socketpair: getsockname connectedaddr: %s",
-			sock_strerror(errno));
-		sock_close(lst);
-		sock_close(pair[0]);
-		sock_close(pair[1]);
-		pair[0] = -1;
-		pair[1] = -1;
-		return 0;
-	}
-	if(connaddrlen > (socklen_t)sizeof(connaddr)) {
-		log_err("create socketpair: getsockname connectedaddr returned addr too big");
-		sock_close(lst);
-		sock_close(pair[0]);
-		sock_close(pair[1]);
-		pair[0] = -1;
-		pair[1] = -1;
-		return 0;
-	}
-	if(connaddr.sin_family != AF_INET ||
-	   memcmp(localhost, &connaddr.sin_addr, 4) != 0) {
-		log_err("create socketpair: getsockname connectedaddr returned wrong address");
-		sock_close(lst);
-		sock_close(pair[0]);
-		sock_close(pair[1]);
-		pair[0] = -1;
-		pair[1] = -1;
-		return 0;
-	}
-	if(accaddr.sin_port != connaddr.sin_port) {
-		log_err("create socketpair: accept from wrong port");
-		sock_close(lst);
-		sock_close(pair[0]);
-		sock_close(pair[1]);
-		pair[0] = -1;
-		pair[1] = -1;
-		return 0;
-	}
-	sock_close(lst);
-
-	loopcount = 0;
-	bcount = 0;
-	while(1) {
-		if(++loopcount > IPC_LOOP_MAX) {
-			log_err("create socketpair: send failed due to loop");
-			sock_close(pair[0]);
-			sock_close(pair[1]);
-			pair[0] = -1;
-			pair[1] = -1;
-			return 0;
-		}
-		ret = send(pair[1], (void*)(nonce+bcount),
-			sizeof(nonce)-bcount, 0);
-		if(ret == -1) {
-			if(
-#ifndef USE_WINSOCK
-				errno == EINTR || errno == EAGAIN
-#  ifdef EWOULDBLOCK
-				|| errno == EWOULDBLOCK
-#  endif
-#else
-				WSAGetLastError() == WSAEINTR ||
-				WSAGetLastError() == WSAEINPROGRESS ||
-				WSAGetLastError() == WSAEWOULDBLOCK
-#endif
-				)
-				continue; /* Try again. */
-			log_err("create socketpair: send: %s", sock_strerror(errno));
-			sock_close(pair[0]);
-			sock_close(pair[1]);
-			pair[0] = -1;
-			pair[1] = -1;
-			return 0;
-		} else if(ret+(ssize_t)bcount != sizeof(nonce)) {
-			bcount += ret;
-			if((size_t)bcount < sizeof(nonce))
-				continue;
-		}
-		break;
-	}
-
-	if(!sock_poll_timeout(pair[0], connect_poll_timeout, 1, 0, &pollin_event)) {
-		log_err("create socketpair: poll failed: %s",
-			sock_strerror(errno));
-		sock_close(pair[0]);
-		sock_close(pair[1]);
-		pair[0] = -1;
-		pair[1] = -1;
-		return 0;
-	}
-	if(!pollin_event) {
-		log_err("create socketpair: poll timeout for recv");
-		sock_close(pair[0]);
-		sock_close(pair[1]);
-		pair[0] = -1;
-		pair[1] = -1;
-		return 0;
-	}
-
-	loopcount = 0;
-	bcount = 0;
-	while(1) {
-		if(++loopcount > IPC_LOOP_MAX) {
-			log_err("create socketpair: recv failed due to loop");
-			sock_close(pair[0]);
-			sock_close(pair[1]);
-			pair[0] = -1;
-			pair[1] = -1;
-			return 0;
-		}
-		ret = recv(pair[0], (void*)(recvnonce+bcount),
-			sizeof(nonce)-bcount, 0);
-		if(ret == -1) {
-			if(
-#ifndef USE_WINSOCK
-				errno == EINTR || errno == EAGAIN
-#  ifdef EWOULDBLOCK
-				|| errno == EWOULDBLOCK
-#  endif
-#else
-				WSAGetLastError() == WSAEINTR ||
-				WSAGetLastError() == WSAEINPROGRESS ||
-				WSAGetLastError() == WSAEWOULDBLOCK
-#endif
-				)
-				continue; /* Try again. */
-			log_err("create socketpair: recv: %s", sock_strerror(errno));
-			sock_close(pair[0]);
-			sock_close(pair[1]);
-			pair[0] = -1;
-			pair[1] = -1;
-			return 0;
-		} else if(ret == 0) {
-			log_err("create socketpair: stream closed");
-			sock_close(pair[0]);
-			sock_close(pair[1]);
-			pair[0] = -1;
-			pair[1] = -1;
-			return 0;
-		} else if(ret+(ssize_t)bcount != sizeof(nonce)) {
-			bcount += ret;
-			if((size_t)bcount < sizeof(nonce))
-				continue;
-		}
-		break;
-	}
-
-	if(memcmp(nonce, recvnonce, sizeof(nonce)) != 0) {
-		log_err("create socketpair: recv wrong nonce");
-		sock_close(pair[0]);
-		sock_close(pair[1]);
-		pair[0] = -1;
-		pair[1] = -1;
-		return 0;
-	}
-#endif
-	return 1;
-}
-
 /** fast reload thread. setup the thread info */
 static int
 fast_reload_thread_setup(struct worker* worker, int fr_verb, int fr_nopause,
@@ -7790,6 +7445,13 @@ auth_zone_zonemd_stop_lookup(struct auth_zone* z, struct mesh_area* mesh)
 {
 	struct query_info qinfo;
 	uint16_t qflags = BIT_RD;
+	if(z->zonemd_transfer_active) {
+		auth_load_info_release_transfer_in_progress(
+			z->zonemd_callback_env);
+		auth_load_schedule_waiting_pickup(z->zonemd_callback_env);
+		z->zonemd_transfer_active = 0;
+	}
+
 	qinfo.qname_len = z->namelen;
 	qinfo.qname = z->name;
 	qinfo.qclass = z->dclass;
@@ -7871,6 +7533,8 @@ fr_worker_auth_del(struct worker* worker, struct fast_reload_auth_change* item,
 			released = 1;
 			xfr_disown_tasks(xfr, worker);
 		}
+		auth_load_del_zone_tasks(worker, xfr->name, xfr->namelen,
+			xfr->dclass);
 		lock_basic_unlock(&xfr->lock);
 	}

@@ -59,6 +59,7 @@
 #include "services/cache/infra.h"
 #include "services/cache/dns.h"
 #include "services/authzone.h"
+#include "services/authload.h"
 #include "services/mesh.h"
 #include "services/localzone.h"
 #include "services/rpz.h"
@@ -95,8 +96,6 @@
 #include "winrc/win_svc.h"
 #endif

-/** Size of an UDP datagram */
-#define NORMAL_UDP_SIZE	512 /* bytes */
 /** ratelimit for error responses */
 #define ERROR_RATELIMIT 100 /* qps */

@@ -863,7 +862,7 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
 			"validation");
 		goto bail_out; /* need to validate cache entry first */
 	} else if(rep->security == sec_status_secure) {
-		if(reply_all_rrsets_secure(rep)) {
+		if(reply_an_ns_rrsets_secure(rep)) {
 			*is_secure_answer = 1;
 		} else {
 			if(must_validate) {
@@ -1706,6 +1705,8 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		}
 		memset(&reply_edns, 0, sizeof(reply_edns));
 		reply_edns.edns_present = 1;
+		reply_edns.edns_version = EDNS_ADVERTISED_VERSION;
+		reply_edns.udp_size = EDNS_ADVERTISED_SIZE;
 		error_encode(c->buffer, ret, &qinfo,
 			*(uint16_t*)(void *)sldns_buffer_begin(c->buffer),
 			sldns_buffer_read_u16_at(c->buffer, 2), &reply_edns);
@@ -2262,6 +2263,7 @@ worker_create(struct daemon* daemon, int id)
 		free(worker);
 		return NULL;
 	}
+	rbtree_init(&worker->auth_load_tree, auth_load_tree_cmp);
 	explicit_bzero(&seed, sizeof(seed));
 	return worker;
 }
@@ -47,6 +47,7 @@
 #include "util/netevent.h"
 #include "util/locks.h"
 #include "util/alloc.h"
+#include "util/rbtree.h"
 #include "util/data/msgreply.h"
 #include "util/data/msgparse.h"
 #include "daemon/stats.h"
@@ -135,6 +136,8 @@ struct worker {
 #endif
 	/** reuse existing cache on reload if other conditions allow it. */
 	int reuse_cache;
+	/** tree of auth load threads, attached to this worker. */
+	rbtree_type auth_load_tree;
 };

 /**
@@ -968,6 +968,7 @@ dns64_adjust_ptr(struct module_qstate* qstate, struct module_qstate* super)
    if(answer) {
 	    answer->rk.dname = super->qinfo.qname;
 	    answer->rk.dname_len = super->qinfo.qname_len;
+	    answer->entry.hash = rrset_key_hash(&answer->rk);
    }
 }

@@ -1,3 +1,189 @@
+13 October 2026: Wouter
+	- Fix dns64 synthesis and cache with subnet module enabled.
+	  The subnet module stopped a cache store, that caused later
+	  dns64 replies to have a nodata answer for the AAAA.
+
+13 October 2026: Yorgos
+	- Fix #1526: Root Server h.root-servers.net has been included for Zone
+	  Transfer Service by including it in the example configuration.
+
+2 October 2026: Yorgos
+	- Document libunbound's context lifetime during an async callback.
+	  Thanks to Omar Mousa for the suggestion.
+
+28 September 2026: Wouter
+	- Fix to log the errno for trust anchor write close fail.
+	- Merge #1518 from nshopik: rrset: rehash copies after
+	  changing the key.
+	- Fix to allow for large (64Kb) packets with testbound.
+
+22 September 2026: Yorgos
+	- Fix #1514: [FR] do-not-query-localhost is not including
+	  0.0.0.0/8 and ‘::’ in the man page.
+	- Fix #1513: [FR] Size of harden-large-queries in the man page.
+	- Move NORMAL_UDP_SIZE around.
+	- Clarify man page text for harden-short-bufsize.
+	- Update generated man pages.
+
+21 September 2026: Yorgos
+	- Merge #1510 from Andy Warner: Move unlink of temp file to before
+	  fatal exit.
+
+16 September 2026: Wouter
+	- Release of 1.26.1 with the following security fixes.
+	- Fix CVE-2026-81642, Heap buffer overflow and possible Remote Code
+	  Execution when digesting DNSKEY. Thanks to Yuqi Qiu and Xiang Li
+	  from Nankai University, AOSP Lab for the report.
+	- Fix CVE-2026-81634, Possible heap buffer overflow during DNSSEC
+	  canonicalization. Thanks to Vlatko Kosturjak with Marlink Cyber,
+	  for the report.
+	- Fix CVE-2026-82717, CNAME synthesis could lead to heap corruption.
+	  Thanks to Ben Morris from Anthropic for the report.
+	- Fix CVE-2026-77955, Possible ZONEMD verification bypass window.
+	  Thanks to Yuqi Qiu and Xiang Li from Nankai University, AOSP Lab,
+	  for the report. In addition, thanks to Qifan Zhang from Palo Alto
+	  Networks for also reporting this issue.
+	- Fix CVE-2026-78227, Use-after-free in DoQ stream output buffer on
+	  reset re-transmission. Thanks to Yuqi Qiu and Xiang Li from Nankai
+	  University, AOSP Lab for the report.
+	- Fix CVE-2026-80225, Possible degradation of service from continuous
+	  queries on the same TCP/DoT connection. Thanks to Qifan Zhang from
+	  Palo Alto Networks for the report.
+	- Fix CVE-2026-82720, Use-after-free in DoH stream cleanup code path.
+	  Thanks to Yuqi Qiu and Xiang Li from Nankai University, AOSP Lab,
+	  for the report.
+	- Fix CVE-2026-85501, Retrap: Novel Vulnerabilities to launch
+	  Algorithmic Complexity Attacks on DNSSEC. Thanks to Zuyao Xu and
+	  Xiang Li from Nankai University, AOSP Lab for the report. In
+	  addition, thanks to Qifan Zhang from Palo Alto Networks for a
+	  complimentary report.
+	- Fix CVE-2026-77860, 'serve-expired' can bypass Unbound 'wait-limit'.
+	  Thanks to Xuanchao Xie, Lutong Chen, and Kaiping Xue from the
+	  University of Science and Technology of China (USTC) for the
+	  report.
+	- The code repository continues with 1.26.2 under development,
+	  that includes the changes from before the 1.26.1 commits.
+	- Unit test for CVE-2026-81642.
+	- Unit test for CVE-2026-82717.
+	- Unit test for CVE-2026-85501.
+
+15 September 2026: Wouter
+	- For #1507: TOCTOU race in store_rrsets() can return a
+	  CNAME chain whose target owns no address.
+
+10 September 2026: Wouter
+	- Fix to construct the delegation point during DS NS find
+	  as a child side delegation point if that was the response.
+	  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
+	- Fix to error on missing close parenthesis for zone file
+	  read and for url content read. Thanks to Qifan Zhang, Palo
+	  Alto Networks, for the report.
+
+8 September 2026: Wouter
+	- Fix to elevate the diagnostic for no matches for a wildcard
+	  trusted-keys-file, make it more descriptive, and more man
+	  page content for it. Thanks to Qifan Zhang, Palo Alto
+	  Networks, for the report.
+
+4 September 2026: Wouter
+	- Fix to make rpz_config leave the rpz with correct set up
+	  on failure. The struct is not half configured on exit.
+	  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
+	- Fix to not change the action override in rpz_config, before
+	  the cname override has succeeded.
+
+3 September 2026: Wouter
+	- Fix to match NSEC3 hash length to the NSEC3 algorithm,
+	  this stops negative cache overdeletion. It also contrains
+	  the hash label length and checks if the NSEC nextowner
+	  is valid. Thanks to Yuqi Qiu & Xiang Li (Nankai University,
+	  AOSP Lab).
+	- Remove unused .travis.yml for ci integration.
+	- Fix to reorder SVCB and HTTPS svcparams for unknown RR form
+	  zonefile input. If it can not be parsed it is leniently
+	  accepted, much like as a secondary it leniently accepts it.
+	  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
+	- Fix that when extended EDNS RCODE does not fit, at short
+	  udpsize, the reply is truncated with TC and fix for the
+	  rcode in that short reply to be a sensible rcode.
+	  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
+	- Fix that when a partial EDNS option is in a query, the
+	  response is a more RFC conformant FORMERR, since the EDNS
+	  option is malformed. Also fix to have an EDNS size for
+	  the reply error encoding for failed EDNS parse of the query.
+	  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
+
+2 September 2026: Wouter
+	- Fix to not commit to have_zone at apply AXFR time for auth
+	  zone transfers, so that later failure rolls back to not.
+	  The have_zone value is set later when the SOA is retrieved.
+	  Also fix to clear the zone data when a transfer does not
+	  have a valid SOA record in the zone for it.
+	  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
+
+1 September 2026: Wouter
+	- Fix to allow block_a and other local-zone types in a view.
+	- Fix LOC RR parse to avoid double to uint32 cast overflow.
+	  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
+
+26 August 2026: Wouter
+	- Fix notify for auth-zone during initial start up. It
+	  performs the transfer and not only lookup.
+
+24 August 2026: Wouter
+	- Fix #132: Add `harden-cname-follow: yes` config option, that
+	  can be used to disable cname scrubbing. That can be useful
+	  for when the traffic is on localhost only.
+
+21 August 2026: Wouter
+	- Fix to defend against double event deletion, that could cause
+	  event corruption and use after free, for comm_timer_disable.
+
+11 August 2026: Wouter
+	- Fix #1492 from zacek: Data race in log_init() on
+	  key_created/log_lock when calling ub_ctx_create()
+	  concurrently from multiple threads.
+	- Fix stat_values.tdir test to have less test failures.
+
+7 August 2026: Wouter
+	- Fix #1489 from jplesnik: Replace removed Python 2 C API
+	  macros for SWIG 4.5.0 compatibility.
+
+6 August 2026: Alex Khanin
+	- Fix #1488: bounds check in packed_rr_to_string, it checked
+	  the assembled rr length against the output string length
+	  dest_len, instead of against the size of the rr buffer it
+	  writes into. Callers in cachedump.c and remote.c pass a
+	  dest_len larger than that buffer.
+	- Unit test for packed_rr_to_string.
+
+6 August 2026: Wouter
+	- Fix #1485: the list_forwards command omits port numbers.
+	  The list_forwards and list_stubs commands for
+	  unbound-control print port and tls auth name.
+	- Fix #1487: regression in 1.26.0, ipsecmod is now always
+	  partly enabled.
+
+4 August 2026: Wouter
+	- Fix to set makedist.sh to not wget config.sub and
+	  config.guess from git repo. The fetch times out, and the
+	  version from libtoolize is much more recent now than
+	  that it was when the wget was added.
+
+31 July 2026: Wouter
+	- For #1483: The failure reason when an NSEC NXDOMAIN is
+	  encountered when looking for an insecure delegation, is
+	  fixed to mention the NSEC records, instead of nonexistent
+	  NSEC3 records, that it attempted.
+
+30 July 2026: Wouter
+	- Fix #1482: DNS-over-QUIC doesn't work with simple config.
+	  That fixes interface-automatic for use with doq service.
+
+28 July 2026: Wouter
+	- Tag for 1.26.0rc1. The repo continues with version 1.26.1.
+	  This became 1.26.0 on 4 aug 2026.
+
 24 July 2026: Wouter
 	- Merge #1433 from jisakiel: Add new static zone type
 	  block_aaaa to suppress AAAA queries.
@@ -203,6 +203,12 @@ server:
 	# protects against poison attempts.
 	# iter-scrub-promiscuous: yes

+	# Limit on number of DNSSEC validation attempts for a query.
+	# val-validation-attempts: 32
+
+	# Limit on number of DNSSEC hash attempts for a query.
+	# val-hash-attempts: 32
+
 	# msec for waiting for an unknown server to reply.  Increase if you
 	# are behind a slow satellite link, to eg. 1128.
 	# unknown-server-time-limit: 376
@@ -582,6 +588,9 @@ server:
 	# additional section.
 	# harden-unknown-additional: no

+	# Harden CNAME redirections by following them.
+	# harden-cname-follow: yes
+
 	# Sent minimum amount of information to upstream servers to enhance
 	# privacy. Only sent minimum required labels of the QNAME and set QTYPE
 	# to A when possible.
@@ -728,7 +737,7 @@ server:
 	# non-secure data. Useful to shield the users of this validator from
 	# potential bogus data in the additional section. All unsigned data
 	# in the additional section is removed from secure messages.
-	# val-clean-additional: yes
+	# val-clean-additional: no

 	# Turn permissive mode on to permit bogus messages. Thus, messages
 	# for which security checks failed will be returned to clients,
@@ -1162,6 +1171,8 @@ server:
 	# Timeout in milliseconds for TCP queries to auth servers.
 	# tcp-auth-query-timeout: 3000

+	# Number of threads to use to load auth-zones (and RPZ). 0 disables.
+	# auth-task-threads: 0

 # Python config section. To enable:
 # o use --with-pythonmodule to configure before compiling.
@@ -1270,6 +1281,7 @@ remote-control:
 #	primary: 199.7.91.13          # d.root-servers.net
 #	primary: 192.5.5.241          # f.root-servers.net
 #	primary: 192.112.36.4         # g.root-servers.net
+#	primary: 198.97.190.53        # h.root-servers.net
 #	primary: 193.0.14.129         # k.root-servers.net
 #	primary: 192.0.47.132         # xfr.cjr.dns.icann.org
 #	primary: 192.0.32.132         # xfr.lax.dns.icann.org
@@ -1278,6 +1290,7 @@ remote-control:
 #	primary: 2001:500:2d::d       # d.root-servers.net
 #	primary: 2001:500:2f::f       # f.root-servers.net
 #	primary: 2001:500:12::d0d     # g.root-servers.net
+#	primary: 2001:500:1::53       # h.root-servers.net
 #	primary: 2001:7fd::1          # k.root-servers.net
 #	primary: 2620:0:2830:202::132 # xfr.cjr.dns.icann.org
 #	primary: 2620:0:2d0:202::132  # xfr.lax.dns.icann.org
@@ -331,6 +331,8 @@ void my_callback_function(void* my_arg, int err,
 The \fBasync_id\fP is returned so you can (at your option) decide to
 track it and cancel the request if needed.
 If you pass a NULL pointer the \fBasync_id\fP is not returned.
+The context, created via \fBub_ctx_create\fP, is in use during but also
+after the callback and it cannot be deleted during a callback.
 .TP
 .B ub_cancel
 Cancel an async query in progress.
@@ -408,6 +408,8 @@ Functions
        The **async_id** is returned so you can (at your option) decide to
        track it and cancel the request if needed.
        If you pass a NULL pointer the **async_id** is not returned.
+        The context, created via **ub_ctx_create**, is in use during but also
+        after the callback and it cannot be deleted during a callback.

    ub_cancel
        Cancel an async query in progress.
@@ -2070,7 +2070,8 @@ Default:  \(dq3 2 1 0 0\(dq
 .INDENT 0.0
 .TP
 .B harden\-short\-bufsize: \fI<yes or no>\fP 
-Very small EDNS buffer sizes from queries are ignored.
+Very small EDNS buffer sizes from queries are ignored and are instead
+set to the normal UDP packet size (512 bytes).
 .sp
 Default: yes (per \fI\%RFC 6891\fP)
 .UNINDENT
@@ -2078,6 +2079,7 @@ Default: yes (per \fI\%RFC 6891\fP)
 .TP
 .B harden\-large\-queries: \fI<yes or no>\fP 
 Very large queries are ignored.
+The cutoff value is chosen to be the normal UDP packet size (512 bytes).
 Default is no, since it is legal protocol wise to send these, and could be
 necessary for operation if TSIG or EDNS payload is very large.
 .sp
@@ -2201,6 +2203,18 @@ Default: no
 .UNINDENT
 .INDENT 0.0
 .TP
+.B harden\-cname\-follow: \fI<yes or no>\fP 
+Harden CNAME redirections by following them.
+If no, then upstream CNAME and DNAME redirections are allowed in a
+response without checking with further messages if those are valid.
+It can only really be disabled safely on localhost net or encrypted
+connectivity.
+Default is on to protect the cache integrity.
+.sp
+Default: yes
+.UNINDENT
+.INDENT 0.0
+.TP
 .B use\-caps\-for\-id: \fI<yes or no>\fP 
 Use 0x20\-encoded random bits in the query to foil spoof attempts.
 This perturbs the lowercase and uppercase of query names sent to authority
@@ -2336,7 +2350,10 @@ Default: (none)
 .B do\-not\-query\-localhost: \fI<yes or no>\fP 
 If yes, localhost is added to the
 \fI\%do\-not\-query\-address\fP entries,
-both IPv6 \fB::1\fP and IPv4 \fB127.0.0.1/8\fP\&.
+both IPv4 \fB127.0.0.1/8\fP (also \fB::ffff:127.0.0.0/104\fP) and IPv6 \fB::1\fP\&.
+Additionally, the zero subnets \fB0.0.0.0/8\fP (also \fB::ffff:0:0/96\fP) and
+\fB::\fP are added to the list since on some systems they route to
+localhost as well.
 If no, then localhost can be used to send queries to.
 .sp
 Default: yes
@@ -2504,6 +2521,9 @@ Format is BIND\-9 style format, the \fBtrusted\-keys { name flag proto algo
 It is possible to use wildcards with this statement, the wildcard is
 expanded on start and on reload.
 .sp
+A wildcard that matches no files is not an error: the entry loads no
+trust anchors, and the condition is logged at operational verbosity.
+.sp
 Default: \(dq\(dq (no trusted keys file)
 .UNINDENT
 .INDENT 0.0
@@ -2613,7 +2633,7 @@ affected.
 Use this setting to protect the users that rely on this validator for
 authentication from potentially bad data in the additional section.
 .sp
-Default: yes
+Default: no
 .UNINDENT
 .INDENT 0.0
 .TP
@@ -3879,6 +3899,28 @@ Default: yes
 .UNINDENT
 .INDENT 0.0
 .TP
+.B val\-validation\-attempts: \fI<number>\fP 
+Limit on the number of DNSSEC validation attempts for a query.
+This protects against too large numbers of cryptographic operations,
+like for a deep delegation chain.
+This counts attempts to validate RRSIGs.
+When it is exceeded, the query fails.
+.sp
+Default: 32
+.UNINDENT
+.INDENT 0.0
+.TP
+.B val\-hash\-attempts: \fI<number>\fP 
+Limit on the number of DNSSEC hash attempts for a query.
+This protects against too large numbers of cryptographic operations,
+like for a deep delegation chain.
+This counts DS hash attempts to match DNSKEYs.
+When it is exceeded, the query fails.
+.sp
+Default: 32
+.UNINDENT
+.INDENT 0.0
+.TP
 .B fast\-server\-permil: \fI<number>\fP 
 Specify how many times out of 1000 to pick from the set of fastest servers.
 0 turns the feature off.
@@ -1838,13 +1838,15 @@ These options are part of the ``server:`` section.


@@UAHL@unbound.conf@harden-short-bufsize@@: *<yes or no>*
-    Very small EDNS buffer sizes from queries are ignored.
+    Very small EDNS buffer sizes from queries are ignored and are instead
+    set to the normal UDP packet size (512 bytes).

    Default: yes (per :rfc:`6891`)


@@UAHL@unbound.conf@harden-large-queries@@: *<yes or no>*
    Very large queries are ignored.
+    The cutoff value is chosen to be the normal UDP packet size (512 bytes).
    Default is no, since it is legal protocol wise to send these, and could be
    necessary for operation if TSIG or EDNS payload is very large.

@@ -1952,6 +1954,17 @@ These options are part of the ``server:`` section.
    Default: no


+@@UAHL@unbound.conf@harden-cname-follow@@: *<yes or no>*
+    Harden CNAME redirections by following them.
+    If no, then upstream CNAME and DNAME redirections are allowed in a
+    response without checking with further messages if those are valid.
+    It can only really be disabled safely on localhost net or encrypted
+    connectivity.
+    Default is on to protect the cache integrity.
+
+    Default: yes
+
+
@@UAHL@unbound.conf@use-caps-for-id@@: *<yes or no>*
    Use 0x20-encoded random bits in the query to foil spoof attempts.
    This perturbs the lowercase and uppercase of query names sent to authority
@@ -2077,7 +2090,10 @@ These options are part of the ``server:`` section.
@@UAHL@unbound.conf@do-not-query-localhost@@: *<yes or no>*
    If yes, localhost is added to the
    :ref:`do-not-query-address<unbound.conf.do-not-query-address>` entries,
-    both IPv6 ``::1`` and IPv4 ``127.0.0.1/8``.
+    both IPv4 ``127.0.0.1/8`` (also ``::ffff:127.0.0.0/104``) and IPv6 ``::1``.
+    Additionally, the zero subnets ``0.0.0.0/8`` (also ``::ffff:0:0/96``) and
+    ``::`` are added to the list since on some systems they route to
+    localhost as well.
    If no, then localhost can be used to send queries to.

    Default: yes
@@ -2226,6 +2242,9 @@ These options are part of the ``server:`` section.
    It is possible to use wildcards with this statement, the wildcard is
    expanded on start and on reload.

+    A wildcard that matches no files is not an error: the entry loads no
+    trust anchors, and the condition is logged at operational verbosity.
+
    Default: "" (no trusted keys file)


@@ -2320,7 +2339,7 @@ These options are part of the ``server:`` section.
    Use this setting to protect the users that rely on this validator for
    authentication from potentially bad data in the additional section.

-    Default: yes
+    Default: no


@@UAHL@unbound.conf@val-log-level@@: *<number>*
@@ -3358,6 +3377,26 @@ These options are part of the ``server:`` section.
    Default: yes


+@@UAHL@unbound.conf@val-validation-attempts@@: *<number>*
+    Limit on the number of DNSSEC validation attempts for a query.
+    This protects against too large numbers of cryptographic operations,
+    like for a deep delegation chain.
+    This counts attempts to validate RRSIGs.
+    When it is exceeded, the query fails.
+
+    Default: 32
+
+
+@@UAHL@unbound.conf@val-hash-attempts@@: *<number>*
+    Limit on the number of DNSSEC hash attempts for a query.
+    This protects against too large numbers of cryptographic operations,
+    like for a deep delegation chain.
+    This counts DS hash attempts to match DNSKEYs.
+    When it is exceeded, the query fails.
+
+    Default: 32
+
+
@@UAHL@unbound.conf@fast-server-permil@@: *<number>*
    Specify how many times out of 1000 to pick from the set of fastest servers.
    0 turns the feature off.
@@ -3481,6 +3520,24 @@ These options are part of the ``server:`` section.

    Default: no

+
+@@UAHL@unbound.conf@auth-task-threads@@: *<number of threads>*
+    If nonzero, the number of threads to start to process zone transfers
+    for authority zones, and also RPZ zones.
+    The zone transfer is processed in a thread, that does not interrupt
+    the resolver.
+    For RPZ zones that means the old RPZ zone continues to be used, while
+    the task is processed.
+    The thread allocates the new zone data, and this keeps another copy of
+    the zone data in memory during processing.
+    The result is swapped into the resolver when the thread is done.
+
+    The value 0 disables the threading, one of the worker threads performs
+    the processing. Without threading enabled, use the value 0.
+
+    Default: 0
+
+
 .. _unbound.conf.remote:

 Remote Control Options
@@ -1167,7 +1167,8 @@ subnetmod_operate(struct module_qstate *qstate, enum module_ev event,
 			subnet_ecs_opt_list_append(&sq->ecs_client_out,
 				&qstate->edns_opts_front_out, qstate,
 				qstate->region);
-			qstate->is_subnet_answer = 1;
+			if(sq->subnet_sent || sq->subnet_sent_no_subnet)
+				qstate->is_subnet_answer = 1;
 			if(verbosity >= VERB_ALGO) {
 				subnet_log_print("reply has edns subnet",
 					edns_opt_list_find(
@@ -59,6 +59,11 @@
 static int
 ipsecmod_apply_cfg(struct ipsecmod_env* ipsecmod_env, struct config_file* cfg)
 {
+	if(cfg->ipsecmod_whitelist &&
+		!ipsecmod_whitelist_apply_cfg(ipsecmod_env, cfg))
+		return 0;
+	if(!cfg->ipsecmod_enabled)
+		return 1;
 	if(!cfg->ipsecmod_hook || (cfg->ipsecmod_hook && !cfg->ipsecmod_hook[0])) {
 		log_err("ipsecmod: missing ipsecmod-hook.");
 		return 0;
@@ -68,9 +73,6 @@ ipsecmod_apply_cfg(struct ipsecmod_env* ipsecmod_env, struct config_file* cfg)
 			cfg->ipsecmod_hook, strerror(errno));
 		return 0;
 	}
-	if(cfg->ipsecmod_whitelist &&
-		!ipsecmod_whitelist_apply_cfg(ipsecmod_env, cfg))
-		return 0;
 	return 1;
 }

@@ -626,6 +628,8 @@ ipsecmod_inform_super(struct module_qstate* qstate, int id,
 		verbose(VERB_ALGO, "super has no ipsecmod state");
 		return;
 	}
+	if(!siq->enabled)
+		return;

 	if(qstate->return_msg) {
 		struct ub_packed_rrset_key* rrset_key = reply_find_answer_rrset(
@@ -46,6 +46,7 @@
 #include "services/cache/dns.h"
 #include "util/net_help.h"
 #include "util/data/dname.h"
+#include "util/config_file.h"
 #include "sldns/rrdef.h"
 #include "sldns/pkthdr.h"

@@ -107,7 +108,8 @@ response_type_from_cache(struct dns_msg* msg,
 enum response_type 
 response_type_from_server(int rdset,
 	struct dns_msg* msg, struct query_info* request, struct delegpt* dp,
-	int* empty_nodata_found, int msg_lame_empty, int msg_lame_referral)
+	int* empty_nodata_found, int msg_lame_empty, int msg_lame_referral,
+	struct config_file* cfg)
 {
 	uint8_t* origzone = (uint8_t*)"\000"; /* the default */
 	struct ub_packed_rrset_key* s;
@@ -130,6 +132,16 @@ response_type_from_server(int rdset,
 		if( (msg->rep->flags&BIT_RA) &&
 			!(msg->rep->flags&BIT_AA) && !rdset)
 				return RESPONSE_TYPE_REC_LAME;
+		if(!cfg->harden_cname_follow /* follow CNAME chain */) {
+			/* If the CNAME chain is allowed, see if there is a
+			 * SOA record, if so, the chain is complete to the
+			 * end of it, otherwise it could be a partial chain.*/
+			for(i=msg->rep->an_numrrsets; i<msg->rep->an_numrrsets+msg->rep->ns_numrrsets; i++) {
+				s = msg->rep->rrsets[i];
+				if(ntohs(s->rk.type) == LDNS_RR_TYPE_SOA)
+					return RESPONSE_TYPE_ANSWER;
+			}
+		}
 		/* it could be a CNAME with NXDOMAIN rcode */
 		for(i=0; i<msg->rep->an_numrrsets; i++) {
 			s = msg->rep->rrsets[i];
@@ -162,6 +174,7 @@ response_type_from_server(int rdset,
 	if(msg->rep->an_numrrsets > 0) {
 		uint8_t* mname = request->qname;
 		size_t mname_len = request->qname_len;
+		int sawanswer = 0;

 		/* Now look at the answer section first. 3 states: our 
 		 * answer is there directly, our answer is there after 
@@ -197,6 +210,7 @@ response_type_from_server(int rdset,
 				 * the answer, we only provisionally say 
 				 * 'ANSWER' -- it very well could be a 
 				 * REFERRAL. */
+				sawanswer = 1;
 				break;
 			}

@@ -214,6 +228,10 @@ response_type_from_server(int rdset,
 		 * still got to here, then it is a CNAME response. 
 		 * (This is regardless of the AA bit at this point) */
 		if(mname != request->qname) {
+			if(!cfg->harden_cname_follow /* allow CNAMEs */ &&
+				sawanswer /* The last was not CNAME, and
+				there is an answer RRset. */ )
+				return RESPONSE_TYPE_ANSWER;
 			return RESPONSE_TYPE_CNAME;
 		}
 	}
@@ -45,6 +45,7 @@
 struct dns_msg;
 struct query_info;
 struct delegpt;
+struct config_file;

 /**
 * The response type is used to interpret the response.
@@ -115,7 +116,7 @@ enum response_type response_type_from_cache(struct dns_msg* msg,
 * detection, mostly).
 *
 * @param rdset: if RD bit was sent in query sent by unbound.
- * @param msg: the message from the cache.
+ * @param msg: the message.
 * @param request: the request that generated the response.
 * @param dp: The delegation point that was being queried
 *          when the response was returned.
@@ -124,10 +125,12 @@ enum response_type response_type_from_cache(struct dns_msg* msg,
 *	is lame, before it became empty.
 * @param msg_lame_referral: returned true if the reply has a referral before
 *	scrub.
+ * @param cfg: config with options.
 * @return the response type (CNAME or ANSWER).
 */
 enum response_type response_type_from_server(int rdset, 
 	struct dns_msg* msg, struct query_info* request, struct delegpt* dp,
-	int* empty_nodata_found, int msg_lame_empty, int msg_lame_referral);
+	int* empty_nodata_found, int msg_lame_empty, int msg_lame_referral,
+	struct config_file* cfg);

 #endif /* ITERATOR_ITER_RESPTYPE_H */
@@ -294,7 +294,14 @@ synth_cname_rrset(uint8_t** sname, size_t* snamelen, uint8_t* alias,
 		if(ttl_t > MAX_TTL) ttl_t = MAX_TTL;
 		ttl = (uint32_t)ttl_t;
 		sldns_write_uint32(cn->rr_first->ttl_data, ttl);
-		sldns_write_uint32(rrset->rr_first->ttl_data, ttl);
+		/* Do NOT write the clamp back into the packet buffer:
+		 * parse_packet already sized every name from the original
+		 * bytes and rdata_copy re-walks them trusting those sizes;
+		 * mutating packet bytes between the walks breaks that
+		 * invariant (compression pointers can target these TTL
+		 * bytes). The DNAME rrset receives the same clamp at store
+		 * time in rdata_copy, so the DNAME and the synthesized
+		 * CNAME still carry equal TTLs in the cache. */
 	}
 	sldns_write_uint16(cn->rr_first->ttl_data+4, aliaslen);
 	memmove(cn->rr_first->ttl_data+6, alias, aliaslen);
@@ -517,7 +524,7 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 			 * server, scrub down the length to something
 			 * shorter. This deletes everything after the limit
 			 * is reached. The iterator is going to look up
-			 * the content one by one anyway. */
+			 * the content one by one, if harden-cname-follow . */
 			remove_rrset("normalize: removing because too many cnames:",
 				pkt, msg, prev, &rrset);
 			continue;
@@ -648,6 +655,9 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 					if(rrset->type == LDNS_RR_TYPE_NS &&
 						rrset->rr_count > env->cfg->iter_scrub_ns) {
 						shorten_rrset(pkt, rrset, env->cfg->iter_scrub_ns);
+					} else if(rrset->type == LDNS_RR_TYPE_DS &&
+						rrset->rr_count > env->cfg->iter_scrub_ns) {
+						shorten_rrset(pkt, rrset, env->cfg->iter_scrub_ns);
 					}
 					prev = rrset;
 					rrset = rrset->rrset_all_next;
@@ -667,6 +677,9 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 		if(rrset->type == LDNS_RR_TYPE_NS &&
 			rrset->rr_count > env->cfg->iter_scrub_ns) {
 			shorten_rrset(pkt, rrset, env->cfg->iter_scrub_ns);
+		} else if(rrset->type == LDNS_RR_TYPE_DS &&
+			rrset->rr_count > env->cfg->iter_scrub_ns) {
+			shorten_rrset(pkt, rrset, env->cfg->iter_scrub_ns);
 		}

 		/* Mark the additional names from relevant rrset as OK. */
@@ -791,6 +804,11 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 					shorten_rrset(pkt, rrset, env->cfg->iter_scrub_ns);
 				}
 			}
+		} else if(rrset->type==LDNS_RR_TYPE_DS) {
+			if(rrset->rr_count > env->cfg->iter_scrub_ns) {
+				shorten_rrset(pkt, rrset,
+					env->cfg->iter_scrub_ns);
+			}
 		}
 		/* if this is type DS and we query for type DS we just got
 		 * a referral answer for our type DS query, fix packet */
@@ -893,8 +911,8 @@ store_rrset(sldns_buffer* pkt, struct msg_parse* msg, struct module_env* env,
 	packed_rrset_ttl_add(d, now);
 	ref.key = k;
 	ref.id = k->id;
-	/*ignore ret: it was in the cache, ref updated */
-	(void)rrset_cache_update(env->rrset_cache, &ref, env->alloc, now);
+	/* if it was in the cache, ref updated */
+	rrset_cache_update_unlock(env->rrset_cache, &ref, env->alloc, now);
 }

 /**
@@ -1021,6 +1039,8 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
 	uint8_t* ns_rrset_dname = NULL;
 	int added_rrlen_ede = 0;
 	struct rrset_parse* rrset, *prev;
+	uint8_t* sname = qinfo->qname;
+	size_t snamelen = qinfo->qname_len;
 	prev = NULL;
 	rrset = msg->rrset_first;

@@ -1028,6 +1048,7 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
 	 * it can be used from the cache. After normalization, an initial 
 	 * DNAME will have a correctly synthesized CNAME after it. */
 	if(rrset && rrset->type == LDNS_RR_TYPE_DNAME && 
+		env->cfg->harden_cname_follow /* CNAME chain is cut off, one DNAME is allowed here. */ &&
 		rrset->section == LDNS_SECTION_ANSWER &&
 		pkt_strict_sub(pkt, qinfo->qname, rrset->dname) &&
 		pkt_sub(pkt, rrset->dname, zonename)) {
@@ -1043,12 +1064,33 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
 	 * ANY queries get query name in answer section.
 	 * Remainders of CNAME chains are cut off and resolved by iterator. */
 	while(rrset && rrset->section == LDNS_SECTION_ANSWER) {
-		if(dname_pkt_compare(pkt, qinfo->qname, rrset->dname) != 0) {
+		if(!env->cfg->harden_cname_follow /* CNAME chain is allowed to stay */ &&
+			rrset->type == LDNS_RR_TYPE_DNAME &&
+			pkt_strict_sub(pkt, sname, rrset->dname) &&
+			pkt_sub(pkt, rrset->dname, zonename)) {
+			/* This DNAME is allowed to stay, the synthesized
+			 * CNAME follows next. */
+			prev = rrset;
+			rrset = rrset->rrset_all_next;
+			continue;
+		}
+		if(dname_pkt_compare(pkt, sname, rrset->dname) != 0) {
 			if(has_additional(rrset->type)) del_addi = 1;
 			remove_rrset("sanitize: removing extraneous answer "
 				"RRset:", pkt, msg, prev, &rrset);
 			continue;
 		}
+		if(!env->cfg->harden_cname_follow /* CNAME chain is allowed to stay */ &&
+			qinfo->qtype != LDNS_RR_TYPE_ANY &&
+			rrset->type == LDNS_RR_TYPE_CNAME &&
+			dname_pkt_compare(pkt, sname, rrset->dname) == 0) {
+			/* Follow the CNAME chain, and allow the elements
+			 * that match the CNAME chain. Also allow a DNAME
+			 * in front. */
+			if(!parse_get_cname_target(rrset, &sname, &snamelen,
+				pkt))
+				return 0;
+		}
 		prev = rrset;
 		rrset = rrset->rrset_all_next;
 	}
@@ -1215,8 +1215,8 @@ iter_store_parentside_rrset(struct module_env* env,
 	rrset->entry.hash = rrset_key_hash(&rrset->rk);
 	ref.key = rrset;
 	ref.id = rrset->id;
-	/* ignore ret: if it was in the cache, ref updated */
-	(void)rrset_cache_update(env->rrset_cache, &ref, env->alloc, *env->now);
+	/* if it was in the cache, ref updated */
+	rrset_cache_update_unlock(env->rrset_cache, &ref, env->alloc, *env->now);
 }

 /** fetch NS record from reply, if any */
@@ -1712,3 +1712,28 @@ deleg_port_number(struct module_env* env)
 		return env->cfg->ssl_port;
 	return -1;
 }
+
+void
+shorten_answer_cname(struct reply_info* rep, uint8_t* cutoff)
+{
+	size_t i, found = 0, removenum;
+	uint8_t* sname = NULL;
+	size_t snamelen = 0;
+	for(i=0; i<rep->an_numrrsets; i++) {
+		if(query_dname_compare(rep->rrsets[i]->rk.dname, cutoff) == 0) {
+			found = 1;
+			removenum = i;
+			break;
+		}
+		if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_CNAME) {
+			get_cname_target(rep->rrsets[i], &sname, &snamelen);
+			if(query_dname_compare(sname, cutoff) == 0) {
+				found = 1;
+				removenum = i+1;
+				break;
+			}
+		}
+	}
+	if(!found) return; /* not found */
+	val_reply_remove_answers(rep, removenum, rep->an_numrrsets-removenum);
+}
@@ -486,4 +486,7 @@ void iter_make_minimal(struct reply_info* rep);
 /** See if we need a different port number */
 int deleg_port_number(struct module_env* env);

+/** Shorten reply CNAME chain to cutoff, cutoff is excluded. */
+void shorten_answer_cname(struct reply_info* rep, uint8_t* cutoff);
+
 #endif /* ITERATOR_ITER_UTILS_H */
@@ -3189,7 +3189,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 	type = response_type_from_server(
 		(int)((iq->chase_flags&BIT_RD) || iq->chase_to_rd),
 		iq->response, &iq->qinfo_out, iq->dp, &iq->empty_nodata_found,
-		iq->msg_lame_empty, iq->msg_lame_referral);
+		iq->msg_lame_empty, iq->msg_lame_referral, qstate->env->cfg);
 	iq->chase_to_rd = 0;
 	/* remove TC flag, if this is erroneously set by TCP upstream */
 	iq->response->rep->flags &= ~BIT_TC;
@@ -3302,6 +3302,47 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 		 * to send another query with a new qtype. */
 		type = RESPONSE_TYPE_ANSWER;
 	}
+	if(type == RESPONSE_TYPE_ANSWER &&
+		!qstate->env->cfg->harden_cname_follow /* cname chain from upstream is allowed */ &&
+		qstate->env->auth_zones &&
+		/* Check for CNAMEs in answer and RPZ after the CNAME. */
+		reply_find_rrset_section_an(
+		iq->response->rep, iq->qchase.qname,
+		iq->qchase.qname_len, LDNS_RR_TYPE_CNAME,
+		iq->qchase.qclass) != NULL) {
+		/* If this is an answer with CNAMEs in front, and
+		 * RPZ wants to modify after CNAME(s), cut off, the
+		 * remainder, and treat as the CNAME response */
+		size_t i;
+		uint8_t* origname = iq->qchase.qname;
+		size_t orignamelen = iq->qchase.qname_len;
+		for(i=0; i<iq->response->rep->an_numrrsets; i++) {
+			struct dns_msg* forged_response;
+			if(ntohs(iq->response->rep->rrsets[i]->rk.type) ==
+				LDNS_RR_TYPE_DNAME) {
+				continue;
+			}
+			if(ntohs(iq->response->rep->rrsets[i]->rk.type) !=
+				LDNS_RR_TYPE_CNAME) {
+				break;
+			}
+			get_cname_target(iq->response->rep->rrsets[i],
+				&iq->qchase.qname, &iq->qchase.qname_len);
+			forged_response = rpz_callback_from_iterator_cname(qstate, iq);
+			if(forged_response) {
+				/* Cut off the answer section at this point.
+				 * RPZ is going to make an answer, in the
+				 * processInit after the CNAME(s) in front
+				 * are handled. */
+				shorten_answer_cname(iq->response->rep,
+					iq->qchase.qname);
+				type = RESPONSE_TYPE_CNAME;
+				break;
+			}
+		}
+		iq->qchase.qname = origname;
+		iq->qchase.qname_len = orignamelen;
+	}

 	/* handle each of the type cases */
 	if(type == RESPONSE_TYPE_ANSWER) {
@@ -3804,7 +3845,7 @@ processPrimeResponse(struct module_qstate* qstate, int id)
 	type = response_type_from_server(
 		(int)((iq->chase_flags&BIT_RD) || iq->chase_to_rd), 
 		iq->response, &iq->qchase, iq->dp, NULL, iq->msg_lame_empty,
-		iq->msg_lame_referral);
+		iq->msg_lame_referral, qstate->env->cfg);
 	if(type == RESPONSE_TYPE_ANSWER) {
 		qstate->return_rcode = LDNS_RCODE_NOERROR;
 		qstate->return_msg = iq->response;
@@ -3954,15 +3995,32 @@ processDSNSResponse(struct module_qstate* qstate, int id,
 	struct module_qstate* forq)
 {
 	struct iter_qstate* foriq = (struct iter_qstate*)forq->minfo[id];
+	int sec_an = 0, sec_ns = 0;

 	/* if the finished (iq->response) query has no NS set: continue
 	 * up to look for the right dp; nothing to change, do DPNSstate */
 	if(qstate->return_rcode != LDNS_RCODE_NOERROR)
 		return; /* seek further */
 	/* find the NS RRset (without allowing CNAMEs) */
-	if(!reply_find_rrset(qstate->return_msg->rep, qstate->qinfo.qname,
-		qstate->qinfo.qname_len, LDNS_RR_TYPE_NS,
-		qstate->qinfo.qclass)){
+	/* Usually, the response has a NS in the answer section, since that
+	 * was the query type. And it is then the child side part of the NS
+	 * set. This child side part would be used if next up a delegation
+	 * point was constructed from cache, for example. But now it uses that
+	 * child side part for constructing a delegation point for the DS
+	 * lookup.
+	 * If that is not there, we can pick up the NS from the authority
+	 * section as well, like from a referral. */
+	if(reply_find_rrset_section_an(qstate->return_msg->rep,
+		qstate->qinfo.qname, qstate->qinfo.qname_len,
+		LDNS_RR_TYPE_NS, qstate->qinfo.qclass))
+		sec_an = 1;
+	if(!sec_an && reply_find_rrset_section_ns(qstate->return_msg->rep,
+		qstate->qinfo.qname, qstate->qinfo.qname_len,
+		LDNS_RR_TYPE_NS, qstate->qinfo.qclass))
+		sec_ns = 1;
+	if(!sec_an && !sec_ns) {
+		/* We probably hit an intermediate label, without a type NS
+		 * record there. To find the nameservers, it must go up more.*/
 		return; /* seek further */
 	}

@@ -3975,6 +4033,11 @@ processDSNSResponse(struct module_qstate* qstate, int id,
 		errinf(qstate, "malloc failure, in DS search");
 		return; /* dp==NULL in QUERYTARGETS makes SERVFAIL */
 	}
+	if(sec_an) {
+		/* The NS is in the answer section, this is not a parent side,
+		 * but a child side response for it. */
+		foriq->dp->has_parent_side_NS = 0;
+	}
 	/* success, go query the querytargets in the new dp (and go down) */
 }

@@ -0,0 +1,49 @@
+/*
+ * libunbound/authload.h - prototypes for auth load methods.
+ *
+ * Copyright (c) 2026, NLnet Labs. All rights reserved.
+ *
+ * This software is open source.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ * 
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ * 
+ * Neither the name of the NLNET LABS nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
+ * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * \file
+ *
+ * This file declares the methods that must be implemented to use the
+ * auth load service.
+ */
+
+#ifndef LIBUNBOUND_AUTHLOAD_H
+#define LIBUNBOUND_AUTHLOAD_H
+
+/** The worker routine that services the auth load connection. */
+void worker_auth_load_service_cb(int fd, short bits, void* arg);
+
+#endif /* LIBUNBOUND_AUTHLOAD_H */
@@ -409,7 +409,7 @@ if [ "$DOWIN" = "yes" ]; then
 	info "git clone --depth=1 --no-tags -b $GITBRANCH $GITREPO unbound"
 	git clone --depth=1 --no-tags -b $GITBRANCH $GITREPO unbound || error_cleanup "git clone failed"
 	cd unbound || error_cleanup "Unbound not exported correctly from git"
-	rm -rf .git .travis.yml .gitattributes .github .gitignore || error_cleanup "Failed to remove .git tracking and ci information"
+	rm -rf .git .gitattributes .github .gitignore || error_cleanup "Failed to remove .git tracking and ci information"

 	# on a re-configure the cache may no longer be valid...
 	if test -f mingw32-config.cache; then rm mingw32-config.cache; fi
@@ -603,11 +603,13 @@ info "git clone --depth=1 --no-tags -b $GITBRANCH $GITREPO unbound"
 git clone --depth=1 --no-tags -b $GITBRANCH $GITREPO unbound || error_cleanup "git clone failed"

 cd unbound || error_cleanup "Unbound not exported correctly from git"
-rm -rf .git .travis.yml .gitattributes .github .gitignore || error_cleanup "Failed to remove .git tracking and ci information"
+rm -rf .git .gitattributes .github .gitignore || error_cleanup "Failed to remove .git tracking and ci information"

 info "Adding libtool utils (libtoolize)."
 libtoolize -c --install || libtoolize -c || error_cleanup "Libtoolize failed."

+# Turn this off, if the git repo times out for lookups.
+if test "updateconfigsub" = "false"; then
 # https://www.gnu.org/software/gettext/manual/html_node/config_002eguess.html
 info "Updating config.guess and config.sub"
 wget -O config.guess 'https://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.guess;hb=HEAD'
@@ -621,6 +623,7 @@ if [ `uname -s | grep -i -c darwin` -ne 0 ]; then
        xattr -d com.apple.quarantine config.sub
    fi
 fi
+fi

 info "Building configure script (autoreconf)."
 autoreconf -f || error_cleanup "Autoconf failed."
@@ -79,7 +79,7 @@
                i+(int)((unsigned int)name[i]) < len) {
                memmove(buf, name + i + 1, (unsigned int)name[i]);
                buf[(unsigned int)name[i]] = 0;
-                PyList_SetItem(list, cnt, PyString_FromString(buf));
+                PyList_SetItem(list, cnt, PyUnicode_FromString(buf));
        }
        i += ((unsigned int)name[i]) + 1;
        cnt++;
@@ -96,7 +96,7 @@

     list = PyList_New(len);
     for (i=0; i < len; i++) {
-            PyList_SET_ITEM(list, i, PyString_FromString(array[i]));
+            PyList_SET_ITEM(list, i, PyUnicode_FromString(array[i]));
     }
     return list;
   }
@@ -207,7 +207,7 @@ struct query_info {
       char buf[LDNS_MAX_DOMAINLEN];
       buf[0] = '\0';
       dname_str((uint8_t*)PyBytes_AsString(dname), buf);
-       return PyString_FromString(buf);
+       return PyUnicode_FromString(buf);
   }
 %}

@@ -345,7 +345,7 @@ struct packed_rrset_data {
   PyObject* _get_data_rr_len(struct packed_rrset_data* d, int idx) {
     if ((d != NULL) && (idx >= 0) &&
             ((size_t)idx < (d->count+d->rrsig_count)))
-        return PyInt_FromLong(d->rr_len[idx]);
+        return PyLong_FromLong(d->rr_len[idx]);
     return Py_None;
   }
   void _set_data_rr_ttl(struct packed_rrset_data* d, int idx, uint32_t ttl)
@@ -357,7 +357,7 @@ struct packed_rrset_data {
   PyObject* _get_data_rr_ttl(struct packed_rrset_data* d, int idx) {
     if ((d != NULL) && (idx >= 0) &&
             ((size_t)idx < (d->count+d->rrsig_count)))
-        return PyInt_FromLong(d->rr_ttl[idx]);
+        return PyLong_FromLong(d->rr_ttl[idx]);
     return Py_None;
   }
   PyObject* _get_data_rr_data(struct packed_rrset_data* d, int idx) {
@@ -555,12 +555,12 @@ struct sockaddr_storage {};

        if (ss->ss_family == AF_INET) {
            const struct sockaddr_in *sa4 = (struct sockaddr_in *)ss;
-            return PyInt_FromLong(ntohs(sa4->sin_port));
+            return PyLong_FromLong(ntohs(sa4->sin_port));
        }

        if (ss->ss_family == AF_INET6) {
            const struct sockaddr_in6 *sa6 = (struct sockaddr_in6 *)ss;
-            return PyInt_FromLong(ntohs(sa6->sin6_port));
+            return PyLong_FromLong(ntohs(sa6->sin6_port));
        }

        return Py_None;
@@ -574,7 +574,7 @@ struct sockaddr_storage {};
        }

        sa6 = (struct sockaddr_in6 *)ss;
-        return PyInt_FromLong(ntohl(sa6->sin6_flowinfo));
+        return PyLong_FromLong(ntohl(sa6->sin6_flowinfo));
    }

    PyObject *_sockaddr_storage_scope_id(const struct sockaddr_storage *ss) {
@@ -585,7 +585,7 @@ struct sockaddr_storage {};
        }

        sa6 = (struct sockaddr_in6 *)ss;
-        return PyInt_FromLong(ntohl(sa6->sin6_scope_id));
+        return PyLong_FromLong(ntohl(sa6->sin6_scope_id));
    }
 %}

@@ -661,7 +661,7 @@ struct edns_option {
 %inline %{
    PyObject* _edns_option_opt_code_get(struct edns_option* option) {
        uint16_t opt_code = option->opt_code;
-        return PyInt_FromLong(opt_code);
+        return PyLong_FromLong(opt_code);
    }

    PyObject* _edns_option_opt_data_get(struct edns_option* option) {
@@ -1627,7 +1627,7 @@ int edns_opt_list_append(struct edns_option** list, uint16_t code, size_t len,
        }
        result = PyObject_Call(func, py_args, py_kwargs);
        if (result) {
-            res = PyInt_AsLong(result);
+            res = PyLong_AsLong(result);
        }
 out:
        Py_XDECREF(py_edns);
@@ -1711,7 +1711,7 @@ out:
        }
        result = PyObject_Call(func, py_args, py_kwargs);
        if (result) {
-            res = PyInt_AsLong(result);
+            res = PyLong_AsLong(result);
        }
 out:
        Py_XDECREF(py_qinfo);
@@ -1765,7 +1765,7 @@ out:
        }
        result = PyObject_Call(func, py_args, py_kwargs);
        if (result) {
-            res = PyInt_AsLong(result);
+            res = PyLong_AsLong(result);
        }
 out:
        Py_XDECREF(py_qstate);
@@ -1814,7 +1814,7 @@ out:
        }
        result = PyObject_Call(func, py_args, py_kwargs);
        if (result) {
-            res = PyInt_AsLong(result);
+            res = PyLong_AsLong(result);
        }
 out:
        Py_XDECREF(py_qstate);
@@ -246,14 +246,14 @@ log_py_err(void)
 	}

 	/* And it should be a string all ready to go - duplicate it. */
-	if (!PyString_Check(obResult) && !PyUnicode_Check(obResult)) {
+	if (!PyBytes_Check(obResult) && !PyUnicode_Check(obResult)) {
 		log_err("pythonmod: cannot print exception, "
 			"StringIO.getvalue() result did not String_Check"
 			" or Unicode_Check");
 		goto cleanup;
 	}
-	if(PyString_Check(obResult)) {
-		result = PyString_AsString(obResult);
+	if(PyBytes_Check(obResult)) {
+		result = PyBytes_AsString(obResult);
 	} else {
 		ascstr = PyUnicode_AsASCIIString(obResult);
 		result = PyBytes_AsString(ascstr);
@@ -450,7 +450,7 @@ int pythonmod_init(struct module_env* env, int id)

   pe->data = PyDict_New();
   /* add the script filename to the global "mod_env" for trivial access */
-   fname = PyString_FromString(pe->fname);
+   fname = PyUnicode_FromString(pe->fname);
   if(PyDict_SetItemString(pe->data, "script", fname) < 0) {
 	log_err("pythonmod: could not add item to dictionary");
 	Py_XDECREF(fname);
@@ -734,6 +734,7 @@ respip_data_answer(enum respip_action action,
 	if(!new_rep)
 		return -1;
 	rp->rk.flags |= PACKED_RRSET_FIXEDTTL; /* avoid adjusting TTL */
+	rp->entry.hash = rrset_key_hash(&rp->rk);
 	new_rep->rrsets[rrset_id] = rp;

 	*redirect_rrsetp = rp;
@@ -0,0 +1,301 @@
+/*
+ * services/authload.h - authoritative zone load thread
+ *
+ * Copyright (c) 2026, NLnet Labs. All rights reserved.
+ *
+ * This software is open source.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ * 
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ * 
+ * Neither the name of the NLNET LABS nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
+ * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * \file
+ *
+ * This file contains the auth load thread. This loads authority zone
+ * and RPZ zone information in a thread, in a separate memory structure.
+ * When it is done, the information is swapped over to the running server.
+ */
+
+#ifndef SERVICES_AUTHLOAD_H
+#define SERVICES_AUTHLOAD_H
+#include "util/locks.h"
+#include "util/rbtree.h"
+struct worker;
+struct daemon;
+struct auth_xfer;
+struct module_env;
+struct auth_load_task;
+struct comm_timer;
+
+/**
+ * General information for auth load threads. The number of active threads.
+ */
+struct auth_load_general_info {
+	/** lock on this structure. It is after the auth_zones lock, and
+	 * after the auth_xfer locks. */
+	lock_basic_type lock;
+	/** The number of active auth load threads. */
+	int num_auth_load_threads;
+	/** The number of active downloads, zone transfers in progress.
+	 * These are going to need an auth load thread when done. The counter
+	 * is decremented when the thread and transfer have completed. */
+	int num_auth_transfers;
+	/** The auth zone xfer transfer wait list */
+	struct auth_xfer* wait_transfer_list;
+	/** The last item of the wait_transfer list. */
+	struct auth_xfer* wait_transfer_last;
+	/** To resume from a waiting item, the callback, at zero timeout is
+	 * used. That breaks out of callbacks and handles the items there.
+	 * If the timer is set, this is true. */
+	int resume_timer_enabled;
+	/** The resume timer for the wait_transfer list. */
+	struct comm_timer* resume_timer;
+	/** The worker env for the resume timer. It is set in the event base
+	 * of that worker. */
+	struct module_env* resume_env;
+};
+
+/**
+ * The types of notifications that the auth load thread sends around.
+ */
+enum auth_load_notification_type {
+	/** This is sent to make the auth load thread perform exit */
+	auth_load_notification_exit
+};
+
+/**
+ * The auth load thread. The thread runs to load authority zone information
+ * and RPZ information into memory. It loads into a copy. Then that is swapped
+ * over to the running server. This keeps the server responsive while the
+ * information is loaded.
+ */
+struct auth_load_thread {
+	/** the thread number for the thread,
+	 * must be first to cast thread arg to int* in checklock code. */
+	int threadnum;
+	/** thread id, of the io thread */
+	ub_thread_type tid;
+#ifdef HAVE_GETTID
+	/** thread tid, the LWP id */
+	pid_t thread_tid;
+	/** if logging should include the LWP id */
+	int thread_tid_log;
+#endif
+
+	/** communication socket pair, that sends commands */
+	int commpair[2];
+	/** if the thread has to quit */
+	int need_to_quit;
+	/** the event that listens on the worker to commpair,
+	 * it receives content from the auth load thread. */
+	void* service_event;
+	/** if the event that listens on the worker has
+	 * been added to the comm base. */
+	int service_event_is_added;
+
+	/** the worker that the auth load is connected to */
+	struct worker* worker;
+	/** if the thread is inserted in the tree at the worker. */
+	int tree_inserted;
+	/** the rbtree node for the worker tree of auth load threads. */
+	rbnode_type node;
+
+	/** The task that the thread is working on */
+	struct auth_load_task* task;
+};
+
+/**
+ * The types of tasks that the auth load can perform.
+ */
+enum auth_load_task_type {
+	AUTH_LOAD_TASK_TRANSFER,
+	AUTH_LOAD_TASK_ZONEFILE_READ,
+	AUTH_LOAD_TASK_ZONEFILE_WRITE,
+	AUTH_LOAD_TASK_HTTPCHUNKS
+};
+
+/**
+ * The task for the auth load. The task can be to load a zone transfer, AXFR,
+ * IXFR, from zonefile, and from a http read, from chunks.
+ */
+struct auth_load_task {
+	/** The type of the task */
+	enum auth_load_task_type task_type;
+	/** The task is connected with this worker */
+	struct worker* worker;
+
+	/** The zone name */
+	uint8_t* name;
+	/** The zone namelen */
+	size_t namelen;
+	/** The zone class */
+	uint16_t dclass;
+
+	/** name of the host that the transfer comes from. */
+	char* host;
+	/** file part of the url that the transfer comes from, or NULL. */
+	char* file;
+	/** Set if the host is http transfer, if false it is AXFR or IXFR. */
+	int on_http;
+	/** Set if the transfer is doing IXFR */
+	int on_ixfr;
+	/** Set if the transfer is an IXFR but we detected an AXFR contents */
+	int on_ixfr_is_axfr;
+	/** The zone is an rpz zone. */
+	int is_rpz;
+
+	/** Set if the ixfr failed. (So that there can be backoff to AXFR). */
+	int ixfr_fail;
+
+	/** current serial (from SOA), if we have no zone, 0
+	 * This is for checking the IXFR result. */
+	uint32_t serial;
+
+	/** the data chunks, or NULL, to process. */
+	struct auth_chunk* chunks_first;
+	/** last data chunk */
+	struct auth_chunk* chunks_last;
+	/** size of data in data chunks. */
+	size_t chunks_total;
+
+	/** time taken for the task */
+	struct timeval time_taken;
+	/** time taken for the reload part of the task */
+	struct timeval time_reload;
+	/** memory used for the task */
+	size_t mem_used;
+};
+
+/**
+ * Add a new task to be performed by the auth load thread.
+ * It starts a thread.
+ * @param xfr: zone transfer to start for.
+ * @param worker: worker that is connected to the task.
+ * @return false on failure.
+ */
+int auth_load_add_task_xfr(struct auth_xfer* xfr, struct worker* worker);
+
+/**
+ * Add a new task to be performed by the auth load thread.
+ * It starts a thread. This writes to zonefile.
+ * @param name: name of zone, wireformat.
+ * @param namelen: length of name.
+ * @param dclass: class of the zone.
+ * @param env: the module env.
+ * @param chunk_list: for writes after http, the chunk list with data.
+ * @return false on failure to create the thread.
+ */
+int auth_load_add_task_write(uint8_t* name, size_t namelen, uint16_t dclass,
+	struct module_env* env, struct auth_chunk* chunk_list);
+
+/** See if there is a quit signal, true if so. */
+int auth_load_thread_poll_for_quit(struct auth_load_thread* thr);
+
+/**
+ * Create auth load info structure.
+ * @return NULL on failure.
+ */
+struct auth_load_general_info* auth_load_info_create(void);
+
+/**
+ * Delete auth load info structure.
+ * @param auth_load_info: to delete.
+ */
+void auth_load_info_delete(struct auth_load_general_info* auth_load_info);
+
+/**
+ * Grab a new thread from the auth load count.
+ * @param env: with auth_load_info with the active thread count.
+ *	and config file, with configured maximum.
+ * @return false on failure, like too many active, true if successful.
+ */
+int auth_load_info_grab_thread(struct module_env* env);
+
+/**
+ * Release thread from auth load count. It is done.
+ * @param env: with auth_load_info with the active thread count.
+ */
+void auth_load_info_release_thread(struct module_env* env);
+
+/**
+ * Grab a new transfer in progress, this is limited by the auth load count.
+ * @param env: with auth_load_info with the active transfer number.
+ *	and config file, with configured maximum.
+ * @return false on failure, like too many active, true if successful.
+ */
+int auth_load_info_grab_transfer_in_progress(struct module_env* env);
+
+/**
+ * Release transfer from active count. It is done.
+ * @param env: with auth_load_info with the active transfer count.
+ */
+void auth_load_info_release_transfer_in_progress(struct module_env* env);
+
+/**
+ * Make transfer active in the in progress transfer count.
+ * @param xfr: the xfr is in progress
+ * @return false if not possible.
+ */
+int xfr_transfer_grab_active(struct auth_xfer* xfr);
+
+/**
+ * Release active transfer from in progress transfer count.
+ * @param xfr: the xfr is no longer in progress.
+ */
+void xfr_transfer_release_active(struct auth_xfer* xfr);
+
+/**
+ * Add transfer to wait_transfer list. It can not become active right now.
+ * @param xfr: the xfr is put on the wait_transfer list.
+ */
+void xfr_transfer_wait_active(struct auth_xfer* xfr);
+
+/**
+ * Remove xfr from wait_transfer list
+ * @param xfr: the xfr is removed from the wait_transfer list.
+ */
+void xfr_transfer_remove_wait_transfer_list(struct auth_xfer* xfr);
+
+/** The timer callback for the wait_transfer resume timer. */
+void auth_load_resume_timer_cb(void* arg);
+
+/** Schedule pick up of waiting transfers. */
+void auth_load_schedule_waiting_pickup(struct module_env* env);
+
+/** Compare auth load tree entries, in the worker auth load tree. */
+int auth_load_tree_cmp(const void* a, const void* b);
+
+/** Delete tasks for the zone. The write and xfr tasks for that name, class
+ * are sent a quit signal, and the thread is joined, as it exits. */
+void auth_load_del_zone_tasks(struct worker* worker, uint8_t* name,
+	size_t namelen, uint16_t dclass);
+
+/** Stop all the auth load threads. */
+void auth_load_stop_threads(struct daemon* daemon);
+
+#endif /* SERVICES_AUTHLOAD_H */
@@ -65,6 +65,7 @@ struct auth_probe;
 struct auth_transfer;
 struct auth_master;
 struct auth_chunk;
+struct auth_load_thread;

 /**
 * Authoritative zones, shared.
@@ -146,6 +147,12 @@ struct auth_zone {
 	uint16_t zonemd_callback_qtype;
 	/** for the zonemd callback, the unique info */
 	void* zonemd_callback_unique_info;
+	/** if the zonemd callback should write to file */
+	int zonemd_callback_perform_write;
+	/** chunklist to write for chunked transfer. */
+	struct auth_chunk* perform_write_chunk_list;
+	/** The zonemd transfer is an active transfer (for auth load info) */
+	int zonemd_transfer_active;
 	/** zone has been deleted */
 	int zone_deleted;
 	/** deletelist pointer, unused normally except during delete */
@@ -400,6 +407,15 @@ struct auth_transfer {
 	size_t chunks_total;
 	/** start time of the transfer */
 	struct timeval start_time;
+	/** if the transfer is active and in the in progress count. */
+	int active_transfer;
+	/** if the transfer is on the wait_transfer list (it waits to
+	 * become active). */
+	int on_wait_transfer_list;
+	/** If on the wait_transfer list, the previous list item. */
+	struct auth_xfer* wait_transfer_prev;
+	/** If on the wait_transfer list, the next list item. */
+	struct auth_xfer* wait_transfer_next;

 	/** list of upstream masters for this zone, from config */
 	struct auth_master* masters;
@@ -541,7 +557,15 @@ void auth_zones_delete(struct auth_zones* az);
 /**
 * Write auth zone data to file, in zonefile format.
 */
-int auth_zone_write_file(struct auth_zone* z, const char* fname);
+int auth_zone_write_file(struct auth_zone* z, const char* fname,
+	struct auth_load_thread* thr);
+
+/** write to zonefile after zone has updated, reacquires z readlock.
+ * The chunk list is freed on return.
+ * If the zone is gone, chunk_list is freed (if non NULL). */
+void zone_write_after_update_reacq(uint8_t* name, size_t namelen,
+	uint16_t dclass, struct module_env* env,
+	struct auth_chunk* chunk_list, struct auth_load_thread* thr);

 /**
 * Use auth zones to lookup the answer to a query.
@@ -857,4 +881,49 @@ int chunkline_count_parens(struct sldns_buffer* buf, size_t start);
 /** Clear data in auth zone */
 void auth_zone_clear_data(struct auth_zone* z);

+/** Get memory usage of auth zone */
+size_t auth_zone_get_mem(struct auth_zone* z);
+
+/** create domain with the given name */
+struct auth_data* az_domain_create(struct auth_zone* z, uint8_t* nm,
+	size_t nmlen);
+
+/** helper traverse to delete zones */
+void auth_data_del(rbnode_type* n, void* arg);
+
+/** Pick up xfr task from wait_transfer resumption. xfr is locked on entry,
+ * unlocked at return. */
+void xfr_pick_up_transfer(struct auth_xfer* xfr, struct module_env* env);
+
+/** Handle the end of an auth load task. */
+void xfr_process_load_end_transfer(struct auth_xfer* xfr,
+	struct module_env* env, uint8_t status, int ixfr_fail,
+	struct timeval* time_taken, struct timeval* time_reload,
+	size_t mem_used, size_t chunks_total, struct auth_chunk* chunk_list);
+
+/** Handle the end of an auth load task to write. */
+void auth_zone_process_load_end_write(struct module_env* env);
+
+/** Log preview of http transfer */
+void xfr_http_preview(const char* file, struct auth_chunk* chunk_list);
+
+/** Check syntax of first part of the http download */
+int xfr_http_syntax_check(uint8_t* name, size_t namelen, uint16_t dclass,
+	const char* host, const char* file, struct auth_chunk* chunk_list,
+	struct sldns_buffer* scratch_buffer);
+
+/** Apply http transfer to auth_zone */
+int xfr_apply_http(uint8_t* name, size_t namelen, const char* host,
+	const char* file, struct auth_chunk* chunk_list, struct auth_zone* z,
+	struct sldns_buffer* scratch_buffer, struct auth_load_thread* thr);
+
+/** Apply IXFR transfer to auth_zone */
+int xfr_apply_ixfr(struct auth_chunk* chunk_list, uint32_t xfr_serial,
+	struct auth_zone* z, struct sldns_buffer* scratch_buffer,
+	struct auth_load_thread* thr);
+
+/** Apply AXFR transfer to auth_zone */
+int xfr_apply_axfr(struct auth_chunk* chunk_list, struct auth_zone* z,
+	struct sldns_buffer* scratch_buffer, struct auth_load_thread* thr);
+
 #endif /* SERVICES_AUTHZONE_H */
@@ -95,7 +95,8 @@ store_rrsets(struct module_env* env, struct reply_info* rep, time_t now,
 		case 2: /* ref updated, cache is superior */
 			if(region) {
 				struct ub_packed_rrset_key* ck;
-				lock_rw_rdlock(&rep->ref[i].key->entry.lock);
+				/* the entry is already readlocked from the
+				 * check in rrset_cache_update. */
 				/* if deleted rrset, do not copy it */
 				if(rep->ref[i].key->id == 0 ||
 					rep->ref[i].id != rep->ref[i].key->id)
@@ -116,6 +117,8 @@ store_rrsets(struct module_env* env, struct reply_info* rep, time_t now,
 						qrep->serve_expired_ttl = qrep->ttl + SERVE_EXPIRED_TTL;
 					}
 				}
+			} else {
+				lock_rw_unlock(&rep->ref[i].key->entry.lock);
 			}
 			/* no break: also copy key item */
 			/* the line below is matched by gcc regex and silences
@@ -677,7 +680,7 @@ tomsg(struct module_env* env, struct query_info* q, struct reply_info* r,
 		rrset_array_unlock(r->ref, r->rrset_count);
 		return NULL;
 	}
-	if(r->security == sec_status_secure && !reply_all_rrsets_secure(r)) {
+	if(r->security == sec_status_secure && !reply_an_ns_rrsets_secure(r)) {
 		/* message rrsets have changed status, revalidate */
 		rrset_array_unlock(r->ref, r->rrset_count);
 		return NULL;
@@ -1208,9 +1211,9 @@ dns_cache_store(struct module_env* env, struct query_info* msgqinf,
 				rep->rrsets[i]->entry.data, *env->now);
 			ref.key = rep->rrsets[i];
 			ref.id = rep->rrsets[i]->id;
-			/*ignore ret: it was in the cache, ref updated */
+			/* if it was in the cache, ref updated */
 			/* no leeway for typeNS */
-			(void)rrset_cache_update(env->rrset_cache, &ref, 
+			rrset_cache_update_unlock(env->rrset_cache, &ref,
 				env->alloc,
 				((ntohs(ref.key->rk.type)==LDNS_RR_TYPE_NS
 				 && !pside) ? qstarttime:*env->now + leeway));
@@ -239,9 +239,13 @@ rrset_cache_update(struct rrset_cache* r, struct rrset_ref* ref,
 			equal, (rrset_type==LDNS_RR_TYPE_NS),
 			(rrset_type==LDNS_RR_TYPE_A || rrset_type==LDNS_RR_TYPE_AAAA))) {
 			/* cache is superior, return that value */
+			if(equal) {
+				ub_packed_rrset_parsedelete(k, alloc);
+				/* return readlocked item. */
+				return 2;
+			}
 			lock_rw_unlock(&e->lock);
 			ub_packed_rrset_parsedelete(k, alloc);
-			if(equal) return 2;
 			return 1;
 		}
 		lock_rw_unlock(&e->lock);
@@ -269,6 +273,15 @@ rrset_cache_update(struct rrset_cache* r, struct rrset_ref* ref,
 	return 0;
 }

+void rrset_cache_update_unlock(struct rrset_cache* r, struct rrset_ref* ref,
+	struct alloc_cache* alloc, time_t timenow)
+{
+	int ret = rrset_cache_update(r, ref, alloc, timenow);
+	if(ret == 2) {
+		lock_rw_unlock(&ref->key->entry.lock);
+	}
+}
+
 /** See if the name is a within signer authority */
 static int
 dname_subdomain_rrsig_signers(uint8_t* dname,
@@ -333,8 +346,8 @@ void rrset_cache_update_wildcard(struct rrset_cache* rrset_cache,
 	rrset->entry.hash = rrset_key_hash(&rrset->rk);
 	ref.key = rrset;
 	ref.id = rrset->id;
-	/* ignore ret: if it was in the cache, ref updated */
-	(void)rrset_cache_update(rrset_cache, &ref, alloc, timenow);
+	/* if it was in the cache, ref updated */
+	rrset_cache_update_unlock(rrset_cache, &ref, alloc, timenow);
 }

 /** Grace period in seconds for TTL=0 DNAME rrsets (RFC 2308: do not cache).
@@ -129,10 +129,16 @@ void rrset_cache_touch(struct rrset_cache* r, struct ub_packed_rrset_key* key,
 * 	1: reference updated, item is inserted in cache.
 * 	2: reference updated, item in cache is considered superior.
 *	   also the rdata is equal (but other parameters in cache are superior).
+ *	   In case 2 the item is returned under a readlock. The caller must
+ *	   unlock.
 */
 int rrset_cache_update(struct rrset_cache* r, struct rrset_ref* ref, 
 	struct alloc_cache* alloc, time_t timenow);

+/** The rrset_cache_update routine that unlocks at end */
+void rrset_cache_update_unlock(struct rrset_cache* r, struct rrset_ref* ref,
+	struct alloc_cache* alloc, time_t timenow);
+
 /**
 * Update or add an rrset in the rrset cache using a wildcard dname.
 * Generates wildcard dname by prepending the wildcard label to the closest
@@ -1341,13 +1341,33 @@ ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp,
 	if((is_doq) && !(is_https || is_ssl)) do_tcp = 0;

 	if(do_auto) {
+		enum listen_type auto_port_type;
 		ub_sock = calloc(1, sizeof(struct unbound_socket));
 		if(!ub_sock)
 			return 0;
+		if(is_dnscrypt) {
+			auto_port_type = listen_type_udpancil_dnscrypt;
+			add = "udpancil_dnscrypt";
+		} else if(is_doq) {
+			auto_port_type = listen_type_doq;
+			add = "doq";
+			if(if_listens_on(ifname, port, 53, NULL)) {
+				log_err("DNS over QUIC is strictly not "
+					"allowed on port 53 as per RFC 9250. "
+					"Port 53 is for DNS datagrams. Error "
+					"for interface '%s'.", ifname);
+				free(ub_sock->addr);
+				free(ub_sock);
+				return 0;
+			}
+		} else {
+			auto_port_type = listen_type_udpancil;
+			add = "udpancil";
+		}
 		if((s = make_sock_port(SOCK_DGRAM, ifname, port, hints, 1,
 			&noip6, rcv, snd, reuseport, transparent,
 			tcp_mss, nodelay, freebind, use_systemd, dscp, ub_sock,
-			(is_dnscrypt?"udpancil_dnscrypt":"udpancil"))) == -1) {
+			add)) == -1) {
 			free(ub_sock->addr);
 			free(ub_sock);
 			if(noip6) {
@@ -1366,9 +1386,7 @@ ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp,
 		if (sock_queue_timeout && !set_recvtimestamp(s)) {
 			log_warn("socket timestamping is not available");
 		}
-		if(!port_insert(list, s, is_dnscrypt
-			?listen_type_udpancil_dnscrypt:listen_type_udpancil,
-			is_pp2, ub_sock)) {
+		if(!port_insert(list, s, auto_port_type, is_pp2, ub_sock)) {
 			sock_close(s);
 			free(ub_sock->addr);
 			free(ub_sock);
@@ -2133,7 +2151,7 @@ void listen_start_accept(struct listen_dnsport* listen)
 }

 struct tcp_req_info*
-tcp_req_info_create(struct sldns_buffer* spoolbuf)
+tcp_req_info_create(struct comm_base* base, struct sldns_buffer* spoolbuf)
 {
 	struct tcp_req_info* req = (struct tcp_req_info*)malloc(sizeof(*req));
 	if(!req) {
@@ -2141,6 +2159,12 @@ tcp_req_info_create(struct sldns_buffer* spoolbuf)
 		return NULL;
 	}
 	memset(req, 0, sizeof(*req));
+	req->read_again_timer = comm_timer_create(base, tcp_read_again_cb, req);
+	if(!req->read_again_timer) {
+		log_err("malloc failure");
+		free(req);
+		return NULL;
+	}
 	req->spool_buffer = spoolbuf;
 	return req;
 }
@@ -2150,6 +2174,7 @@ tcp_req_info_delete(struct tcp_req_info* req)
 {
 	if(!req) return;
 	tcp_req_info_clear(req);
+	comm_timer_delete(req->read_again_timer);
 	/* cp is pointer back to commpoint that owns this struct and
 	 * called delete on us */
 	/* spool_buffer is shared udp buffer, not deleted here */
@@ -2189,6 +2214,9 @@ void tcp_req_info_clear(struct tcp_req_info* req)
 	req->done_req_list = NULL;
 	req->num_done_req = 0;
 	req->read_is_closed = 0;
+
+	if(comm_timer_is_set(req->read_again_timer))
+		comm_timer_disable(req->read_again_timer);
 }

 void
@@ -4504,7 +4532,7 @@ doq_stream_reset_cb(ngtcp2_conn* ATTR_UNUSED(conn), int64_t stream_id,
 			"unknown stream %d", (int)stream_id);
 		return 0;
 	}
-	if(!doq_stream_close(doq_conn, stream, 0))
+	if(!doq_stream_close(doq_conn, stream, 1))
 		return NGTCP2_ERR_CALLBACK_FAILURE;
 	return 0;
 }
@@ -347,6 +347,10 @@ struct tcp_req_info {
 	int num_done_req;
 	/** list of pending writable result packets, malloced one at a time */
 	struct tcp_req_done_item* done_req_list;
+	/** the read again timer, when the number of pipelined TCP queries
+	 * is large, it waits, zero time, for a new event loop to service
+	 * the remainder of the TCP traffic on the fd. */
+	struct comm_timer* read_again_timer;
 };

 /**
@@ -377,10 +381,12 @@ struct tcp_req_done_item {
 * Create tcp request info structure that keeps track of open
 * requests on the TCP channel that are resolved at the same time,
 * and the pending results that have to get written back to that client.
+ * @param base: comm base for read again timer.
 * @param spoolbuf: shared buffer
 * @return new structure or NULL on alloc failure.
 */
-struct tcp_req_info* tcp_req_info_create(struct sldns_buffer* spoolbuf);
+struct tcp_req_info* tcp_req_info_create(struct comm_base* base,
+	struct sldns_buffer* spoolbuf);

 /**
 * Delete tcp request structure.  Called by owning commpoint.
@@ -373,7 +373,7 @@ mesh_serve_expired_lookup(struct module_qstate* qstate,
 			"validation");
 		goto bail_out; /* need to validate cache entry first */
 	} else if(msg->rep->security == sec_status_secure &&
-		!reply_all_rrsets_secure(msg->rep) && must_validate) {
+		!reply_an_ns_rrsets_secure(msg->rep) && must_validate) {
 			verbose(VERB_ALGO, "Serve expired: secure entry"
 				" changed status");
 			goto bail_out; /* rrset changed, re-verify */
@@ -1097,6 +1097,18 @@ mesh_state_make_unique(struct mesh_state* mstate)
 	mstate->unique = mstate;
 }

+/** pop a reply from the reply list, if there are any. */
+static struct mesh_reply*
+mesh_reply_list_pop_first(struct mesh_state* mstate)
+{
+	if(mstate->reply_list) {
+		struct mesh_reply* r = mstate->reply_list;
+		mstate->reply_list = r->next;
+		return r;
+	}
+	return NULL;
+}
+
 void
 mesh_state_cleanup(struct mesh_state* mstate)
 {
@@ -1112,15 +1124,30 @@ mesh_state_cleanup(struct mesh_state* mstate)
 	}
 	/* drop unsent replies */
 	if(!mstate->replies_sent) {
-		struct mesh_reply* rep = mstate->reply_list;
+		struct mesh_reply* rep;
 		struct mesh_cb* cb;
-		/* in tcp_req_info, the mstates linked are removed, but
-		 * the reply_list is now NULL, so the remove-from-empty-list
-		 * takes no time and also it does not do the mesh accounting */
-		mstate->reply_list = NULL;
-		for(; rep; rep=rep->next) {
+		/* Pop items from the list, that means there is no iterator.
+		 * And then items can be removed from the reply list, from
+		 * like comm_point_drop_reply and comm_point_close calls.
+		 * As the tcp_req_info and http2 code drops the entire
+		 * connection. That could delete mesh_reply items previous and
+		 * after the current state. The previous items are already
+		 * popped. And the next items can be altered, like to when a
+		 * connection has more replies on the reply list.
+		 * The current item is also popped so the code needs to
+		 * remove its references. */
+		while((rep = mesh_reply_list_pop_first(mstate)) != NULL) {
 			infra_wait_limit_dec(mesh->env->infra_cache,
 				&rep->query_reply, mesh->env->cfg);
+			if(rep->query_reply.c->tcp_req_info)
+				tcp_req_info_remove_mesh_state(
+					rep->query_reply.c->tcp_req_info,
+					mstate);
+			else if(rep->query_reply.c->use_h2)
+				http2_stream_remove_mesh_state(rep->h2_stream);
+			else if(rep->query_reply.doq_stream)
+				doq_stream_remove_mesh_state(
+					rep->query_reply.doq_stream);
 			comm_point_drop_reply(&rep->query_reply);
 			log_assert(mesh->num_reply_addrs > 0);
 			mesh->num_reply_addrs--;
@@ -1484,12 +1511,6 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
 	struct timeval end_time;
 	struct timeval duration;
 	int secure;
-	/* briefly set the replylist to null in case the
-	 * meshsendreply calls tcpreqinfo sendreply that
-	 * comm_point_drops because of size, and then the
-	 * null stops the mesh state remove and thus
-	 * reply_list modification and accounting */
-	struct mesh_reply* rlist = m->reply_list;

 	/* rpz: apply actions */
 	rcode = mesh_is_udp(r) && mesh_is_rpz_respip_tcponly_action(m)
@@ -1546,9 +1567,7 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
 		sldns_buffer_write_at(r_buffer, 0, &r->qid, sizeof(uint16_t));
 		sldns_buffer_write_at(r_buffer, 12, r->qname,
 			m->s.qinfo.qname_len);
-		m->reply_list = NULL;
 		comm_point_send_reply(&r->query_reply);
-		m->reply_list = rlist;
 	} else if(rcode) {
 		m->s.qinfo.qname = r->qname;
 		m->s.qinfo.local_alias = r->local_alias;
@@ -1570,9 +1589,7 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
 		}
 		error_encode(r_buffer, rcode, &m->s.qinfo, r->qid,
 			r->qflags, &r->edns);
-		m->reply_list = NULL;
 		comm_point_send_reply(&r->query_reply);
-		m->reply_list = rlist;
 	} else {
 		size_t udp_size = r->edns.udp_size;
 		r->edns.edns_version = EDNS_ADVERTISED_VERSION;
@@ -1608,9 +1625,7 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
 			error_encode(r_buffer, LDNS_RCODE_SERVFAIL,
 				&m->s.qinfo, r->qid, r->qflags, &r->edns);
 		}
-		m->reply_list = NULL;
 		comm_point_send_reply(&r->query_reply);
-		m->reply_list = rlist;
 	}
 	infra_wait_limit_dec(m->s.env->infra_cache, &r->query_reply,
 		m->s.env->cfg);
@@ -1762,6 +1777,7 @@ void mesh_query_done(struct mesh_state* mstate)
 	struct reply_info* rep = (mstate->s.return_msg?
 		mstate->s.return_msg->rep:NULL);
 	struct timeval tv = {0, 0};
+	struct mesh_area* mesh = mstate->s.env->mesh;
 	int i = 0;
 	/* No need for the serve expired timer anymore; we are going to reply. */
 	if(mstate->s.serve_expired_data) {
@@ -1786,7 +1802,18 @@ void mesh_query_done(struct mesh_state* mstate)
 		&& (!rep || rep->security != sec_status_secure))
 		dns_error_reporting(&mstate->s, rep);

-	for(r = mstate->reply_list; r; r = r->next) {
+	while((r = mesh_reply_list_pop_first(mstate)) != NULL) {
+
+		/* it was not detached (because it had a reply list), could be now */
+		if(!mstate->reply_list && !mstate->cb_list
+			&& mstate->super_set.count == 0) {
+			mesh->num_detached_states++;
+		}
+		/* if not replies any more in mstate, it is no longer a reply_state */
+		if(!mstate->reply_list && !mstate->cb_list) {
+			log_assert(mesh->num_reply_states > 0);
+			mesh->num_reply_states--;
+		}
 		if(mesh_is_udp(r)) {
 			/* For UDP queries, the old replies are discarded.
 			 * This stops a large volume of old replies from
@@ -1801,22 +1828,18 @@ void mesh_query_done(struct mesh_state* mstate)
 				((int)old.tv_sec)*1000+((int)old.tv_usec)/1000 >
 				mstate->s.env->cfg->discard_timeout) {
 				/* Drop the reply, it is too old */
-				/* briefly set the reply_list to NULL, so that the
-				 * tcp req info cleanup routine that calls the mesh
-				 * to deregister the meshstate for it is not done
-				 * because the list is NULL and also accounting is not
-				 * done there, but instead we do that here. */
-				struct mesh_reply* reply_list = mstate->reply_list;
 				verbose(VERB_ALGO, "drop reply, it is older than discard-timeout");
 				infra_wait_limit_dec(mstate->s.env->infra_cache,
 					&r->query_reply, mstate->s.env->cfg);
-				mstate->reply_list = NULL;
-				if(r->query_reply.c->use_h2)
+				if(r->query_reply.c->tcp_req_info)
+					tcp_req_info_remove_mesh_state(
+						r->query_reply.c->tcp_req_info,
+						mstate);
+				else if(r->query_reply.c->use_h2)
 					http2_stream_remove_mesh_state(r->h2_stream);
 				else if(r->query_reply.doq_stream)
 					doq_stream_remove_mesh_state(r->query_reply.doq_stream);
 				comm_point_drop_reply(&r->query_reply);
-				mstate->reply_list = reply_list;
 				log_assert(mstate->s.env->mesh->num_reply_addrs > 0);
 				mstate->s.env->mesh->num_reply_addrs--;
 				mstate->s.env->mesh->num_queries_discard_timeout++;
@@ -1841,22 +1864,17 @@ void mesh_query_done(struct mesh_state* mstate)
 		/* if this query is determined to be dropped during the
 		 * mesh processing, this is the point to take that action. */
 		if(mstate->s.is_drop) {
-			/* briefly set the reply_list to NULL, so that the
-			 * tcp req info cleanup routine that calls the mesh
-			 * to deregister the meshstate for it is not done
-			 * because the list is NULL and also accounting is not
-			 * done there, but instead we do that here. */
-			struct mesh_reply* reply_list = mstate->reply_list;
 			infra_wait_limit_dec(mstate->s.env->infra_cache,
 				&r->query_reply, mstate->s.env->cfg);
-			mstate->reply_list = NULL;
-			if(r->query_reply.c->use_h2) {
+			if(r->query_reply.c->tcp_req_info) {
+				tcp_req_info_remove_mesh_state(
+					r->query_reply.c->tcp_req_info, mstate);
+			} else if(r->query_reply.c->use_h2) {
 				http2_stream_remove_mesh_state(r->h2_stream);
 			} else if(r->query_reply.doq_stream) {
 				doq_stream_remove_mesh_state(r->query_reply.doq_stream);
 			}
 			comm_point_drop_reply(&r->query_reply);
-			mstate->reply_list = reply_list;
 			log_assert(mstate->s.env->mesh->num_reply_addrs > 0);
 			mstate->s.env->mesh->num_reply_addrs--;
 		} else {
@@ -1897,18 +1915,6 @@ void mesh_query_done(struct mesh_state* mstate)
 		}
 	}

-	/* Mesh area accounting */
-	if(mstate->reply_list) {
-		mstate->reply_list = NULL;
-		if(!mstate->reply_list && !mstate->cb_list) {
-			/* was a reply state, not anymore */
-			log_assert(mstate->s.env->mesh->num_reply_states > 0);
-			mstate->s.env->mesh->num_reply_states--;
-		}
-		if(!mstate->reply_list && !mstate->cb_list &&
-			mstate->super_set.count == 0)
-			mstate->s.env->mesh->num_detached_states++;
-	}
 	mstate->replies_sent = 1;

 	while((c = mstate->cb_list) != NULL) {
@@ -2498,7 +2504,6 @@ void mesh_state_remove_reply(struct mesh_area* mesh, struct mesh_state* m,
 	}
 }

-
 static int
 apply_respip_action(struct module_qstate* qstate,
 	const struct query_info* qinfo, struct respip_client_info* cinfo,
@@ -2631,7 +2636,18 @@ mesh_serve_expired_callback(void* arg)
 	if(verbosity >= VERB_ALGO)
 		log_dns_msg("Serve expired lookup", &qstate->qinfo, msg->rep);

-	for(r = mstate->reply_list; r; r = r->next) {
+	while((r = mesh_reply_list_pop_first(mstate)) != NULL) {
+
+		/* it was not detached (because it had a reply list), could be now */
+		if(!mstate->reply_list && !mstate->cb_list
+			&& mstate->super_set.count == 0) {
+			mesh->num_detached_states++;
+		}
+		/* if not replies any more in mstate, it is no longer a reply_state */
+		if(!mstate->reply_list && !mstate->cb_list) {
+			log_assert(mesh->num_reply_states > 0);
+			mesh->num_reply_states--;
+		}
 		if(mesh_is_udp(r)) {
 		    struct timeval old;
 		    timeval_subtract(&old, mstate->s.env->now_tv, &r->start_time);
@@ -2639,22 +2655,17 @@ mesh_serve_expired_callback(void* arg)
 			((int)old.tv_sec)*1000+((int)old.tv_usec)/1000 >
 			mstate->s.env->cfg->discard_timeout) {
 			/* Drop the reply, it is too old */
-			/* briefly set the reply_list to NULL, so that the
-			 * tcp req info cleanup routine that calls the mesh
-			 * to deregister the meshstate for it is not done
-			 * because the list is NULL and also accounting is not
-			 * done there, but instead we do that here. */
-			struct mesh_reply* reply_list = mstate->reply_list;
 			verbose(VERB_ALGO, "drop reply, it is older than discard-timeout");
 			infra_wait_limit_dec(mstate->s.env->infra_cache,
 				&r->query_reply, mstate->s.env->cfg);
-			mstate->reply_list = NULL;
-			if(r->query_reply.c->use_h2)
+			if(r->query_reply.c->tcp_req_info)
+				tcp_req_info_remove_mesh_state(
+					r->query_reply.c->tcp_req_info, mstate);
+			else if(r->query_reply.c->use_h2)
 				http2_stream_remove_mesh_state(r->h2_stream);
 			else if(r->query_reply.doq_stream)
 				doq_stream_remove_mesh_state(r->query_reply.doq_stream);
 			comm_point_drop_reply(&r->query_reply);
-			mstate->reply_list = reply_list;
 			log_assert(mstate->s.env->mesh->num_reply_addrs > 0);
 			mstate->s.env->mesh->num_reply_addrs--;
 			mstate->s.env->mesh->num_queries_discard_timeout++;
@@ -2692,8 +2703,7 @@ mesh_serve_expired_callback(void* arg)
 		if(r->query_reply.c->tcp_req_info)
 			tcp_req_info_remove_mesh_state(r->query_reply.c->tcp_req_info, mstate);
 		/* mesh_send_reply removed mesh state from http2_stream. */
-		infra_wait_limit_dec(mstate->s.env->infra_cache,
-			&r->query_reply, mstate->s.env->cfg);
+		/* mesh_send_reply decremented wait_limit. */
 		prev = r;
 		prev_buffer = r_buffer;
 	}
@@ -2712,18 +2722,6 @@ mesh_serve_expired_callback(void* arg)
 		}
 	}

-	/* Mesh area accounting */
-	if(mstate->reply_list) {
-		mstate->reply_list = NULL;
-		if(!mstate->reply_list && !mstate->cb_list) {
-			log_assert(mesh->num_reply_states > 0);
-			mesh->num_reply_states--;
-			if(mstate->super_set.count == 0) {
-				mesh->num_detached_states++;
-			}
-		}
-	}
-
 	while((c = mstate->cb_list) != NULL) {
 		/* take this cb off the list; so that the list can be
 		 * changed, eg. by adds from the callback routine */
@@ -506,24 +506,37 @@ delete_cname_override(struct rpz* r)
 static int
 rpz_apply_cfg_elements(struct rpz* r, struct config_auth* p)
 {
+	enum rpz_action action_override;
 	if(p->rpz_taglist && p->rpz_taglistlen) {
-		r->taglistlen = p->rpz_taglistlen;
-		r->taglist = memdup(p->rpz_taglist, r->taglistlen);
-		if(!r->taglist) {
+		uint8_t* taglist = memdup(p->rpz_taglist, p->rpz_taglistlen);
+		if(!taglist) {
 			log_err("malloc failure on RPZ taglist alloc");
 			return 0;
 		}
+		if(r->taglist)
+			free(r->taglist);
+		r->taglist = taglist;
+		r->taglistlen = p->rpz_taglistlen;
+	} else {
+		/* free taglist, if any */
+		if(r->taglist) {
+			free(r->taglist);
+			r->taglist = NULL;
+			r->taglistlen = 0;
+		}
 	}

 	if(p->rpz_action_override) {
-		r->action_override = rpz_config_to_action(p->rpz_action_override);
+		action_override = rpz_config_to_action(p->rpz_action_override);
 	}
 	else
-		r->action_override = RPZ_NO_OVERRIDE_ACTION;
+		action_override = RPZ_NO_OVERRIDE_ACTION;

-	if(r->action_override == RPZ_CNAME_OVERRIDE_ACTION) {
+	if(action_override == RPZ_CNAME_OVERRIDE_ACTION) {
 		uint8_t nm[LDNS_MAX_DOMAINLEN+1];
 		size_t nmlen = sizeof(nm);
+		struct regional* newr;
+		struct ub_packed_rrset_key* cname_override;

 		if(!p->rpz_cname) {
 			log_err("rpz: override with cname action found, but no "
@@ -536,33 +549,50 @@ rpz_apply_cfg_elements(struct rpz* r, struct config_auth* p)
 				p->rpz_cname);
 			return 0;
 		}
-		r->cname_override = new_cname_override(r->region, nm, nmlen);
-		if(!r->cname_override) {
+		newr = regional_create_custom(sizeof(struct regional));
+		if(!newr) {
+			log_err("malloc failure on RPZ cname override region");
 			return 0;
 		}
+		cname_override = new_cname_override(newr, nm, nmlen);
+		if(!cname_override) {
+			regional_destroy(newr);
+			return 0;
+		}
+		regional_destroy(r->region);
+		r->region = newr;
+		r->cname_override = cname_override;
+	} else {
+		delete_cname_override(r);
 	}
+	r->action_override = action_override;
 	r->log = p->rpz_log;
 	r->signal_nxdomain_ra = p->rpz_signal_nxdomain_ra;
 	if(p->rpz_log_name) {
-		if(!(r->log_name = strdup(p->rpz_log_name))) {
+		char* log_name = strdup(p->rpz_log_name);
+		if(!log_name) {
 			log_err("malloc failure on RPZ log_name strdup");
 			return 0;
 		}
+		if(r->log_name)
+			free(r->log_name);
+		r->log_name = log_name;
+	} else {
+		/* free logname, if any */
+		if(r->log_name) {
+			free(r->log_name);
+			r->log_name = NULL;
+		}
 	}
 	return 1;
 }

 struct rpz*
-rpz_create(struct config_auth* p)
+rpz_create_empty(void)
 {
 	struct rpz* r = calloc(1, sizeof(*r));
 	if(!r)
-		goto err;
-
-	r->region = regional_create_custom(sizeof(struct regional));
-	if(!r->region) {
-		goto err;
-	}
+		return NULL;

 	if(!(r->local_zones = local_zones_create())){
 		goto err;
@@ -586,6 +616,35 @@ rpz_create(struct config_auth* p)
 	if(r->ns_set == NULL) {
 		goto err;
 	}
+	return r;
+err:
+	if(r) {
+		if(r->local_zones)
+			local_zones_delete(r->local_zones);
+		if(r->nsdname_zones)
+			local_zones_delete(r->nsdname_zones);
+		if(r->respip_set)
+			respip_set_delete(r->respip_set);
+		if(r->client_set != NULL)
+			rpz_clientip_synthesized_set_delete(r->client_set);
+		if(r->ns_set != NULL)
+			rpz_clientip_synthesized_set_delete(r->ns_set);
+		free(r);
+	}
+	return NULL;
+}
+
+struct rpz*
+rpz_create(struct config_auth* p)
+{
+	struct rpz* r = rpz_create_empty();
+	if(!r)
+		goto err;
+
+	r->region = regional_create_custom(sizeof(struct regional));
+	if(!r->region) {
+		goto err;
+	}

 	if(!rpz_apply_cfg_elements(r, p))
 		goto err;
@@ -616,22 +675,6 @@ rpz_config(struct rpz* r, struct config_auth* p)
 {
 	/* If the zonefile changes, it is read later, after which
 	 * rpz_clear and rpz_finish_config is called. */
-
-	/* free taglist, if any */
-	if(r->taglist) {
-		free(r->taglist);
-		r->taglist = NULL;
-		r->taglistlen = 0;
-	}
-
-	/* free logname, if any */
-	if(r->log_name) {
-		free(r->log_name);
-		r->log_name = NULL;
-	}
-
-	delete_cname_override(r);
-
 	if(!rpz_apply_cfg_elements(r, p))
 		return 0;
 	return 1;
@@ -2078,6 +2121,7 @@ rpz_synthesize_localdata_from_rrset(struct rpz* ATTR_UNUSED(r), struct module_qs
 	 * actual data. So that the actual network data and fake data
 	 * are kept track of separately. */
 	rp->rk.flags |= PACKED_RRSET_RPZ;
+	rp->entry.hash = rrset_key_hash(&rp->rk);
 	new_reply_info->rrsets[0] = rp;
 	msg->rep = new_reply_info;
 	if(!rpz_add_soa(msg->rep, ms, az))
@@ -2243,6 +2287,7 @@ rpz_synthesize_cname_override_msg(struct rpz* r, struct module_qstate* ms,
 	 * actual data. So that the actual network data and fake data
 	 * are kept track of separately. */
 	rp->rk.flags |= PACKED_RRSET_RPZ;
+	rp->entry.hash = rrset_key_hash(&rp->rk);
 	new_reply_info->rrsets[0] = rp;

 	msg->rep = new_reply_info;
@@ -2849,7 +2894,8 @@ size_t rpz_get_mem(struct rpz* r)
 		m += r->taglistlen;
 	if(r->log_name)
 		m += strlen(r->log_name) + 1;
-	m += regional_get_mem(r->region);
+	if(r->region)
+		m += regional_get_mem(r->region);
 	m += local_zones_get_mem(r->local_zones);
 	m += local_zones_get_mem(r->nsdname_zones);
 	m += respip_set_get_mem(r->respip_set);
@@ -219,6 +219,9 @@ void rpz_delete(struct rpz* r);
 */
 int rpz_clear(struct rpz* r);

+/** Create empty RPZ structure, useful as a proxy for entering data. */
+struct rpz* rpz_create_empty(void);
+
 /**
 * Create RPZ. RPZ must be added to linked list after creation.
 * @return: the newly created RPZ
@@ -197,6 +197,8 @@ sldns_fget_token_l(FILE *f, char *token, const char *delim, size_t limit, int *l
 	}
 	*t = '\0';
 	if (c == EOF) {
+		if(p != 0 || quoted)
+			return -1;
 		return (ssize_t)i;
 	}

@@ -842,8 +842,7 @@ rrinternal_parse_rdata(sldns_buffer* strbuf, char* token, size_t token_len,
 	sldns_write_uint16(rr+dname_len+8, (uint16_t)(rr_cur_len-dname_len-10));
 	*rr_len = rr_cur_len;
 	/* SVCB/HTTPS handling  */
-	if ((rr_type == LDNS_RR_TYPE_SVCB || rr_type == LDNS_RR_TYPE_HTTPS)
-		&& !was_unknown_rr_format) {
+	if (rr_type == LDNS_RR_TYPE_SVCB || rr_type == LDNS_RR_TYPE_HTTPS) {
 		size_t rdata_len = rr_cur_len - dname_len - 10;
 		uint8_t *rdata = rr+dname_len + 10;

@@ -875,7 +874,14 @@ rrinternal_parse_rdata(sldns_buffer* strbuf, char* token, size_t token_len,

 		rdata_len -= 1;
 		rdata += 1;
-		return sldns_str2wire_check_svcbparams(rdata, rdata_len);
+		status = sldns_str2wire_check_svcbparams(rdata, rdata_len);
+		/* For RFC3597 generic-form input, preserve unprintable records.
+		 * Those could have appeared due to secondary zones, and also
+		 * unbound writing invalid-format records out in generic form.
+		 * If it can be parsed, it fixes the svcparam ordering. */
+		if(was_unknown_rr_format && status != LDNS_WIREPARSE_ERR_OK)
+			status = LDNS_WIREPARSE_ERR_OK;
+		return status;

 	}
 	return LDNS_WIREPARSE_ERR_OK;
@@ -2304,6 +2310,8 @@ int sldns_str2wire_loc_buf(const char* str, uint8_t* rd, size_t* len)

 	if (isdigit((unsigned char) *my_str)) {
 		s = strtod(my_str, &my_str);
+		if(s > 60.0)
+			return LDNS_WIREPARSE_ERR_SYNTAX;
 	}

 	/* skip blanks before northerness */
@@ -2362,6 +2370,8 @@ north:

 	if (isdigit((unsigned char) *my_str)) {
 		s = strtod(my_str, &my_str);
+		if(s > 60.0)
+			return LDNS_WIREPARSE_ERR_SYNTAX;
 	}

 	/* skip blanks before easterness */
@@ -2394,8 +2404,17 @@ east:
 		longitude = equator - longitude;
 	}

-	altitude = (uint32_t)(strtod(my_str, &my_str)*100.0 +
-		10000000.0 + 0.5);
+	while (isblank((unsigned char) *my_str)) {
+		my_str++;
+	}
+
+	/* altitude */
+	if(!(isdigit((unsigned char) *my_str) || *my_str == '-'))
+		return LDNS_WIREPARSE_ERR_SYNTAX;
+	s = strtod(my_str, &my_str);
+	if(s < -100000.0 || s > 42849672.95)
+		return LDNS_WIREPARSE_ERR_SYNTAX;
+	altitude = (uint32_t)(s*100.0 + 10000000.0 + 0.5);
 	if (*my_str == 'm' || *my_str == 'M') {
 		my_str++;
 	}
@@ -264,6 +264,9 @@ setup_config(FILE* in, int* lineno, int* pass_argc, char* pass_argv[])
 	fprintf(cfg, "		pidfile: \"\"\n");
 	fprintf(cfg, "		val-log-level: 2\n");
 	fprintf(cfg, "		log-servfail: yes\n");
+	/* the extra thread needs pipe communication that is not available
+	 * from fake_event calls. So auth-task-threads: 0 disables them. */
+	fprintf(cfg, "		auth-task-threads: 0\n");
 	fprintf(cfg, "remote-control:	control-enable: no\n");
 	while(fgets(line, MAX_LINE_LEN-1, in)) {
 		parse = line;
@@ -786,3 +789,13 @@ size_t doq_table_quic_size_get(struct doq_table* ATTR_UNUSED(table))
 	return 0;
 }
 #endif
+
+void tcp_read_again_cb(void* ATTR_UNUSED(arg))
+{
+	/* nothing */
+}
+
+void tcp_more_read_again_cb(void* ATTR_UNUSED(arg))
+{
+	/* nothing */
+}
@@ -387,7 +387,7 @@ hex_buffer2wire(sldns_buffer *data_buffer)
 	uint8_t *wire = (uint8_t*)malloc(MAX_PACKETLEN);
 	if(!wire) error("out of memory");
 	
-	hexbuf = (uint8_t*)malloc(MAX_PACKETLEN);
+	hexbuf = (uint8_t*)malloc(MAX_PACKETLEN * 2);
 	if(!hexbuf) error("out of memory");
 	for (data_buf_pos = 0; data_buf_pos < sldns_buffer_position(data_buffer); data_buf_pos++) {
 		c = (int) data_wire[data_buf_pos];
@@ -402,7 +402,7 @@ hex_buffer2wire(sldns_buffer *data_buffer)
 					(c >= 'a' && c <= 'f') ||
 					(c >= 'A' && c <= 'F') )
 				{
-					if (hexbufpos >= MAX_PACKETLEN) {
+					if (hexbufpos >= MAX_PACKETLEN * 2) {
 						error("buffer overflow");
 						free(hexbuf);
 						return 0;
@@ -422,7 +422,7 @@ hex_buffer2wire(sldns_buffer *data_buffer)
 				}
 				break;
 			case 2:
-				if (hexbufpos >= MAX_PACKETLEN) {
+				if (hexbufpos >= MAX_PACKETLEN * 2) {
 					error("buffer overflow");
 					free(hexbuf);
 					return 0;
@@ -433,13 +433,13 @@ hex_buffer2wire(sldns_buffer *data_buffer)
 		}
 	}

-	if (hexbufpos >= MAX_PACKETLEN) {
+	if (hexbufpos >= MAX_PACKETLEN * 2) {
 		/*verbose("packet size reached\n");*/
 	}
 	
 	/* lenient mode: length must be multiple of 2 */
 	if (hexbufpos % 2 != 0) {
-		if (hexbufpos >= MAX_PACKETLEN) {
+		if (hexbufpos >= MAX_PACKETLEN * 2) {
 			error("buffer overflow");
 			free(hexbuf);
 			return 0;
@@ -630,7 +630,7 @@ read_entry(FILE* in, const char* name, struct sldns_file_parse_state* pstate,
 				add_section = LDNS_SECTION_ADDITIONAL;
 			else error("%s line %d: bad section %s", name, pstate->lineno, parse);
 		} else if(str_keyword(&parse, "HEX_ANSWER_BEGIN")) {
-			hex_data_buffer = sldns_buffer_new(MAX_PACKETLEN);
+			hex_data_buffer = sldns_buffer_new(MAX_PACKETLEN*2);
 			reading_hex = 1;
 		} else if(str_keyword(&parse, "HEX_ANSWER_END")) {
 			if(!reading_hex) {
@@ -643,7 +643,7 @@ read_entry(FILE* in, const char* name, struct sldns_file_parse_state* pstate,
 		} else if(reading_hex) {
 			sldns_buffer_printf(hex_data_buffer, "%s", line);
 		} else if(str_keyword(&parse, "HEX_EDNSDATA_BEGIN")) {
-			hex_ednsdata_buffer = sldns_buffer_new(MAX_PACKETLEN);
+			hex_ednsdata_buffer = sldns_buffer_new(MAX_PACKETLEN*2);
 			reading_hex_ednsdata = 1;
 		} else if(str_keyword(&parse, "HEX_EDNSDATA_END")) {
 			if (!reading_hex_ednsdata) {
@@ -735,7 +735,7 @@ check_read_exact(const char* name, const char* zone)
 	z = authtest_addzone(az, name, fname);
 	unit_assert(z);
 	outf = create_tmp_file(NULL);
-	if(!auth_zone_write_file(z, outf)) {
+	if(!auth_zone_write_file(z, outf, NULL)) {
 		fatal_exit("write file failed for %s", fname);
 	}
 	checkfile(fname, outf);
@@ -1337,6 +1337,89 @@ static void mesh_test(void)
 	free(c1);
 }

+#include "util/data/packed_rrset.h"
+#include "sldns/sbuffer.h"
+/** packed_rrset unit tests */
+static void packed_rrset_test(void)
+{
+	/* packed_rr_to_string assembles the dname, type, class, ttl and
+	 * rdata of one rr into a buffer of 65535 bytes.  Check that it
+	 * refuses an rr that does not fit in there, also when the caller
+	 * passes a dest_len that is larger than that, like the callers in
+	 * daemon/cachedump.c and daemon/remote.c do.  Without the check it
+	 * writes past the end of the assembly buffer. */
+	uint8_t smalldname[] = "\003www\007example\003com";
+	uint8_t smallrdata[] = {0, 4, 1, 2, 3, 4};
+	uint8_t maxdname[LDNS_MAX_DOMAINLEN];
+	struct ub_packed_rrset_key rrk;
+	struct packed_rrset_data d;
+	uint8_t* rr_data[1];
+	size_t rr_len[1];
+	time_t rr_ttl[1];
+	size_t dest_len = 65535*4+2048; /* the size daemon/cachedump.c uses */
+	char* dest = (char*)malloc(dest_len);
+	int i;
+
+	unit_show_func("util/data/packed_rrset.c", "packed_rr_to_string");
+	if(!dest) fatal_exit("out of memory");
+	memset(&rrk, 0, sizeof(rrk));
+	memset(&d, 0, sizeof(d));
+	rrk.entry.data = &d;
+	rrk.rk.rrset_class = htons(LDNS_RR_CLASS_IN);
+	d.count = 1;
+	d.rr_len = rr_len;
+	d.rr_ttl = rr_ttl;
+	d.rr_data = rr_data;
+	rr_ttl[0] = 3600;
+
+	/* an ordinary rr is printed, also with the large dest_len */
+	rrk.rk.dname = smalldname;
+	rrk.rk.dname_len = sizeof(smalldname);
+	rrk.rk.type = htons(LDNS_RR_TYPE_A);
+	rr_data[0] = smallrdata;
+	rr_len[0] = sizeof(smallrdata);
+	unit_assert(packed_rr_to_string(&rrk, 0, 0, dest, dest_len) == 1);
+	unit_assert(strstr(dest, "1.2.3.4") != NULL);
+
+	/* a dname of the maximum length, 127 labels of one character */
+	for(i=0; i<127; i++) {
+		maxdname[i*2] = 1;
+		maxdname[i*2+1] = (uint8_t)'a';
+	}
+	maxdname[254] = 0;
+	rrk.rk.dname = maxdname;
+	rrk.rk.dname_len = sizeof(maxdname);
+	rrk.rk.type = htons(LDNS_RR_TYPE_TXT);
+
+	/* 255+2+2+4+65272 is exactly 65535, that still fits */
+	rr_len[0] = 65535 - 255 - 8;
+	rr_data[0] = (uint8_t*)calloc(1, rr_len[0]);
+	if(!rr_data[0]) fatal_exit("out of memory");
+	sldns_write_uint16(rr_data[0], (uint16_t)(rr_len[0]-2));
+	unit_assert(packed_rr_to_string(&rrk, 0, 0, dest, dest_len) == 1);
+	free(rr_data[0]);
+
+	/* one more byte of rdata does not fit and must be refused */
+	rr_len[0] = 65535 - 255 - 8 + 1;
+	rr_data[0] = (uint8_t*)calloc(1, rr_len[0]);
+	if(!rr_data[0]) fatal_exit("out of memory");
+	sldns_write_uint16(rr_data[0], (uint16_t)(rr_len[0]-2));
+	unit_assert(packed_rr_to_string(&rrk, 0, 0, dest, dest_len) == 0);
+	unit_assert(dest[0] == 0);
+	free(rr_data[0]);
+
+	/* the largest rdata an rr can hold, well over the buffer */
+	rr_len[0] = 2 + 65535;
+	rr_data[0] = (uint8_t*)calloc(1, rr_len[0]);
+	if(!rr_data[0]) fatal_exit("out of memory");
+	sldns_write_uint16(rr_data[0], 65535);
+	unit_assert(packed_rr_to_string(&rrk, 0, 0, dest, dest_len) == 0);
+	unit_assert(dest[0] == 0);
+	free(rr_data[0]);
+
+	free(dest);
+}
+
 void unit_show_func(const char* file, const char* func)
 {
 	printf("test %s:%s\n", file, func);
@@ -1409,6 +1492,7 @@ main(int argc, char* argv[])
 	zonemd_test();
 	tcpreuse_test();
 	msgparse_test();
+	packed_rrset_test();
 	edns_ede_answer_encode_test();
 	localzone_test();
 	mesh_test();
@@ -196,7 +196,7 @@ verifytest_rrset(struct module_env* env, struct val_env* ve,
 	setup_sigalg(dnskey, sigalg); /* check all algorithms in the dnskey */
 	/* ok to give null as qstate here, won't be used for answer section. */
 	sec = dnskeyset_verify_rrset(env, ve, rrset, dnskey, sigalg, &reason,
-		NULL, LDNS_SECTION_ANSWER, NULL, &verified, reasonbuf,
+		NULL, LDNS_SECTION_ANSWER, NULL, NULL, &verified, reasonbuf,
 		sizeof(reasonbuf));
 	if(vsig) {
 		printf("verify outcome is: %s %s\n", sec_status_to_string(sec),
@@ -510,6 +510,146 @@ nsec3_hash_test(const char* fname)
 	sldns_buffer_free(buf);
 }

+/** Test the rrset_canonicalize_to_buffer function to see if the
+ * size of canon_owner name is properly checked for. */
+static void
+canon_owner_buf_test(void)
+{
+	struct regional* region;
+	sldns_buffer* buf;
+	struct ub_packed_rrset_key k;
+	struct packed_rrset_data d;
+	size_t rr_len[2];
+	time_t rr_ttl[2];
+	uint8_t* rr_data[2];
+	int ret;
+	unit_show_func("validator/val_sigcrypt.c",
+		"rrset_canonicalize_to_buffer");
+	region = regional_create();
+	if(!region)
+		fatal_exit("out of memory");
+	/* Purposefully a very small buffer, to overflow it */
+	buf = sldns_buffer_new(28);
+	if(!buf)
+		fatal_exit("out of memory");
+
+	/* An RRset to canonicalize. The buffer is made smaller, so
+	 * it can fail on bounds checks. */
+	memset(&d, 0, sizeof(d));
+	d.ttl = 3600;
+	d.count = 1;
+	d.rrsig_count = 1;
+	d.rr_len = rr_len;
+	d.rr_ttl = rr_ttl;
+	d.rr_data = rr_data;
+	rr_len[0] = 18;
+	rr_len[1] = 36;
+	rr_ttl[0] = 3600;
+	rr_ttl[1] = 3600;
+	rr_data[0] = (uint8_t*)"\x00\x10\x0Fzzaaaaaaaaaaaaa";
+	rr_data[1] = (uint8_t*)"\x00\x24\x00\x06\x08\x3\x01\x02\x03\x04\x01\x02\x03\x04\x01\x02\x03\x04\x12\x34\x03zzz\x00zzaaaaaaaaaaa";
+
+	memset(&k, 0, sizeof(k));
+	k.rk.dname = (uint8_t*) "\x0f" "aaaaaaaaaaaaaaa" "\x00";
+	k.rk.dname_len = 17;
+	k.rk.type = htons(LDNS_RR_TYPE_TXT);
+	k.rk.rrset_class = htons(LDNS_RR_CLASS_IN);
+	k.entry.data = &d;
+
+	/* There should be no buffer overflow, assertion failure, here */
+	ret = rrset_canonicalize_to_buffer(region, buf, &k);
+	unit_assert(ret == 0);
+
+	regional_destroy(region);
+	sldns_buffer_free(buf);
+}
+
+/** Test if ds_digest_match_dnskey that calls ds_create_dnskey_digest,
+ * checks the buffer size. */
+static void
+dnskey_ds_digest_test(void)
+{
+	struct regional* region;
+	sldns_buffer* buf;
+	struct module_env env;
+	struct ub_packed_rrset_key k1, k2;
+	struct packed_rrset_data d1, d2;
+	size_t rr_len1[1], rr_len2[1];
+	time_t rr_ttl1[1], rr_ttl2[1];
+	uint8_t* rr_rdata1[1], *rr_rdata2[1];
+	int ret;
+	unit_show_func("validator/val_sigcrypt.c", "ds_digest_match_dnskey");
+	region = regional_create();
+	if(!region)
+		fatal_exit("out of memory");
+	/* Purposefully a very small buffer, to overflow it */
+	buf = sldns_buffer_new(28);
+	if(!buf)
+		fatal_exit("out of memory");
+	memset(&env, 0, sizeof(env));
+	env.scratch = region;
+	env.scratch_buffer = buf;
+
+	/* A DNSKEY and DS RRset to match together. The buffer is made
+	 * smaller, so it can fail on bounds checks. */
+	memset(&d1, 0, sizeof(d1));
+	d1.ttl = 3600;
+	d1.count = 1;
+	d1.rr_len = rr_len1;
+	d1.rr_ttl = rr_ttl1;
+	d1.rr_data = rr_rdata1;
+	rr_len1[0] = 38;
+	rr_ttl1[0] = 3600;
+	/* DS rdata has: keytag (2bytes), algorithm (1byte),
+	 * digesttype (1byte), digest (remainder). */
+	rr_rdata1[0] = (uint8_t*)"\x00\x24"
+		"\x12\x34"
+		"\x08" /* RSASHA256 */
+		"\x02" /* SHA256 */
+		"0123456789abcdef0123456789abcdef"; /* 32 bytes */
+		;
+
+	memset(&k1, 0, sizeof(k1));
+	k1.rk.dname = (uint8_t*) "\x03" "foo" "\x00";
+	k1.rk.dname_len = 5;
+	k1.rk.type = htons(LDNS_RR_TYPE_DS);
+	k1.rk.rrset_class = htons(LDNS_RR_CLASS_IN);
+	k1.entry.data = &d1;
+
+	memset(&d2, 0, sizeof(d2));
+	d2.ttl = 3600;
+	d2.count = 1;
+	d2.rr_len = rr_len2;
+	d2.rr_ttl = rr_ttl2;
+	d2.rr_data = rr_rdata2;
+	rr_len2[0] = 38;
+	rr_ttl2[0] = 3600;
+	/* DNSKEY rdata has: flags (2bytes), protocol (1byte),
+	 * algorithm (1byte), publickey (remainder). */
+	rr_rdata2[0] = (uint8_t*)"\x00\x24"
+		"\x01\x01" /* KSK */
+		"\x03" /* DNSSEC_KEYPROTO */
+		"\x08" /* RSASHA256 */
+		"0123456789abcdef0123456789abcdef"; /* 32 bytes of content */
+		;
+
+	memset(&k2, 0, sizeof(k2));
+	k2.rk.dname = (uint8_t*) "\x03" "foo" "\x00";
+	k2.rk.dname_len = 5;
+	k2.rk.type = htons(LDNS_RR_TYPE_DNSKEY);
+	k2.rk.rrset_class = htons(LDNS_RR_CLASS_IN);
+	k2.entry.data = &d2;
+	/* 36 byte rdata length for DNSKEY (38-2), and dname length of 5,
+	 * exceeds the (small) buffer size. */
+
+	/* There should be no buffer overflow, assertion failure, here */
+	ret = ds_digest_match_dnskey(&env, &k2, 0, &k1, 0);
+	unit_assert(ret == 0);
+
+	regional_destroy(region);
+	sldns_buffer_free(buf);
+}
+
 #define xstr(s) str(s)
 #define str(s) #s

@@ -724,4 +864,6 @@ verify_test(void)
 #endif
 	nsectest();
 	nsec3_hash_test(SRCDIRSTR "/testdata/test_nsec3_hash.1");
+	dnskey_ds_digest_test();
+	canon_owner_buf_test();
 }
@@ -85,6 +85,15 @@ for input in $PRE/testdata/*.rpl $PRE/testdata/*.crpl; do
 		fi
 	fi

+	# detect if ECDSA is needed
+	if echo $cleaninput | grep ecdsa >/dev/null 2>&1; then
+		if $PRE/testbound -e >/dev/null 2>&1; then
+			: # ECDSA is supported
+		else
+			continue
+		fi
+	fi
+
 	# detect if CLIENT_SUBNET is needed
 	if echo $cleaninput | grep subnet >/dev/null 2>&1; then
 		if $PRE/testbound -c >/dev/null 2>&1; then
@@ -0,0 +1,18 @@
+server:
+	verbosity: 8
+	# num-threads: 1
+	interface: 127.0.0.1
+	port: @PORT@
+	use-syslog: no
+	directory: ""
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+	auth-task-threads: 1
+auth-zone:
+	name: "example.com"
+	for-upstream: yes
+	for-downstream: yes
+	master: "127.0.0.1@@TOPORT@"
+
@@ -0,0 +1,16 @@
+BaseName: auth_load
+Version: 1.0
+Description: Perform AXFR for authority zone with auth load thread
+CreationDate: Thu 2 Jul 09:35:40 CEST 2026
+Maintainer: dr. W.C.A. Wijngaards
+Category:
+Component:
+CmdDepends:
+Depends:
+Help:
+Pre: auth_load.pre
+Post: auth_load.post
+Test: auth_load.test
+AuxFiles:
+Passed:
+Failure:
@@ -0,0 +1,12 @@
+# #-- auth_load.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+kill_pid $FWD_PID
+kill_pid $UNBOUND_PID
+cat fwd.log
+cat unbound.log
@@ -0,0 +1,39 @@
+# #-- auth_load.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+. ../common.sh
+# if no threads; exit
+if grep -e "define HAVE_PTHREAD 1" -e "define HAVE_SOLARIS_THREADS 1" -e "define HAVE_WINDOWS_THREADS 1" $PRE/config.h; then
+	echo "have threads"
+else
+	skip_test "no threads"
+fi
+
+get_random_port 2
+UNBOUND_PORT=$RND_PORT
+FWD_PORT=$(($RND_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+
+# start forwarder
+get_ldns_testns
+$LDNS_TESTNS -p $FWD_PORT auth_load.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+# make config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' < auth_load.conf > ub.conf
+# start unbound in the background
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+#valgrind --leak-check=full --show-reachable=yes $PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_ldns_testns_up fwd.log
+wait_unbound_up unbound.log
+
@@ -0,0 +1,55 @@
+# #-- auth_load.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+# do the test
+echo "> dig www.example.com."
+dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 1
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 1
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 1
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 3
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 3
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+echo "> check answer"
+if grep "1.2.3.4" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+if grep "auth zone example.com. details" unbound.log; then
+	echo "OK"
+else
+	echo "not OK"
+	exit 1
+fi
+
+exit 0
@@ -0,0 +1,27 @@
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+example.com. IN SOA
+SECTION ANSWER
+example.com. IN SOA ns.example.com. hostmaster.example.com. 1 3600 900 86400 3600
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+example.com. IN AXFR
+SECTION ANSWER
+example.com. IN SOA ns.example.com. hostmaster.example.com. 1 3600 900 86400 3600
+example.com.	IN NS	ns.example.net.
+EXTRA_PACKET
+REPLY QR AA NOERROR
+SECTION QUESTION
+example.com. IN AXFR
+SECTION ANSWER
+www.example.com. IN A	1.2.3.4
+example.com. IN SOA ns.example.com. hostmaster.example.com. 1 3600 900 86400 3600
+ENTRY_END
@@ -0,0 +1,3 @@
+example.com. IN SOA ns.example.com. hostmaster.example.com. 1 3600 900 86400 3600
+example.com.	IN NS	ns.example.net.
+www.example.com. IN A	1.2.3.4
@@ -0,0 +1,18 @@
+server:
+	verbosity: 8
+	# num-threads: 1
+	interface: 127.0.0.1
+	port: @PORT@
+	use-syslog: no
+	directory: ""
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+	auth-task-threads: 1
+auth-zone:
+	name: "example.com"
+	for-upstream: yes
+	for-downstream: yes
+	url: "https://127.0.0.1:@TOPORT@/example.com.zone"
+
@@ -0,0 +1,16 @@
+BaseName: auth_load_http
+Version: 1.0
+Description: Perform http transfer for authority zone with auth load thread
+CreationDate: Tue 11 Aug 16:00:00 CEST 2026
+Maintainer: dr. W.C.A. Wijngaards
+Category:
+Component:
+CmdDepends:
+Depends:
+Help:
+Pre: auth_load_http.pre
+Post: auth_load_http.post
+Test: auth_load_http.test
+AuxFiles:
+Passed:
+Failure:
@@ -0,0 +1,12 @@
+# #-- auth_load_http.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+kill_pid $UNBOUND_PID
+kill_pid $PETAL_PID
+cat petal.log
+cat unbound.log
@@ -0,0 +1,40 @@
+# #-- auth_load_http.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+. ../common.sh
+# if no threads; exit
+if grep -e "define HAVE_PTHREAD 1" -e "define HAVE_SOLARIS_THREADS 1" -e "define HAVE_WINDOWS_THREADS 1" $PRE/config.h; then
+	echo "have threads"
+else
+	skip_test "no threads"
+fi
+
+get_random_port 2
+UNBOUND_PORT=$RND_PORT
+PETAL_PORT=$(($RND_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "PETAL_PORT=$PETAL_PORT" >> .tpkg.var.test
+
+get_make
+(cd $PRE; $MAKE petal)
+
+# start https daemon
+$PRE/petal -v -a "127.0.0.1" -p $PETAL_PORT >petal.log 2>&1 &
+PETAL_PID=$!
+echo "PETAL_PID=$PETAL_PID" >> .tpkg.var.test
+wait_petal_up petal.log
+
+# make config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$PETAL_PORT'/' < auth_load_http.conf > ub.conf
+# start unbound in the background
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+#valgrind --leak-check=full --show-reachable=yes $PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_unbound_up unbound.log
@@ -0,0 +1,55 @@
+# #-- auth_load_http.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+# do the test
+echo "> dig www.example.com."
+dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 1
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 1
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 1
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 3
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 3
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+echo "> check answer"
+if grep "1.2.3.4" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+if grep "auth zone example.com. details" unbound.log; then
+	echo "OK"
+else
+	echo "not OK"
+	exit 1
+fi
+
+exit 0
@@ -0,0 +1,21 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIDfQIBAAKBwQC1xQ/Kca6zszZbcCtdOTIH2Uy2gOy/DfabMUU7TmNPm0dVE0NJ
+RuN+Rm304SonpwghfP2/ULZNnuDgpG03/32yI7k/VzG6iA4hiF7tT/KAAWC/+2l1
+QCsawCV2bSrFK0VhcZr7ALqXd8vkDaQ867K029ypjOQtAJ85qdO3mERy7TGtdUcu
+O6hLeVet419YeQ2F8cfNxn63d7bOzNGLPW5xwaCd3UcgD+Ib0k4xfFvbinvPQUeU
+J/i4YDWexFYSL+ECAwEAAQKBwCLXXQl+9O+5AEhSnd1Go1Jh0pSA7eBJOuXQcebG
+Rb7ykp+6C4G2NtDziwwPRNdI6wQQQ0sym18RfyVQHydGr78/nbiIbB3HCn5e92Mh
+mefzW6ow9Kvm2txLzGKA1lvoyRbNm81jnG/eygi3u7Nqd5PNv+4dHj2RkTlmxOeh
+qnDMVP5md8uZPv6lYNnrnIzvLCR5vnPNdVwn89AqzI85IcDZdy0R9ZX4NBbsDgAU
+6ig6uXuRXvSGiyJ/OUXSrnogaQJhAOjvkHUhVZQkPOxO90TNH4j0GdKKtbSWxIdz
+lKfuJeBAEqs0TL+C6vbS81Xw3W1alyDdUBk3rJMOBqW6Ryq5HNL+j5H+Jfsh7fvc
+Yle+5wHGci0P9zCFZCrY8It7n9XFIwJhAMfEi6oJa2G8waPJ1bQhxka82Tf9pnKM
+XCn/1BBOFjVIx5F842cpA+zp5a62GENTGYPQTTRBB/2/ZwnW5aIkrlg54AtmbqBZ
+Oh+2kJdJQD/tfoVmc5soUE2ScTHadK5RKwJhAN4w9kjkXS+MSZjX0kIMsBIBVkhh
+C+aREjJqa9ir7/Ey7RvmLXdYuCxtGLRXp7/R8+rjcK49Tx6O+IRJZe042mfhbq3C
+EhS1Tr86f4xXix9EXlDhs9bSxrOgcAN9Dv/opQJhAK7eBcPaav0rVfYh/8emqQHS
+3fJ9Pu6WnzbEksWTFS2ff9KDGCx9YspIFJ5TF/oXDAaumGZdZrlgirm6O1kr8tGY
+F97i04PZl1+bWAaWQH+1TUNI43m2WFUPE7coG2tb8QJgcddDg9VlXliZqgcETZfJ
+kJmYETxrcSn3ao6v116N8yxhEgUgjkmsCTiFgx36iDVnXwK6PIt+sIu8MC7eYNa3
+berrv/M21K0LRn20IWRxvUobG070weHCAgkko7fTWgr2
+-----END RSA PRIVATE KEY-----
@@ -0,0 +1,14 @@
+-----BEGIN CERTIFICATE-----
+MIICFzCCAUACCQDO660L5y5LGDANBgkqhkiG9w0BAQUFADAQMQ4wDAYDVQQDEwVw
+ZXRhbDAeFw0xMDA5MzAxMzQzMDFaFw0zMDA2MTcxMzQzMDFaMBAxDjAMBgNVBAMT
+BXBldGFsMIHfMA0GCSqGSIb3DQEBAQUAA4HNADCByQKBwQC1xQ/Kca6zszZbcCtd
+OTIH2Uy2gOy/DfabMUU7TmNPm0dVE0NJRuN+Rm304SonpwghfP2/ULZNnuDgpG03
+/32yI7k/VzG6iA4hiF7tT/KAAWC/+2l1QCsawCV2bSrFK0VhcZr7ALqXd8vkDaQ8
+67K029ypjOQtAJ85qdO3mERy7TGtdUcuO6hLeVet419YeQ2F8cfNxn63d7bOzNGL
+PW5xwaCd3UcgD+Ib0k4xfFvbinvPQUeUJ/i4YDWexFYSL+ECAwEAATANBgkqhkiG
+9w0BAQUFAAOBwQBBkX9KDP2RXbg+xPmdJ4P6CwvA5x1LZwC++ydVx4NlvT0pWicD
+ZUnXjcWAJlkeOuUBAqFG7WHTrXpUUAjmdqFVq2yFjteUYBdrFz0RDB2jM9feeKYO
+mTgxdZyT9a6humxCxt5VfgT02axLjm/2AqCyFPMbf4PASoJDln01AEuZLZ8Xl2gV
+bYHMnHTGoD1Hu6FNEzRgkMC6XT8X3YjHvzQhpc/qL5wEfEsinQGdX4twsuWbf8xd
+q7miNnkO8vd0maw=
+-----END CERTIFICATE-----
@@ -0,0 +1,103 @@
+server:
+	verbosity: 8
+	num-threads: 1
+	interface: 127.0.0.1
+	port: @PORT@
+	use-syslog: no
+	directory: ""
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+	auth-task-threads: 2
+
+auth-zone:
+	name: "example1.com"
+	for-upstream: yes
+	for-downstream: yes
+	master: "127.0.0.1@@TOPORT@"
+
+auth-zone:
+	name: "example2.com"
+	for-upstream: yes
+	for-downstream: yes
+	master: "127.0.0.1@@TOPORT@"
+
+auth-zone:
+	name: "example3.com"
+	for-upstream: yes
+	for-downstream: yes
+	master: "127.0.0.1@@TOPORT@"
+
+auth-zone:
+	name: "example4.com"
+	for-upstream: yes
+	for-downstream: yes
+	master: "127.0.0.1@@TOPORT@"
+
+auth-zone:
+	name: "example5.com"
+	for-upstream: yes
+	for-downstream: yes
+	master: "127.0.0.1@@TOPORT@"
+
+auth-zone:
+	name: "example6.com"
+	for-upstream: yes
+	for-downstream: yes
+	master: "127.0.0.1@@TOPORT@"
+
+auth-zone:
+	name: "example7.com"
+	for-upstream: yes
+	for-downstream: yes
+	master: "127.0.0.1@@TOPORT@"
+
+auth-zone:
+	name: "example8.com"
+	for-upstream: yes
+	for-downstream: yes
+	master: "127.0.0.1@@TOPORT@"
+
+auth-zone:
+	name: "example9.com"
+	for-upstream: yes
+	for-downstream: yes
+	master: "127.0.0.1@@TOPORT@"
+
+auth-zone:
+	name: "example10.com"
+	for-upstream: yes
+	for-downstream: yes
+	master: "127.0.0.1@@TOPORT@"
+
+auth-zone:
+	name: "example11.com"
+	for-upstream: yes
+	for-downstream: yes
+	master: "127.0.0.1@@TOPORT@"
+
+auth-zone:
+	name: "example12.com"
+	for-upstream: yes
+	for-downstream: yes
+	master: "127.0.0.1@@TOPORT@"
+
+auth-zone:
+	name: "example13.com"
+	for-upstream: yes
+	for-downstream: yes
+	master: "127.0.0.1@@TOPORT@"
+
+auth-zone:
+	name: "example14.com"
+	for-upstream: yes
+	for-downstream: yes
+	master: "127.0.0.1@@TOPORT@"
+
+auth-zone:
+	name: "example15.com"
+	for-upstream: yes
+	for-downstream: yes
+	master: "127.0.0.1@@TOPORT@"
+
@@ -0,0 +1,16 @@
+BaseName: auth_load_list
+Version: 1.0
+Description: Perform more transfers than the auth load thread count
+CreationDate: Fri 9 Jul 15:00:00 CEST 2026
+Maintainer: dr. W.C.A. Wijngaards
+Category:
+Component:
+CmdDepends:
+Depends:
+Help:
+Pre: auth_load_list.pre
+Post: auth_load_list.post
+Test: auth_load_list.test
+AuxFiles:
+Passed:
+Failure:
@@ -0,0 +1,12 @@
+# #-- auth_load_list.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+kill_pid $FWD_PID
+kill_pid $UNBOUND_PID
+cat fwd.log
+cat unbound.log
@@ -0,0 +1,74 @@
+# #-- auth_load_list.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+. ../common.sh
+# if no threads; exit
+if grep -e "define HAVE_PTHREAD 1" -e "define HAVE_SOLARIS_THREADS 1" -e "define HAVE_WINDOWS_THREADS 1" $PRE/config.h; then
+	echo "have threads"
+else
+	skip_test "no threads"
+fi
+
+get_random_port 2
+UNBOUND_PORT=$RND_PORT
+FWD_PORT=$(($RND_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+
+# start forwarder
+
+# create auth_load_list.testns
+for((i=1; i<16; i++)); do
+cat >>auth_load_list.testns <<EOF
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+example$i.com. IN SOA
+SECTION ANSWER
+example$i.com. IN SOA ns.example$i.com. hostmaster.example$i.com. 1 3600 900 86400 3600
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+example$i.com. IN AXFR
+SECTION ANSWER
+example$i.com. IN SOA ns.example$i.com. hostmaster.example$i.com. 1 3600 900 86400 3600
+example$i.com.	IN NS	ns.example.net.
+EXTRA_PACKET
+REPLY QR AA NOERROR
+SECTION QUESTION
+example$i.com. IN AXFR
+SECTION ANSWER
+www.example$i.com. IN A	1.2.3.4
+example$i.com. IN SOA ns.example$i.com. hostmaster.example$i.com. 1 3600 900 86400 3600
+ENTRY_END
+EOF
+done
+
+get_ldns_testns
+$LDNS_TESTNS -p $FWD_PORT auth_load_list.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+# make config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' < auth_load_list.conf > ub.conf
+# start unbound in the background
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+#valgrind --leak-check=full --show-reachable=yes $PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_ldns_testns_up fwd.log
+wait_unbound_up unbound.log
+
@@ -0,0 +1,60 @@
+# #-- auth_load_list.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+
+# do the test
+for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15; do
+	name="www.example$i.com"
+	echo ""
+	echo "> dig $name"
+	dig @127.0.0.1 -p $UNBOUND_PORT $name | tee outfile
+	if grep SERVFAIL outfile; then
+		echo "> try again"
+		dig @127.0.0.1 -p $UNBOUND_PORT $name | tee outfile
+	fi
+	if grep SERVFAIL outfile; then
+		echo "> try again"
+		sleep 1
+		dig @127.0.0.1 -p $UNBOUND_PORT $name | tee outfile
+	fi
+	if grep SERVFAIL outfile; then
+		echo "> try again"
+		sleep 1
+		dig @127.0.0.1 -p $UNBOUND_PORT $name | tee outfile
+	fi
+	if grep SERVFAIL outfile; then
+		echo "> try again"
+		sleep 1
+		dig @127.0.0.1 -p $UNBOUND_PORT $name | tee outfile
+	fi
+	if grep SERVFAIL outfile; then
+		echo "> try again"
+		sleep 3
+		dig @127.0.0.1 -p $UNBOUND_PORT $name | tee outfile
+	fi
+	if grep SERVFAIL outfile; then
+		echo "> try again"
+		sleep 3
+		dig @127.0.0.1 -p $UNBOUND_PORT $name | tee outfile
+	fi
+	echo "> check answer"
+	if grep "1.2.3.4" outfile; then
+		echo "OK"
+	else
+		echo "Not OK"
+		exit 1
+	fi
+	if grep "auth zone example$i.com. details" unbound.log; then
+		echo "OK"
+	else
+		echo "not OK"
+		exit 1
+	fi
+done
+echo "loop done"
+
+exit 0
@@ -0,0 +1,26 @@
+server:
+	verbosity: 8
+	# num-threads: 1
+	interface: 127.0.0.1
+	port: @PORT@
+	use-syslog: no
+	directory: ""
+	pidfile: "unbound.pid"
+	module-config: "respip validator iterator"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+	auth-task-threads: 1
+	log-queries: yes
+	log-replies: yes
+
+forward-zone:
+	name: "."
+	forward-addr: "127.0.0.1@@TOPORT@"
+
+rpz:
+	name: "rpz.example.com"
+	for-downstream: yes
+	master: "127.0.0.1@@TOPORT@"
+	rpz-log: yes
+	rpz-log-name: "rpz.example.com"
@@ -0,0 +1,16 @@
+BaseName: auth_load_rpz
+Version: 1.0
+Description: Load RPZ zone with auth load thread
+CreationDate: Tue 6 Oct 10:00:00 CEST 2026
+Maintainer: dr. W.C.A. Wijngaards
+Category:
+Component:
+CmdDepends:
+Depends:
+Help:
+Pre: auth_load_rpz.pre
+Post: auth_load_rpz.post
+Test: auth_load_rpz.test
+AuxFiles:
+Passed:
+Failure:
@@ -0,0 +1,12 @@
+# #-- auth_load_rpz.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+kill_pid $FWD_PID
+kill_pid $UNBOUND_PID
+cat fwd.log
+cat unbound.log
@@ -0,0 +1,39 @@
+# #-- auth_load_rpz.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+. ../common.sh
+# if no threads; exit
+if grep -e "define HAVE_PTHREAD 1" -e "define HAVE_SOLARIS_THREADS 1" -e "define HAVE_WINDOWS_THREADS 1" $PRE/config.h; then
+	echo "have threads"
+else
+	skip_test "no threads"
+fi
+
+get_random_port 2
+UNBOUND_PORT=$RND_PORT
+FWD_PORT=$(($RND_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+
+# start forwarder
+get_ldns_testns
+$LDNS_TESTNS -p $FWD_PORT auth_load_rpz.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+# make config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' < auth_load_rpz.conf > ub.conf
+# start unbound in the background
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+#valgrind --leak-check=full --show-reachable=yes $PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_ldns_testns_up fwd.log
+wait_unbound_up unbound.log
+
@@ -0,0 +1,56 @@
+# #-- auth_load_rpz.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+# do the test
+# The answer is rewritten by RPZ, that is loaded in the auth load thread.
+echo "> dig www.example.com."
+dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 1
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 1
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 1
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 3
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 3
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+echo "> check answer"
+if grep "1.2.3.4" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+if grep "auth zone rpz.example.com. details" unbound.log; then
+	echo "OK"
+else
+	echo "not OK"
+	exit 1
+fi
+
+exit 0
@@ -0,0 +1,22 @@
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+rpz.example.com. IN SOA
+SECTION ANSWER
+rpz.example.com. IN SOA ns.example.com. hostmaster.example.com. 1 3600 900 86400 3600
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+rpz.example.com. IN AXFR
+SECTION ANSWER
+rpz.example.com. IN SOA ns.example.com. hostmaster.example.com. 1 3600 900 86400 3600
+rpz.example.com.	IN NS	ns.example.net.
+www.example.com.rpz.example.com. IN A	1.2.3.4
+rpz.example.com. IN SOA ns.example.com. hostmaster.example.com. 1 3600 900 86400 3600
+ENTRY_END
@@ -0,0 +1,27 @@
+server:
+	verbosity: 8
+	# num-threads: 1
+	interface: 127.0.0.1
+	port: @PORT@
+	use-syslog: no
+	directory: ""
+	pidfile: "unbound.pid"
+	module-config: "respip validator iterator"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+	auth-task-threads: 1
+	log-queries: yes
+	log-replies: yes
+
+forward-zone:
+	name: "."
+	forward-addr: "127.0.0.1@@TOPORT@"
+
+rpz:
+	name: "rpz.example.com"
+	zonefile: "auth_load_write.zone"
+	for-downstream: yes
+	master: "127.0.0.1@@TOPORT@"
+	rpz-log: yes
+	rpz-log-name: "rpz.example.com"
@@ -0,0 +1,16 @@
+BaseName: auth_load_write
+Version: 1.0
+Description: Write zonefile with auth load thread
+CreationDate: Wed 7 Oct 10:00:00 CEST 2026
+Maintainer: dr. W.C.A. Wijngaards
+Category:
+Component:
+CmdDepends:
+Depends:
+Help:
+Pre: auth_load_write.pre
+Post: auth_load_write.post
+Test: auth_load_write.test
+AuxFiles:
+Passed:
+Failure:
@@ -0,0 +1,12 @@
+# #-- auth_load_write.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+kill_pid $FWD_PID
+kill_pid $UNBOUND_PID
+cat fwd.log
+cat unbound.log
@@ -0,0 +1,39 @@
+# #-- auth_load_write.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+. ../common.sh
+# if no threads; exit
+if grep -e "define HAVE_PTHREAD 1" -e "define HAVE_SOLARIS_THREADS 1" -e "define HAVE_WINDOWS_THREADS 1" $PRE/config.h; then
+	echo "have threads"
+else
+	skip_test "no threads"
+fi
+
+get_random_port 2
+UNBOUND_PORT=$RND_PORT
+FWD_PORT=$(($RND_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
+
+# start forwarder
+get_ldns_testns
+$LDNS_TESTNS -p $FWD_PORT auth_load_write.testns >fwd.log 2>&1 &
+FWD_PID=$!
+echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
+
+# make config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' < auth_load_write.conf > ub.conf
+# start unbound in the background
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+#valgrind --leak-check=full --show-reachable=yes $PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_ldns_testns_up fwd.log
+wait_unbound_up unbound.log
+
@@ -0,0 +1,70 @@
+# #-- auth_load_write.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+. ../common.sh
+# do the test
+# The answer is rewritten by RPZ, that is loaded in the auth load thread.
+echo "> dig www.example.com."
+dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 1
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 1
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 1
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 3
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 3
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+echo "> check answer"
+if grep "1.2.3.4" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+if grep "auth zone rpz.example.com. details" unbound.log; then
+	echo "OK"
+else
+	echo "not OK"
+	exit 1
+fi
+
+wait_logfile unbound.log "write zonefile auth_load_write.zone for rpz.example.com." 10
+grep "write zonefile" unbound.log
+echo "> auth_load_write.zone"
+cat auth_load_write.zone
+echo ""
+
+if grep "text a b c d" auth_load_write.zone; then
+	echo "OK"
+else
+	echo "not OK"
+	exit 1
+fi
+
+exit 0
@@ -0,0 +1,23 @@
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+rpz.example.com. IN SOA
+SECTION ANSWER
+rpz.example.com. IN SOA ns.example.com. hostmaster.example.com. 1 3600 900 86400 3600
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+rpz.example.com. IN AXFR
+SECTION ANSWER
+rpz.example.com. IN SOA ns.example.com. hostmaster.example.com. 1 3600 900 86400 3600
+rpz.example.com.	IN NS	ns.example.net.
+www.example.com.rpz.example.com. IN A	1.2.3.4
+txt.example.com.rpz.example.com. IN TXT "text a b c d"
+rpz.example.com. IN SOA ns.example.com. hostmaster.example.com. 1 3600 900 86400 3600
+ENTRY_END
@@ -0,0 +1,236 @@
+; config options
+server:
+	target-fetch-policy: "0 0 0 0 0"
+
+auth-zone:
+	name: "example.com."
+	master: 1.2.3.44
+	for-downstream: yes
+	for-upstream: yes
+	## fallback-enabled: no
+	allow-notify: 127.0.0.1/32
+
+	## this line generates zonefile: \n"/tmp/xxx.example.com"\n
+	zonefile:
+TEMPFILE_NAME example.com
+	## this is the inline file /tmp/xxx.example.com
+	## the tempfiles are deleted when the testrun is over.
+TEMPFILE_CONTENTS example.com
+example.com.	3600	IN	SOA	ns.example.com. hostmaster.example.com. 1 3600 900 86400 3600
+example.com.	3600	IN	NS	ns.example.net.
+www.example.com.	3600	IN	A	1.2.3.4
+TEMPFILE_END
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test authority zone with NOTIFY during initial lookup
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com. IN A 1.2.3.44
+ENTRY_END
+RANGE_END
+
+; ns.example.net.
+RANGE_BEGIN 0 45
+	ADDRESS 1.2.3.44
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.net. IN NS
+SECTION ANSWER
+example.net.	IN NS	ns.example.net.
+SECTION ADDITIONAL
+ns.example.net.		IN 	A	1.2.3.44
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ns.example.net. IN A
+SECTION ANSWER
+ns.example.net. IN A	1.2.3.44
+SECTION AUTHORITY
+example.net.	IN NS	ns.example.net.
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ns.example.net. IN AAAA
+SECTION AUTHORITY
+example.net.	IN NS	ns.example.net.
+SECTION ADDITIONAL
+www.example.net. IN A	1.2.3.44
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.	IN NS	ns.example.net.
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN SOA
+SECTION ANSWER
+; serial, refresh, retry, expire, minimum
+example.com.	3600	IN	SOA	ns.example.com. hostmaster.example.com. 2 3600 900 86400 3600
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname serial=1
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+example.com. IN IXFR
+SECTION ANSWER
+example.com. IN SOA ns.example.com. hostmaster.example.com. 2 3600 900 86400 3600
+example.com. IN SOA ns.example.com. hostmaster.example.com. 1 3600 900 86400 3600
+example.com. IN SOA ns.example.com. hostmaster.example.com. 2 3600 900 86400 3600
+add.example.com. IN A 1.2.3.5
+example.com. IN SOA ns.example.com. hostmaster.example.com. 2 3600 900 86400 3600
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 20 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR AA RD RA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	1.2.3.4
+ENTRY_END
+
+; NOTIFY example.com
+STEP 30 QUERY
+ENTRY_BEGIN
+REPLY NOTIFY
+SECTION QUESTION
+example.com. IN SOA
+ENTRY_END
+; notify reply
+STEP 40 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RA NOTIFY NOERROR
+SECTION QUESTION
+example.com. IN SOA
+SECTION ANSWER
+ENTRY_END
+
+STEP 45 TRAFFIC
+
+STEP 50 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+add.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 60 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR AA RD RA NOERROR
+SECTION QUESTION
+add.example.com. IN A
+SECTION ANSWER
+add.example.com. IN A	1.2.3.5
+ENTRY_END
+
+; the zonefile was updated with new contents
+STEP 70 CHECK_TEMPFILE example.com
+FILE_BEGIN
+example.com.	3600	IN	SOA	ns.example.com. hostmaster.example.com. 2 3600 900 86400 3600
+example.com.	3600	IN	NS	ns.example.net.
+add.example.com.	3600	IN	A	1.2.3.5
+www.example.com.	3600	IN	A	1.2.3.4
+FILE_END
+
+SCENARIO_END
@@ -283,39 +283,9 @@ www.example.com. IN A
 SECTION ANSWER
 ENTRY_END

-; the zonefile was updated with new contents
+; the zonefile was not updated with new contents, due to zonemd failure
 STEP 70 CHECK_TEMPFILE example.com
 FILE_BEGIN
-example.com.	3600	IN	SOA	ns.example.com. hostmaster.example.com. 200154054 28800 7200 604800 3600
-example.com.	3600	IN	RRSIG	SOA 8 2 3600 20201116135527 20201019135527 55566 example.com. gcFHT/Q4iDZ78CK6fyY2HZr8sRtgH2Rna9fEs06RW0gqMnfDntweoIaBamOZ7NlAP84aY2bZeanmEccmkHexByUpodCoKQ4NzVXctLr0TO4PVoFyfUfj62fjhM56SF8ioDxsoDQcPtYXcjNQjwfntWofMqHCMxrb9LzbgePzhOM=
-example.com.	3600	IN	NS	ns.example.com.
-example.com.	3600	IN	RRSIG	NS 8 2 3600 20201116135527 20201019135527 55566 example.com. X+V3XsbJbBi9OsHpjMkGCox8RLY/uXp/XX/O/flTrIre9fMDWm9ZGnewtuQFpLgGc6hUTi0eLsuRWRA5fZXEKUBhmoR2Ph01KgE1gvlL7v6zPWQwXVcBRUr3mOSbYdNNkHkXEjiDBGEhNkfqR216zNgw563eEGXOkLUFNIx5Zpg=
-example.com.	3600	IN	NSEC	bar.example.com. NS SOA RRSIG NSEC DNSKEY ZONEMD
-example.com.	3600	IN	RRSIG	NSEC 8 2 3600 20201116135527 20201019135527 55566 example.com. ufLrlOQprAqjnH85Rt3T0Mxd3ZB0mBeeNIr84eFJ8Rk6WiWEPm0Y1R7GRufNI24Mj7iqLcL4nJM6KK6B7dJqjqu73jw1acuYNnbsoV2BNDRXRFP2FNWTpctVdi+955f3FzgsmEJXfGiSUG0YXAEcZmdCPCn5ii2jk8mk7r6KKYo=
-example.com.	3600	IN	DNSKEY	256 3 8 AwEAAdug/L739i0mgN2nuK/bhxu3wFn5Ud9nK2+XUmZQlPUEZUC5YZvm1rfMmEWTGBn87fFxEu/kjFZHJ55JLzqsbbpVHLbmKCTT2gYR2FV2WDKROGKuYbVkJIXdKAjJ0ONuK507NinYvlWXIoxHn22KAWOd9wKgSTNHBlmGkX+ts3hh ;{id = 55566}
-example.com.	3600	IN	RRSIG	DNSKEY 8 2 3600 20201116135527 20201019135527 55566 example.com. fsdnVg38PKQTH2mDOwkXL6Jre7JP7Gf8WI3CvIbmeYQUJtAlpcSbZkS3wInm3kKMxOuT55BWzndQzpfmpo91OqJjG27W0k9301NMLUwFprA6b9HK+iPAT0JpYPDPzcm1bQdarLzLS+eD/GPwmyVSX7Gze+08VfE8m8sOW2r7UjA=
-example.com.	3600	IN	ZONEMD	200154054 1 2 58F7620F93204BBB31B44F795B3409CC4ABD9EF5601DECC15675BD7751213152984EDDCE0626E6062E744B03B3E47711202FBB79E4A2EB8BC5CF46741B5CAE6F
-example.com.	3600	IN	RRSIG	ZONEMD 8 2 3600 20201116135527 20201019135527 55566 example.com. orn8ZF/yqj9u4WrhiO6gtEcTaVsnZSWWZLfXhcIOiWSB8kKCxtZl5cG17dD3Du1NllUwMRqkp0KleLhIoUS9xeQ/0x05u+CYLrfQ62oAiD7q54ZQzpXJIH52aQzKV70ZnO03CZowhQBnetmIoKX6xLogKo8pt+BdQbo3oVHxV8Y=
-bar.example.com.	3600	IN	A	1.2.3.55
-bar.example.com.	3600	IN	RRSIG	A 8 3 3600 20201116135527 20201019135527 55566 example.com. NYhmRicF4C9+YxpWeQrepy4ALM1CM0USoDuGi3W5Xtp4/+YpCJfSIdR9vlJaJ2WayYuZrz9Ai2ci7oWwE1Fn3oywGwCKvGo9m0c3mC2eEtphE19wrop6pWu6um4RiFhmzYS1voraA3PAdYzze9U4NHzlk0+sb5vNZW9dSZS30Ds=
-bar.example.com.	3600	IN	NSEC	ding.example.com. A RRSIG NSEC
-bar.example.com.	3600	IN	RRSIG	NSEC 8 3 3600 20201116135527 20201019135527 55566 example.com. VhsGuBx20DXQZNU8ITAMnasn6NVyEjN9xtB8msH5xJn80UCuaqvFBURzcPWN3aHnykEvGfdPF/9P3WvlON0cMikWkqSLy6Q9bpvgAq13HWYh+ZcDoqLtICaB7RkBQc+6aHAqZFyQbD8/m8Kxt5eVJtV6rEuf+yPX0+3aXHhsRg0=
-ding.example.com.	3600	IN	A	1.2.3.4
-ding.example.com.	3600	IN	RRSIG	A 8 3 3600 20201116135527 20201019135527 55566 example.com. OERsruISkpd1s68ute8Xm8YXisBCTkkiDMt34K+0dVqvySOJq63d3qN18BeUxZxLyHDB1eR3nZZKqEdkTqrv2r98skhWhjnOECpFbu5gKjtN/KPexbbJ+rxC0QqciuWOC7M6YE0cvI17/RB9KhVRy5rqY2X4Gt2wk2CNeD1dAko=
-ding.example.com.	3600	IN	NSEC	foo.example.com. A RRSIG NSEC
-ding.example.com.	3600	IN	RRSIG	NSEC 8 3 3600 20201116135527 20201019135527 55566 example.com. nb1W2aaKrU5iAQiY8gMsoMOejID19JMTEwY2rRoe+KsvzMs0rE0ifEkqit4blXaU0tfy0foJ70uqdJFqBoGz1NcSwZ6GNk/iNfGvG3XpxZ/zqEe7kkIucqqei794G7z9psqV94yZ3WaT+IswPpWrSaWv1w41RtcWufPhe4fOAmU=
-foo.example.com.	3600	IN	A	1.2.3.4
-foo.example.com.	3600	IN	RRSIG	A 8 3 3600 20201116135527 20201019135527 55566 example.com. ZcUngb2pUejwnsshbJN/Dfr+Bzu8fcZXyqLArQ+10Bw1IPHyfx7yyUJ43V5tTYVHPSEsJzTnaWj+olVrNhVZxq5e0pgzSYPfGln2FEItEvMIOn33j8yKTpPW2MLyuFF5ZkXhosG20EUwRMvMmRHRz9mIZfwWoMbSGPukmLh8zMA=
-foo.example.com.	3600	IN	NSEC	ns.example.com. A RRSIG NSEC
-foo.example.com.	3600	IN	RRSIG	NSEC 8 3 3600 20201116135527 20201019135527 55566 example.com. fUZEpkEULRWDntN5Z7Kr8M83Hjhf08ECMKRpo6IBoBc3ayenj+YMgWAvFXC825wjENPYYWNGag0d32U83zCZxqgv+8uXZd3B7QDpTbL41aWZdc++s5YWTkYjyOWwJ1XHOv4nL3qEnJBXVzo/E1gbSKhTFuG97i+7J1MFd9MsC5s=
-ns.example.com.	3600	IN	A	127.0.0.1
-ns.example.com.	3600	IN	RRSIG	A 8 3 3600 20201116135527 20201019135527 55566 example.com. SiuxuPtN/ITd+Z20j8UNUHJWbLHirE8zQOWMv5fAZ1rPKpAidrZgUL8J417GdrTwkueU2ywAJ7EzFJSwNTa7o/wUnq7svmOR6Ze6UQsKuZFZGEfqPNDRp4YuF86LU5jChuo+f/IRpydHrxVwGxDPCR9KarDM+ewfW+yI5bZeZcg=
-ns.example.com.	3600	IN	NSEC	www.example.com. A RRSIG NSEC
-ns.example.com.	3600	IN	RRSIG	NSEC 8 3 3600 20201116135527 20201019135527 55566 example.com. 0upKNYjiow4NDJm3I1RbUddE9GGuFYEVKswww5BAc/6WHuukupncL30lskvcSKGpByDssP2Hi2CufyEtYeGWh6q1TxtOFRqFBX1p6Q5b3tBlCtvv4h31dQR9uqLvq+GkGS5MR+0LO5kWagIpZmnI8YY5plVdXEtNbp2Ar8zvz/A=
-www.example.com.	3600	IN	A	127.0.0.1
-www.example.com.	3600	IN	RRSIG	A 8 3 3600 20201116135527 20201019135527 55566 example.com. AaIeICaPjV50TDrpbyOn94+hs8EYIMTmN4pYqj7e8GIGimqQIk5jgpwSx6SOoOF+uOqkf9GKHkQTn5YVGaeXwEQleg7mPTmMYKAOk06Y7MFUO1Vwt1Vt7Wo+Cpa3x2a1CmEkfFOi4WqP43VJnUtjjKmXoKRz3VUmqByyJYUAGbQ=
-www.example.com.	3600	IN	NSEC	example.com. A RRSIG NSEC
-www.example.com.	3600	IN	RRSIG	NSEC 8 3 3600 20201116135527 20201019135527 55566 example.com. meg/t6nIBqQZ0d5/dT7uu/3CuP4vE+HxqFQaj2fjUNceA/6C7QIQnqQ5Kyblg+XijDkQX0yvyFNHYdgF16UDgFT7tlNUCHk1SpF5BWzV4c4tBEhxASTz7UQo111O3Tyd6CldPzO/Se15Ud0/ZYltHEqWTfY5nJoXC/OJD9V2QOI=
 FILE_END

 SCENARIO_END
@@ -0,0 +1,206 @@
+; config options
+; The island of trust is at test.
+server:
+	target-fetch-policy: "0 0 0 0 0"
+	qname-minimisation: no
+	minimal-responses: no
+	local-zone: test. nodefault
+	log-servfail: yes
+	cache-max-ttl: 86400
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test DNAME for post parse packet alteration
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+test. IN NS
+SECTION AUTHORITY
+test.	IN NS	ns.test.
+SECTION ADDITIONAL
+ns.test. IN A 1.2.3.5
+ENTRY_END
+RANGE_END
+
+; ns.test
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.5
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+test. IN NS
+SECTION ANSWER
+test.    IN NS   ns.test
+SECTION ADDITIONAL
+ns.test. IN A 1.2.3.5
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.test. IN A
+SECTION ANSWER
+ns.test. IN A 1.2.3.5
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.test. IN AAAA
+SECTION AUTHORITY
+test. 3600 IN SOA ns.test. host.test. 20201 3600 1800 604800 3600
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+example.test. IN NS
+SECTION AUTHORITY
+example.test.    IN NS   ns.example.test.
+SECTION ADDITIONAL
+ns.example.test. IN A 1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.test.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.test. IN NS
+SECTION ANSWER
+example.test.    IN NS   ns.example.test.
+SECTION ADDITIONAL
+ns.example.test.         IN      A       1.2.3.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.example.test. IN A
+SECTION ANSWER
+ns.example.test.         IN      A       1.2.3.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.example.test. IN AAAA
+SECTION AUTHORITY
+example.test. 3600 IN SOA ns.example.test. host.example.test. 20301 3600 1800 604800 3600
+ENTRY_END
+
+; response to query of interest
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+a.d.example.test. IN CNAME
+SECTION ANSWER
+HEX_ANSWER_BEGIN
+00 00 84 00             ; QR AA
+00 01 00 02 00 01 00 00 ; QDCOUNT=1, ANCOUNT=2, NSCOUNT=1, ARCOUNT=0.
+; a.d.example.test. IN CNAME
+01 61 01 64 07 6578616d706c65 04 74657374 00 00 05 00 01
+; answer d.example.test. DNAME IN TTL=.. e.example.test.
+01 64 07 6578616d706c65 04 74657374 00 00 27 00 01 FF 00 12 34
+00 10 01 65 07 6578616d706c65 04 74657374 00
+; . TXT len to have space.
+00 00 10 00 01 00 00 00 15
+00 10
+0F 000102030405060708090A0B0C0D0E
+; auth SOA, with rdata compression pointer that points to the
+; DNAME TTL value. That gets clamped with max-ttl.
+; example.test. SOA IN ttl
+07 6578616d706c65 04 74657374 00 00 06 00 01 00 00 00 15
+00 18
+; DNAME TTL is at 36
+c0 37
+c0 0c
+00 00 00 01
+00 00 00 02
+00 00 00 03
+00 00 00 04
+00 00 00 05
+HEX_ANSWER_END
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+a.e.example.test. IN A
+SECTION AUTHORITY
+example.test. 3600 IN SOA ns.example.test. host.example.test. 20301 3600 1800 604800 3600
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+a.d.example.test. IN CNAME 
+ENTRY_END
+
+; The query is for type CNAME, so that the DNAME redirect is not followed,
+; but we get the processed answer from that DNAME reply.
+; The packet alteration would have changed the domain name in the SOA rdata.
+; but it should not have happened, the check below has the correct outcome,
+; where the packet data has not been altered, from its already awkward
+; contents.
+; The TXT RR has been scrubbed from the reply.
+; The malformed rdata would read something like:
+; example.test. 5 IN SOA . \001e\007example\004test\000. 1048577 21 1052416 16909060 84281096
+
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA DO NOERROR
+SECTION QUESTION
+a.d.example.test. IN CNAME
+SECTION ANSWER
+d.example.test. 21 IN DNAME e.example.test.
+a.d.example.test. 21 IN CNAME a.e.example.test.
+SECTION AUTHORITY
+example.test. 3600 IN SOA . a.d.example.test. 1 2 3 4 5
+ENTRY_END
+
+SCENARIO_END
@@ -0,0 +1,436 @@
+; config options
+; The island of trust is at example.com
+server:
+	trust-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
+	val-override-date: "20070916134226"
+	target-fetch-policy: "0 0 0 0 0"
+	qname-minimisation: "no"
+	fake-sha1: yes
+	trust-anchor-signaling: no
+	minimal-responses: no
+	ede: yes
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test validator with DS loop with duplicate DS records.
+; the DS records match digest.
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.    IN NS   a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.     IN      A       192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.    IN NS   ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; response to DNSKEY priming query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN DNSKEY
+SECTION ANSWER
+example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
+example.com.    3600    IN      RRSIG   DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+sub1.example.com. IN A
+SECTION ANSWER
+SECTION AUTHORITY
+sub1.example.com.	IN NS	ns.sub1.example.com.
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+
+sub1.example.com.	3600	IN	RRSIG	DS 3 3 3600 20070926134150 20070829134150 2854 example.com. AA2wcVQsxCw2VQcgrSp2zjxYP5ElbMVNMMdc/pMU77k5VkMThtZKygE=
+SECTION ADDITIONAL
+ns.sub1.example.com.		IN 	A	1.2.3.5
+ENTRY_END
+RANGE_END
+
+; ns.sub1.example.com.
+; 24 DSes and 24 DNSKEYs
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.5
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.sub1.example.com. IN AAAA
+SECTION ANSWER
+SECTION AUTHORITY
+sub1.example.com. IN SOA a. b. 3600 3600 3600 3600 3600
+sub1.example.com.	3600	IN	RRSIG	SOA 13 3 3600 20070926134150 20070829134150 20 sub1.example.com. PyHa+O9jyNBtKuVilpPoqQGDKHdMCrfhm6A7GDj0+ZPXZAax/+hl10CVIUhl5YqCS3xGc3Zae/WNbD+1w3cIUQ==
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+sub1.example.com. IN DNSKEY
+SECTION ANSWER
+sub1.example.com.	IN	DNSKEY	257 3 13 n2P99SKaAUDt50U/cToH/0TmGJKG8+Pbiwl1WY/f5EVWZD/auO5QEyY6Tm9kLHzAEOcjWR701V74ZgyFPirxIA== ;{id = 20 (ksk), size = 256b}
+; invalid signatures  There is AAAA01 in it.
+sub1.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 20 sub1.example.com. p6ScxBgybYLIhpD9SVDSquhPsytpehEUVncg2zRoXTxkuKXUsQIDKUuLhZxgeHNAnkKQn8e3xnoDWCGQAAAA01==
+sub1.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 20 sub1.example.com. p6ScxBgybYLIhpD9SVDSquhPsytpehEUVncg2zRoXTxkuKXUsQIDKUuLhZxgeHNAnkKQn8e3xnoDWCGQAAAA02==
+sub1.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 20 sub1.example.com. p6ScxBgybYLIhpD9SVDSquhPsytpehEUVncg2zRoXTxkuKXUsQIDKUuLhZxgeHNAnkKQn8e3xnoDWCGQAAAA03==
+sub1.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 20 sub1.example.com. p6ScxBgybYLIhpD9SVDSquhPsytpehEUVncg2zRoXTxkuKXUsQIDKUuLhZxgeHNAnkKQn8e3xnoDWCGQAAAA04==
+sub1.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 20 sub1.example.com. p6ScxBgybYLIhpD9SVDSquhPsytpehEUVncg2zRoXTxkuKXUsQIDKUuLhZxgeHNAnkKQn8e3xnoDWCGQAAAA05==
+sub1.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 20 sub1.example.com. p6ScxBgybYLIhpD9SVDSquhPsytpehEUVncg2zRoXTxkuKXUsQIDKUuLhZxgeHNAnkKQn8e3xnoDWCGQAAAA06==
+sub1.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 20 sub1.example.com. p6ScxBgybYLIhpD9SVDSquhPsytpehEUVncg2zRoXTxkuKXUsQIDKUuLhZxgeHNAnkKQn8e3xnoDWCGQAAAA07==
+sub1.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 20 sub1.example.com. p6ScxBgybYLIhpD9SVDSquhPsytpehEUVncg2zRoXTxkuKXUsQIDKUuLhZxgeHNAnkKQn8e3xnoDWCGQAAAA08==
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.sub1.example.com. IN A
+SECTION ANSWER
+www.sub1.example.com. IN A	10.20.30.41
+www.sub1.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 20 sub1.example.com. utG2+wuHSbmyQCaIjL7ElDe3DJCMqZGrPqsOEyJj8ljGGa5JaTY+KdYvZ6oGmprV7utRPNyRormou1zRWoG8ew==
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AD DO NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
+ENTRY_END
+
+; sub1.example.com.
+STEP 20 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.sub1.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 30 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ede=6
+;ednsdata
+REPLY QR RD RA DO SERVFAIL
+SECTION QUESTION
+www.sub1.example.com. IN A
+SECTION ANSWER
+;www.sub1.example.com. IN A	10.20.30.41
+;SECTION ADDITIONAL
+;HEX_EDNSDATA_BEGIN
+;; EDE: DNSSEC Bogus "validation failure <www.sub1.example.com. A IN>: DS verify has too many tag matches from 1.2.3.5 for key sub1.example.com. while building chain of trust"
+;000F009A000676616C69646174696F6E206661696C757265203C7777772E737562312E
+;6578616D706C652E636F6D2E204120494E3E3A20445320766572696679206861732074
+;6F6F206D616E7920746167206D6174636865732066726F6D20312E322E332E3520666F
+;72206B657920737562312E6578616D706C652E636F6D2E207768696C65206275696C64
+;696E6720636861696E206F66207472757374
+;HEX_EDNSDATA_END
+ENTRY_END
+
+SCENARIO_END
@@ -0,0 +1,74 @@
+; config options
+server:
+	answer-cookie: yes
+	cookie-secret: "000102030405060708090a0b0c0d0e0f"
+	access-control: 127.0.0.1 allow_cookie
+	access-control: 1.2.3.4 allow
+	local-data: "test. TXT test"
+	harden-short-bufsize: no
+
+CONFIG_END
+
+SCENARIO_BEGIN Test downstream DNS Cookies with short bufsize
+
+; Note: When a valid hash was required, it was generated by running this test
+; with an invalid one and checking the output for the valid one.
+; Actual hash generation is tested with unit tests.
+
+; Query without a client cookie ...
+; There is no space in udpsize for the EDE.
+STEP 0 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+test. IN TXT
+SECTION ADDITIONAL
+. 0 CLASS20 OPT \# 00
+ENTRY_END
+; ... get TC and refused
+STEP 1 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA TC REFUSED
+SECTION QUESTION
+test. IN TXT
+ENTRY_END
+
+; Query with only a client cookie ...
+; The OPT udpsize is short so the reply EDNS OPT does not fit.
+STEP 20 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+test. IN TXT
+SECTION ADDITIONAL
+. 0 CLASS24 OPT \# 12 00 0a 00 08 31 32 33 34 35 36 37 38
+ENTRY_END
+; ... the BADCOOKIE and a new cookie, does not fit.
+STEP 21 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA TC SERVFAIL
+SECTION QUESTION
+test. IN TXT
+ENTRY_END
+
+; Check an EDNS option with a too short content
+; The EDNS OPT rdata is too short, for the option opt_len.
+STEP 30 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+test. IN TXT
+SECTION ADDITIONAL
+. 32768 CLASS1230 OPT \# 04 00 0a 00 08
+ENTRY_END
+STEP 31 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA DO FORMERR
+SECTION QUESTION
+test. IN TXT
+ENTRY_END
+
+SCENARIO_END
@@ -0,0 +1,137 @@
+; This is a comment.
+; config options go here.
+server:
+	# allow cname chains from the upstream.
+	harden-cname-follow: no
+
+forward-zone: name: "." forward-addr: 216.0.0.1
+CONFIG_END
+
+SCENARIO_BEGIN Forward and follow CNAME chain.
+RANGE_BEGIN 0 100
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A 10.20.30.40
+SECTION AUTHORITY
+www.example.com. IN NS ns.example.com.
+www.example.com. IN NS ns.example.com.
+www.example.com. IN NS ns.example.com.
+SECTION ADDITIONAL
+ns.example.com. IN A 10.20.30.50
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www2.example.com. IN A
+SECTION ANSWER
+www2.example.com. IN CNAME b.ex2.com.
+b.ex2.com. IN A 10.20.30.42
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www3.example.com. IN A
+SECTION ANSWER
+www3.example.com. IN CNAME b.ex2.com.
+b.ex2.com. IN CNAME b.ex3.com.
+b.ex3.com. IN A 10.20.30.43
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www4.example.com. IN A
+SECTION ANSWER
+www4.example.com. IN CNAME b4.ex2.com.
+b4.ex2.com. IN CNAME b4.ex3.com.
+b4.ex3.com. IN CNAME b4.ex4.com.
+b4.ex4.com. IN A 10.20.30.44
+ENTRY_END
+
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+STEP 4 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH opcode qname qtype
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A 10.20.30.40
+ENTRY_END
+
+STEP 11 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www2.example.com. IN A
+ENTRY_END
+
+STEP 14 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH opcode qname qtype
+SECTION QUESTION
+www2.example.com. IN A
+SECTION ANSWER
+www2.example.com. IN CNAME b.ex2.com.
+b.ex2.com. IN A 10.20.30.42
+ENTRY_END
+
+STEP 21 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www3.example.com. IN A
+ENTRY_END
+
+STEP 24 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH opcode qname qtype
+SECTION QUESTION
+www3.example.com. IN A
+SECTION ANSWER
+www3.example.com. IN CNAME b.ex2.com.
+b.ex2.com. IN CNAME b.ex3.com.
+b.ex3.com. IN A 10.20.30.43
+ENTRY_END
+
+STEP 31 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www4.example.com. IN A
+ENTRY_END
+
+STEP 34 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH opcode qname qtype
+SECTION QUESTION
+www4.example.com. IN A
+SECTION ANSWER
+www4.example.com. IN CNAME b4.ex2.com.
+b4.ex2.com. IN CNAME b4.ex3.com.
+b4.ex3.com. IN CNAME b4.ex4.com.
+b4.ex4.com. IN A 10.20.30.44
+ENTRY_END
+
+SCENARIO_END
@@ -0,0 +1,506 @@
+; config options
+server: 
+	target-fetch-policy: "0 0 0 0 0"
+	qname-minimisation: no
+	local-zone: test. nodefault
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129
+CONFIG_END
+
+SCENARIO_BEGIN Test locate of DS NS records when middle NS is another server.
+; There are several zones hosted on one server. The DS lookup needs to
+; locate the NS for one of the middle zones. That middle zone has an NS
+; record where the child-data does not precisely match the parent referral.
+; Even though that parent referral is not visible due to the zones that are
+; on one server. The DS lookup fetches the child-side NS record.
+; And then should lookup the DS with it.
+;
+; In foo2.test there is an actual referral, the server host the upper and
+; lower zone, but not the middle, so it gives a referral instead of the
+; child side data when queried for the middle NS record.
+;
+; In foo3.test the zone is co-hosted, also the middle zone, and the glue
+; is correct, there is no mismatch with the NS record. It points to the
+; same server. That server answers from the lower zone for qtype DS,
+; that is from the wrong zone if that server supported DNSSEC for qtype DS.
+;
+; In foo4.test the zone is co-hosted and the server supports DNSSEC for
+; qtype DS, and so uses the correct middle zone, answering the query.
+; And DSNS find is not used.
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 200
+	ADDRESS 193.0.14.129
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET. IN A 193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+test. IN A
+SECTION AUTHORITY
+test. IN NS ns.test.
+SECTION ADDITIONAL
+ns.test. IN A 192.5.0.1
+ENTRY_END
+RANGE_END
+
+; ns.test.
+RANGE_BEGIN 0 200
+	ADDRESS 192.5.0.1
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+foo.test. IN A
+SECTION AUTHORITY
+foo.test. IN NS ns.foo.test.
+SECTION ADDITIONAL
+ns.foo.test. IN A 192.5.0.2
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+ex2.test. IN A
+SECTION AUTHORITY
+ex2.test. IN NS ns.ex2.test.
+SECTION ADDITIONAL
+ns.ex2.test. IN A 192.5.0.3
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+foo2.test. IN A
+SECTION AUTHORITY
+foo2.test. IN NS ns.foo2.test.
+SECTION ADDITIONAL
+ns.foo2.test. IN A 192.5.0.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+ex3.test. IN A
+SECTION AUTHORITY
+ex3.test. IN NS ns.ex3.test.
+SECTION ADDITIONAL
+ns.ex3.test. IN A 192.5.0.5
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+foo3.test. IN A
+SECTION AUTHORITY
+foo3.test. IN NS ns.foo3.test.
+SECTION ADDITIONAL
+ns.foo3.test. IN A 192.5.0.6
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+foo4.test. IN A
+SECTION AUTHORITY
+foo4.test. IN NS ns.foo4.test.
+SECTION ADDITIONAL
+ns.foo4.test. IN A 192.5.0.7
+ENTRY_END
+RANGE_END
+
+; ns.foo.test.
+; This server hosts a number of zones.
+; foo.test
+; mid.foo.test
+; x.mid.foo.test
+RANGE_BEGIN 0 200
+	ADDRESS 192.5.0.2
+
+; This answer is too low, for the DS query, it should have been answered
+; from a higher zone. This starts DSNS find.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+x.mid.foo.test. IN DS
+SECTION ANSWER
+SECTION AUTHORITY
+x.mid.foo.test. IN SOA a. b. 1 2 3 4 5
+ENTRY_END
+
+; The server is also authoriative for mid.foo.test and that
+; has a mismatching NS record, that lists another server than ns.foo.test.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+mid.foo.test. IN NS
+SECTION ANSWER
+mid.foo.test. IN NS ns2.ex2.test.
+SECTION AUTHORITY
+ENTRY_END
+
+; If it goes up further, this is the answer for the foo.test NS.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+foo.test. IN NS
+SECTION ANSWER
+foo.test. IN NS ns.foo.test.
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ns.foo.test. IN A 192.5.0.2
+ENTRY_END
+RANGE_END
+
+; ns.ex2.test.
+RANGE_BEGIN 0 200
+	ADDRESS 192.5.0.3
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns2.ex2.test. IN A
+SECTION ANSWER
+; it is on this same server for ex2.test.
+ns2.ex2.test. IN A 192.5.0.3
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns2.ex2.test. IN AAAA
+SECTION AUTHORITY
+ex2.test. IN SOA a. b. 1 2 3 4 5
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+x.mid.foo.test. IN DS
+SECTION ANSWER
+; The DS and RRSIG content are for the test. Not actually DNSSEC valid,
+; but supposedly the zone is signed, and has a signed DS to the lower zone.
+x.mid.foo.test. IN DS 30899 5 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
+x.mid.foo.test. IN RRSIG DS 3 4 3600 20070926134150 20070829134150 2854 mid.foo.test. MCwCFCW3ix0GD4BSvNLWIbROCJt5DAW9AhRt/kg9kBKJ20UBUdumrBUHqnskdA==
+SECTION AUTHORITY
+ENTRY_END
+RANGE_END
+
+; ns.foo2.test.
+; This server hosts a number of zones.
+; foo2.test
+; x.mid.foo2.test
+; but not: mid.foo2.test
+RANGE_BEGIN 0 200
+	ADDRESS 192.5.0.4
+
+; This answer is too low, for the DS query, it should have been answered
+; from a higher zone. This starts DSNS find.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+x.mid.foo2.test. IN DS
+SECTION ANSWER
+SECTION AUTHORITY
+x.mid.foo2.test. IN SOA a. b. 1 2 3 4 5
+ENTRY_END
+
+; The server has a referral for mid.foo2.test.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+mid.foo2.test. IN NS
+SECTION AUTHORITY
+mid.foo2.test. IN NS ns.ex3.test.
+ENTRY_END
+
+; If it goes up further, this is the answer for the foo2.test NS.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+foo2.test. IN NS
+SECTION ANSWER
+foo2.test. IN NS ns.foo2.test.
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ns.foo2.test. IN A 192.5.0.4
+ENTRY_END
+RANGE_END
+
+; ns.ex3.test.
+RANGE_BEGIN 0 200
+	ADDRESS 192.5.0.5
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.ex3.test. IN A
+SECTION ANSWER
+ns.ex3.test. IN A 192.5.0.5
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.ex3.test. IN AAAA
+SECTION AUTHORITY
+ex3.test. IN SOA a. b. 1 2 3 4 5
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+mid.foo2.test. IN NS
+SECTION ANSWER
+mid.foo2.test. IN NS ns.ex3.test.
+; Not actually valid signature, but content is here for the test.
+mid.foo2.test. IN RRSIG NS 3 3 3600 20070926134150 20070829134150 2854 mid.foo2.test. MCwCFCW3ix0GD4BSvNLWIbROCJt5DAW9AhRt/kg9kBKJ20UBUdumrBUHqnskdA==
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+x.mid.foo2.test. IN DS
+SECTION ANSWER
+; The DS and RRSIG content are for the test. Not actually DNSSEC valid,
+; but supposedly the zone is signed, and has a signed DS to the lower zone.
+x.mid.foo2.test. IN DS 30899 5 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
+x.mid.foo2.test. IN RRSIG DS 3 4 3600 20070926134150 20070829134150 2854 mid.foo2.test. MCwCFCW3ix0GD4BSvNLWIbROCJt5DAW9AhRt/kg9kBKJ20UBUdumrBUHqnskdA==
+SECTION AUTHORITY
+ENTRY_END
+RANGE_END
+
+; ns.foo3.test.
+; This server hosts a number of zones.
+; foo3.test
+; mid.foo3.test
+; x.mid.foo3.test
+RANGE_BEGIN 0 200
+	ADDRESS 192.5.0.6
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.foo3.test. IN A
+SECTION ANSWER
+ns.foo3.test. IN A 192.5.0.6
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.foo3.test. IN AAAA
+SECTION AUTHORITY
+foo3.test. IN SOA a. b. 1 2 3 4 5
+ENTRY_END
+
+; This answer is too low, for the DS query, it should have been answered
+; from a higher zone. This starts DSNS find.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+x.mid.foo3.test. IN DS
+SECTION ANSWER
+SECTION AUTHORITY
+x.mid.foo3.test. IN SOA a. b. 1 2 3 4 5
+ENTRY_END
+
+; The middle zone is actually hosted on this server, and this is its
+; child side NS record.
+; But since this nameserver gives the wrong answer, from the wrong zone
+; for qtype DS, it is not going to resolve the DS lookup from mid.foo3.test,
+; but from x.mid.foo3.test instead. This can happen for a server that does
+; not support DNSSEC, and qtype DS then has lookup in the zone for it.
+; Servers that support DNSSEC are supposed to pick the right zone for the
+; qtype DS lookup in the multiple zone situation.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+mid.foo3.test. IN NS
+SECTION ANSWER
+mid.foo3.test. IN NS ns.foo3.test.
+ENTRY_END
+RANGE_END
+
+; ns.foo4.test.
+; This server hosts a number of zones.
+; foo4.test
+; mid.foo4.test
+; x.mid.foo4.test
+RANGE_BEGIN 0 200
+	ADDRESS 192.5.0.7
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.foo4.test. IN A
+SECTION ANSWER
+ns.foo4.test. IN A 192.5.0.7
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.foo4.test. IN AAAA
+SECTION AUTHORITY
+foo4.test. IN SOA a. b. 1 2 3 4 5
+ENTRY_END
+
+; The server supports DNSSEC, it hosts the correct zone for the answer,
+; and it uses the mid.foo4.test zone for the qtype DS answer.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+x.mid.foo4.test. IN DS
+SECTION ANSWER
+x.mid.foo4.test. IN DS 30899 5 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
+x.mid.foo4.test. IN RRSIG DS 3 4 3600 20070926134150 20070829134150 2854 mid.foo4.test. MCwCFCW3ix0GD4BSvNLWIbROCJt5DAW9AhRt/kg9kBKJ20UBUdumrBUHqnskdA==
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+x.mid.foo.test. IN DS
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA DO NOERROR
+SECTION QUESTION
+x.mid.foo.test. IN DS
+SECTION ANSWER
+x.mid.foo.test. IN DS 30899 5 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
+x.mid.foo.test. IN RRSIG DS 3 4 3600 20070926134150 20070829134150 2854 mid.foo.test. MCwCFCW3ix0GD4BSvNLWIbROCJt5DAW9AhRt/kg9kBKJ20UBUdumrBUHqnskdA==
+ENTRY_END
+RANGE_END
+
+; to resolve pending messages for nameserver lookups.
+STEP 20 TRAFFIC
+
+STEP 30 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+x.mid.foo2.test. IN DS
+ENTRY_END
+
+STEP 40 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA DO NOERROR
+SECTION QUESTION
+x.mid.foo2.test. IN DS
+SECTION ANSWER
+x.mid.foo2.test. IN DS 30899 5 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
+x.mid.foo2.test. IN RRSIG DS 3 4 3600 20070926134150 20070829134150 2854 mid.foo2.test. MCwCFCW3ix0GD4BSvNLWIbROCJt5DAW9AhRt/kg9kBKJ20UBUdumrBUHqnskdA==
+ENTRY_END
+
+; to resolve pending messages for nameserver lookups.
+STEP 50 TRAFFIC
+
+STEP 60 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+x.mid.foo3.test. IN DS
+ENTRY_END
+
+STEP 70 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA DO NOERROR
+SECTION QUESTION
+x.mid.foo3.test. IN DS
+SECTION AUTHORITY
+x.mid.foo3.test. IN SOA a. b. 1 2 3 4 5
+ENTRY_END
+
+; to resolve pending messages for nameserver lookups.
+STEP 80 TRAFFIC
+
+STEP 90 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+x.mid.foo4.test. IN DS
+ENTRY_END
+
+STEP 100 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA DO NOERROR
+SECTION QUESTION
+x.mid.foo4.test. IN DS
+SECTION ANSWER
+x.mid.foo4.test. IN DS 30899 5 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
+x.mid.foo4.test. IN RRSIG DS 3 4 3600 20070926134150 20070829134150 2854 mid.foo4.test. MCwCFCW3ix0GD4BSvNLWIbROCJt5DAW9AhRt/kg9kBKJ20UBUdumrBUHqnskdA==
+ENTRY_END
+
+SCENARIO_END
@@ -0,0 +1,215 @@
+; EXP testbound scenario for <finding-id>
+; Tests: malicious NSEC3 in referral response triggers wipeout over-deletion
+;
+; Scenario:
+; 1. Query www.sub.example.com (A) - triggers referral from example.com
+; 2. The referral includes a malicious NSEC3 with oversized next owner
+;    (200 'v' chars = 125 bytes raw, > 63 LDNS_MAX_LABELLEN)
+; 3. The malicious NSEC3 enters val_neg_addreferral -> neg_insert_data -> wipeout
+; 4. wipeout over-deletes existing neg cache entries
+; 5. The query still resolves (the referral is valid), but the neg cache
+;    is now corrupted
+
+server:
+	trust-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
+	val-override-date: "20070916134226"
+	target-fetch-policy: "0 0 0 0 0"
+	qname-minimisation: "no"
+	fake-sha1: yes
+	trust-anchor-signaling: no
+	module-config: "validator iterator"
+	aggressive-nsec: yes
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129
+CONFIG_END
+
+SCENARIO_BEGIN EXP: malicious NSEC3 in referral triggers wipeout
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.    IN NS   a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.     IN      A       192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.    IN NS   ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN DNSKEY
+SECTION ANSWER
+example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
+example.com. 3600    IN      RRSIG   DNSKEY DSA 2 3600 20070926134150 20070829134150 2854 example.com. MCwCFBQRtlR4BEv9ohi+PGFjp+AHsJuHAhRCvz0shggvnvI88DFnBDCczHUcVA== ;{id = 2854}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; DS query response: no DS for sub.example.com (NODATA with NSEC3 proof)
+; This is a separate query from the validator to verify the delegation
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+sub.example.com. IN DS
+SECTION AUTHORITY
+example.com.	IN SOA	ns.example.com. hostmaster.example.com. 2007090400 28800 7200 604800 18000
+example.com.    3600    IN      RRSIG   SOA 3 2 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCM6lsu9byZIQ1yYjJmyYfFWM2RWAIUcR5t84r2La824oWCkLjmHXRQlco= ;{id = 2854}
+; NODATA response with NSEC3 proof
+; H(sub.example.com.) = kg19n32806c832kijdnglq8p9m2r5mdj
+kg19n32806c832kijdnglq8p9m2r5mdj.example.com.	3600	IN	NSEC3	1 0 0 -  kg19n32806c832kijdnglq8p9m2r5mdk NS RRSIG
+kg19n32806c832kijdnglq8p9m2r5mdj.example.com.	3600	IN	RRSIG	NSEC3 3 3 3600 20070926134150 20070829134150 2854 example.com. AD1ed7zhMyd/S4fTCwip94DwMbiDV1lF+11zFI/yeR4R7k/n0Hh7GcE=
+ENTRY_END
+
+; REFERRAL response with MALICIOUS NSEC3
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION ANSWER
+SECTION AUTHORITY
+sub.example.com. IN	NS ns.sub.example.com.
+; MALICIOUS NSEC3: next owner = vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv (125 bytes, all 0xFF)
+aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.example.com.	3600	IN	NSEC3	1 0 0 - vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv NS RRSIG
+aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.example.com.	3600	IN	RRSIG	NSEC3 3 3 3600 20070926134150 20070829134150 2854 example.com. AC8XUZo1he4odxG32SfOzFznQn83N4/gJv8AWE0wzrbPO+bbO80+0pg=
+
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.3.6
+ENTRY_END
+
+RANGE_END
+
+; ns.sub.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.6
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+sub.example.com. IN NS
+SECTION ANSWER
+sub.example.com. IN	NS ns.sub.example.com.
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.3.6
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+sub.example.com. IN DNSKEY
+SECTION ANSWER
+sub.example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
+sub.example.com.        3600    IN      RRSIG   DNSKEY 3 3 3600 20070926135752 20070829135752 2854 sub.example.com. MCwCFBznBTYM/SrdUnjQdBnLtRO79KAaAhQReG5nRuL7Xsdf6D0KKwPa1GpWyQ== ;{id = 2854}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION ANSWER
+www.sub.example.com. IN A 11.11.11.11
+www.sub.example.com.    3600    IN      RRSIG   A 3 4 3600 20070926135752 20070829135752 2854 sub.example.com. MC0CFEExteiCsLkRi/md6o5K8BhRJAKFAhUAgg2tkvwaDn8Xbm9q+5xnjvgIB8k= ;{id = 2854}
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.sub.example.com. IN A
+ENTRY_END
+
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA DO NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION ANSWER
+www.sub.example.com. 	3600	IN	A	11.11.11.11
+www.sub.example.com.    3600    IN      RRSIG   A 3 4 3600 20070926135752 20070829135752 2854 sub.example.com. MC0CFEExteiCsLkRi/md6o5K8BhRJAKFAhUAgg2tkvwaDn8Xbm9q+5xnjvgIB8k= ;{id = 2854}
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ENTRY_END
+
+SCENARIO_END
@@ -107,7 +107,12 @@ check_expected_stats () {
 # Check that the rest (unspecified) stats are all 0 (no surprises).
 check_rest_stats () {
 	echo "> Checking rest stats"
-	grep -F -x -v -f $EXPECTED_STATS_FILE $FILTERED_STATS_FILE > $REST_STATS_FILE
+	grep -F -x -v -f $EXPECTED_STATS_FILE $FILTERED_STATS_FILE | \
+		grep -F -v -e "msg.cache.max_collisions" \
+			-e "rrset.cache.max_collisions" | \
+		> $REST_STATS_FILE
+	# It filtered out the 'max_collisions', since at random, a msg
+	# or rrset cache entry could have a cache hash collision. */
 	if test $DEBUG -ne 0; then
 		echo "Rest:"
 		cat $REST_STATS_FILE
@@ -0,0 +1,390 @@
+; config options
+server:
+	target-fetch-policy: "0 0 0 0 0"
+	qname-minimisation: "no"
+	module-config: "dns64 subnetcache validator iterator"
+	dns64-prefix: 64:ff9b::0/96
+	dns64-ignore-aaaa: ip6ignore.example.com
+	dns64-ignore-aaaa: ip6only.example.com
+	minimal-responses: no
+	iter-scrub-promiscuous: no
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test dns64 lookup and synthesis with subnetmodule enabled.
+; This checks if the results are in cache properly for ordinary dns64
+; functioning while the subnet cache module is enabled.
+
+; normal A lookup should still succeed
+; AAAA is synthesized if not present.
+; AAAA if present, is passed through unchanged.
+; AAAA if present (but configured to be ignored) but no A, AAAA is passed through unchanged.
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 200
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+7.6.5.in-addr.arpa. IN A
+SECTION AUTHORITY
+7.6.5.in-addr.arpa. IN NS ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN	A	1.2.3.4
+ENTRY_END
+
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 200
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 200
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ip4.example.com. IN AAAA
+SECTION ANSWER
+; NO AAAA present
+SECTION AUTHORITY
+example.com.	IN SOA	a. b. 1 2 3 4 5
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ip4.example.com. IN A
+SECTION ANSWER
+ip4.example.com. IN A	5.6.7.8
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ip6.example.com. IN AAAA
+SECTION ANSWER
+ip6.example.com. IN AAAA 1:2:3::4
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ip6ignore.example.com. IN AAAA
+SECTION ANSWER
+ip6ignore.example.com. IN AAAA 1:2:3::4
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ip6ignore.example.com. IN A
+SECTION ANSWER
+ip6ignore.example.com. IN A	5.6.7.8
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ip6only.example.com. IN AAAA
+SECTION ANSWER
+ip6only.example.com. IN AAAA 1:2:3::4
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ip6only.example.com. IN A
+SECTION ANSWER
+; NO A present
+SECTION AUTHORITY
+example.com.	IN SOA	a. b. 1 2 3 4 5
+ENTRY_END
+
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+8.7.6.5.in-addr.arpa. IN PTR
+SECTION ANSWER
+8.7.6.5.in-addr.arpa. PTR ip4.example.com.
+SECTION AUTHORITY
+7.6.5.in-addr.arpa. IN NS ns.example.com.
+ENTRY_END
+
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+; synthesize from A record 5.6.7.8
+STEP 20 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+ip4.example.com. IN AAAA
+ENTRY_END
+
+; recursion happens here.
+STEP 30 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+ip4.example.com. IN AAAA
+SECTION ANSWER
+ip4.example.com.        IN      AAAA    64:ff9b::506:708
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+STEP 32 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+ip4.example.com. IN AAAA
+ENTRY_END
+
+; cached response for it.
+STEP 33 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+ip4.example.com. IN AAAA
+SECTION ANSWER
+ip4.example.com.        IN      AAAA    64:ff9b::506:708
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+; this node has its own ipv6 address
+STEP 40 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+ip6.example.com. IN AAAA
+ENTRY_END
+
+; recursion happens here.
+STEP 50 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+ip6.example.com. IN AAAA
+SECTION ANSWER
+ip6.example.com. IN AAAA 1:2:3::4
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+; test ptr lookup
+STEP 60 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+8.0.7.0.6.0.5.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.b.9.f.f.4.6.0.0.ip6.arpa. IN PTR
+ENTRY_END
+
+; recursion happens here.
+STEP 70 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+8.0.7.0.6.0.5.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.b.9.f.f.4.6.0.0.ip6.arpa. IN PTR
+SECTION ANSWER
+8.0.7.0.6.0.5.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.b.9.f.f.4.6.0.0.ip6.arpa. IN PTR ip4.example.com.
+SECTION AUTHORITY
+7.6.5.in-addr.arpa. IN NS ns.example.com.
+ENTRY_END
+
+; ignore AAAA and synthesize from A record 5.6.7.8
+STEP 80 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+ip6ignore.example.com. IN AAAA
+ENTRY_END
+
+; recursion happens here.
+STEP 90 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+ip6ignore.example.com. IN AAAA
+SECTION ANSWER
+ip6ignore.example.com.        IN      AAAA    64:ff9b::506:708
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+; try to ignore AAAA but no A record to synthesize, fallback to AAAA
+STEP 100 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+ip6only.example.com. IN AAAA
+ENTRY_END
+
+; recursion happens here.
+STEP 110 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+ip6only.example.com. IN AAAA
+SECTION ANSWER
+ip6only.example.com.        IN      AAAA    1:2:3::4
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+SCENARIO_END
@@ -90,3 +90,11 @@ v18	HTTPS	16 foo.example.org. (alpn=h2,h3-19 mandatory=ipv4hint,alpn
 v19	HTTPS	16 foo.example.org. alpn="f\\\\oo\\,bar,h2"
 v20	HTTPS	16 foo.example.org. alpn=f\\\092oo\092,bar,h2

+; This vector is out-of-order in the wireformat encoding. That could come
+; from an upstream when this is the secondary zone. To leniently accept such
+; content as a secondary, it has to be able to be written and read back in.
+v21	HTTPS	1 . alpn="h3" port=7777
+
+; If the server can leniently accept broken svcparams, then it should be able
+; to write and read them back in. This svcparam is broken, it is truncated.
+v22	HTTPS	\# 8 000100000300021e
@@ -230,3 +230,11 @@ v20	HTTPS	\# 35 (
 68 32                                              ; alpn value
 )

+; This vector is out-of-order in the wireformat encoding. That could come
+; from an upstream when this is the secondary zone. To leniently accept such
+; content as a secondary, it has to be able to be written and read back in.
+v21	HTTPS	\# 16 000100000300021e6100010003026833
+
+; If the server can leniently accept broken svcparams, then it should be able
+; to write and read them back in. This svcparam is broken, it is truncated.
+v22	HTTPS	\# 8 000100000300021e
@@ -0,0 +1,602 @@
+; config options
+; The island of trust is at example.com
+server:
+	trust-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
+	val-override-date: "20070916134226"
+	target-fetch-policy: "0 0 0 0 0"
+	qname-minimisation: "no"
+	fake-sha1: yes
+	trust-anchor-signaling: no
+	minimal-responses: no
+	ede: yes
+	# this is not the limit that is tested here.
+	val-hash-attempts: 128
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test validator with too many tag matches
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.    IN NS   a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.     IN      A       192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.    IN NS   ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; response to DNSKEY priming query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN DNSKEY
+SECTION ANSWER
+example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
+example.com.    3600    IN      RRSIG   DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+sub1.example.com. IN A
+SECTION ANSWER
+SECTION AUTHORITY
+sub1.example.com.	IN NS	ns.sub1.example.com.
+
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	3539 13 2 2e33e1da915795ab2412fa116cab8b219707135aa6bcc48a5f8b1ca097c5a297
+sub1.example.com.	IN	DS	12688 13 2 87a10b8df44945b7dae0c12c98f82d04992587a8e0a2ed823b0789dd48fe889f
+sub1.example.com.	IN	DS	13058 13 2 e8f15b542b537cb7b4a2370575988d5e6dc58c495fe695961fc482be580396fa
+sub1.example.com.	IN	DS	18006 13 2 2a35a6f7d086c11493d34712ac819f74baaa674399d5d478fd056d0227c17b83
+sub1.example.com.	IN	DS	18279 13 2 4a4c9053b35a89d4ba1453fb8c0df658c6f473aa9042dabc9269f00e888751be
+sub1.example.com.	IN	DS	20669 13 2 6958b937ef837d76361e03eb11e780de5ee65e44faac5ec19daecdb9e4722b0d
+sub1.example.com.	IN	DS	25106 13 2 56bbbbaee440eb3649afebdd6a806105bdc345613bffa156b9b5f708cddb44cf
+sub1.example.com.	IN	DS	25932 13 2 76c6e7506e9b7306e547913d35e4cc9162c2cf3000b9b62cc0acb21c5e85b960
+sub1.example.com.	IN	DS	27845 13 2 ed630a116a6049eb5ccdd3f46aa09228bde76a0f3c43ac40731d3ebcdb65c161
+sub1.example.com.	IN	DS	29183 13 2 2a573047cd9945ec15aa6278dc3cd908d59732fa253ebffed6b35485e4e3d6f9
+sub1.example.com.	IN	DS	30380 13 2 a1dac7f7185404ca826ce62c5ec57b50f5584ee86e762c809af3f5ebc207f0a8
+sub1.example.com.	IN	DS	31753 13 2 c811dca5f7cfb8d82be1c145b1bf0f5f6275bed42f31ffdec45fb7ba54d76564
+sub1.example.com.	IN	DS	32621 13 2 4ba7774dbfa9115c6a188dce790b6b45480e0aa5c39602be08ccc139c68492de
+sub1.example.com.	IN	DS	33127 13 2 d45c3cbcc4cb71d53c80374efe2b6081e9d1add53bae66fb6bf61028b68d3cf9
+sub1.example.com.	IN	DS	37404 13 2 2480a04461a7425a5d897921eb6b493428abaf46ed6809f3fac53fd1465415ab
+sub1.example.com.	IN	DS	38693 13 2 ad6a97280b20cf4eac60c9e70db9712a5357d12166993f55c201b91d2b4c1ff5
+sub1.example.com.	IN	DS	40580 13 2 93ace4ec403fd790d1debb05f539f58797822fc75ac3dd0d7e2f8b1d3fdb126d
+sub1.example.com.	IN	DS	43985 13 2 2c8f7712ebd5fd18df7e6e58995b13d8204b258322078f473d5c28a76c03b8d7
+sub1.example.com.	IN	DS	44725 13 2 9e6631ddbc09355f8891c7713d8703c4e213d8c51b1126826d31c05a4b7991be
+sub1.example.com.	IN	DS	44975 13 2 4ea12a0336c18766537d195c608ce76a7ab7cbb5cce873a65fe0d9a662fcd9aa
+sub1.example.com.	IN	DS	49819 13 2 c7f1a7b39c26ffab7ff3775624a2e40aa73af44c84ebd80442c52cdb1abb991e
+sub1.example.com.	IN	DS	56088 13 2 653cff8afa5cda5d6efda676c2a73eccc3301f7e32437bff72a8b761fa1b6379
+sub1.example.com.	IN	DS	58926 13 2 39000f49e8914dee8602795fd559ac2b0b4d434da4c8d1908936e9acc0e42485
+sub1.example.com.	3600	IN	RRSIG	DS 3 3 3600 20070926134150 20070829134150 2854 example.com. AA2wcVQsxCw2VQcgrSp2zjxYP5ElbMVNMMdc/pMU77k5VkMThtZKygE=
+SECTION ADDITIONAL
+ns.sub1.example.com.		IN 	A	1.2.3.5
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+sub2.example.com. IN A
+SECTION ANSWER
+SECTION AUTHORITY
+sub2.example.com.	IN NS	ns.sub2.example.com.
+
+; With this one DS record it works for sub2.example.com, since not that
+; many DNSKEY to RRSIG attempts are made.
+;sub2.example.com.	3600	IN	RRSIG	DS 3 3 3600 20070926134150 20070829134150 2854 example.com. AHyR2q4kMaOs9/SFLRgftMXPMu0CQRjRk8z2+3M7VAcnKzIck7VAcl0=
+; Here with 8 DS records, that match.
+sub2.example.com.	3600	IN	DS	3539 13 2 e94cf5357bdb8ce5423a0a5eacf564105ea1935fbf813c76bcc13eb34594167c
+sub2.example.com.	3600	IN	DS	12688 13 2 73d5613cba9bfe510ffa8241c20277d78b57a28d9b1d3c8ad23c2032fbe86a78
+sub2.example.com.	3600	IN	DS	13058 13 2 12e107e5a4c72620cfcdfe7c4186eccaf1b46501afb7bb3ca9e395a083e16fea
+sub2.example.com.	3600	IN	DS	18006 13 2 7a3525ee9385e36a2819a3b0e650f0aff4788b787d6ef7870d4956692b1d6feb
+sub2.example.com.	3600	IN	DS	18279 13 2 8a900772c1ff65553343920868996b2cf3be2dc5bdf182e962cb996dbd3f1682
+sub2.example.com.	3600	IN	DS	20669 13 2 54ad32be8029ce48cb6d45ffbdba918c11e70fbd416c2f3501321a4fcc2692c8
+sub2.example.com.	3600	IN	DS	25106 13 2 a6c125c2be2f301888e16255405d994c1b31ccc3ca72217399ae2a16c721cbeb
+sub2.example.com.	3600	IN	DS	20 13 2 87f0229abc95a9a463e15e572c52869224ac07098e72ec7bacf0b3e358e44674
+sub2.example.com.	3600	IN	RRSIG	DS 3 3 3600 20070926134150 20070829134150 2854 example.com. AFluwWeqE8NSEI+u1S+pDZBfgdBvbXBeGez5Wf35ojP0HIW+MIFCWL4=
+
+SECTION ADDITIONAL
+ns.sub2.example.com.		IN 	A	1.2.3.6
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+sub3.example.com. IN A
+SECTION ANSWER
+SECTION AUTHORITY
+sub3.example.com.	IN NS	ns.sub3.example.com.
+sub3.example.com.	3600	IN	DS	20 13 2 64d2a1243b619ba0b1f14912fd560f3e9d27b0ae6f4df35625c74fe3015fb1d3
+sub3.example.com.	3600	IN	RRSIG	DS 3 3 3600 20070926134150 20070829134150 2854 example.com. AE7A38rpBCyGBEkqyQVqLHwFnjSmoIwOVEm5oh9bErGhqdB0fIF2ddw=
+SECTION ADDITIONAL
+ns.sub3.example.com.		IN 	A	1.2.3.7
+ENTRY_END
+RANGE_END
+
+; ns.sub1.example.com.
+; 24 DSes and 24 DNSKEYs
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.5
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.sub1.example.com. IN AAAA
+SECTION ANSWER
+SECTION AUTHORITY
+sub1.example.com. IN SOA a. b. 3600 3600 3600 3600 3600
+sub1.example.com.	3600	IN	RRSIG	SOA 13 3 3600 20070926134150 20070829134150 20 sub1.example.com. PyHa+O9jyNBtKuVilpPoqQGDKHdMCrfhm6A7GDj0+ZPXZAax/+hl10CVIUhl5YqCS3xGc3Zae/WNbD+1w3cIUQ==
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+sub1.example.com. IN DNSKEY
+SECTION ANSWER
+; These keys actually match the DS record, but to have more match attempts they
+; are altered, below.
+;sub1.example.com.	IN	DNSKEY	257 3 13 n2P99SKaAUDt50U/cToH/0TmGJKG8+Pbiwl1WY/f5EVWZD/auO5QEyY6Tm9kLHzAEOcjWR701V74ZgyFPirxIA== ;{id = 20 (ksk), size = 256b}
+;sub1.example.com.	IN	DNSKEY	257 3 13 2biK+rkC8P/MV/UMDbksGCov08Tya5wrtrjeDOSez5W1qFqqPKXzxuMxecGSXIYgNM8Y/m8XdlwOd8Q6vUuw5A== ;{id = 3539 (ksk), size = 256b}
+;sub1.example.com.	IN	DNSKEY	257 3 13 UeL+mKovo+r7+B3egif1JxCHPfmbR4SU4m3s0Fp42ozze0FiMzEwRM85O4aYViPOmu0AKgfwuRjEM5aEM1pBug== ;{id = 12688 (ksk), size = 256b}
+;sub1.example.com.	IN	DNSKEY	257 3 13 iFe//OnLHLGXpE9i+4y3H+NefdDTZAEwYzDv0U+OIzs37lnOEMYTVqBxkLA82JDKMtnjupCOtSXMoru7lQcckw== ;{id = 13058 (ksk), size = 256b}
+;sub1.example.com.	IN	DNSKEY	257 3 13 0/lAWEpW94Rkjion6aUxepvCO6MxoRRJ5aIX9fdEPjUJXCGeHviFLmeDnNzTB0egvC5CgthSnQfyxqMqbbuMAQ== ;{id = 18006 (ksk), size = 256b}
+;sub1.example.com.	IN	DNSKEY	257 3 13 P1rwuvxZ8tQOxtOHsbzHAIpMNkleGRtg7gynoesq2gSJT+NAmYRrk+BzEGvHWTHKWd5KnusSt2BpBBlWw5pLiw== ;{id = 18279 (ksk), size = 256b}
+;sub1.example.com.	IN	DNSKEY	257 3 13 WraqJ/JvyS8xQZOKpVscbAUuYU8lVCiuEHjekR0kADMP/eWOvdJkaPZ++REeHclBejqXp+NcP0dnyweObnZDsA== ;{id = 20669 (ksk), size = 256b}
+;sub1.example.com.	IN	DNSKEY	257 3 13 /fci65ankZ0cKOPdJAJBIyXHYGzjngEyqGbBVmeDk2RwAqxmyUB5OORRmlPMY80ipMU+e8Pt3itKpglwpT7qSA== ;{id = 25106 (ksk), size = 256b}
+;sub1.example.com.	IN	DNSKEY	257 3 13 MEfZQnvjQI/L/0QlglQ2YrxSCQ6fRruKF2aQ+nD5JV9ecE1AhA/RujbKkg9UrG4ScjqC7f0fhCW+eUqsSoUcTg== ;{id = 25932 (ksk), size = 256b}
+;sub1.example.com.	IN	DNSKEY	257 3 13 KbKK1C8ZtHNsBicJnjrvTB56BoTTjL9pvNEbRVwCKIcWYdNP8l3dpsvVEAZ/ujxmKRA/ToA7ua4/IBDtALFWvg== ;{id = 27845 (ksk), size = 256b}
+;sub1.example.com.	IN	DNSKEY	257 3 13 G3I9nIlyTOrn12D8luAgZR4ZTK+iNegzz9UG8b5YsC9IV4UtgbdZkoEDRsH2uu429qvezzlUsjTzR+fu/74Saw== ;{id = 29183 (ksk), size = 256b}
+;sub1.example.com.	IN	DNSKEY	257 3 13 fBgVewGRqRmvJUVm/ZQqPLynt1lM6ilPdENMd9uESPh30CzUsi8Q7tbGZoH52CJjpcb17z3zSjJv40ASVEBhNw== ;{id = 30380 (ksk), size = 256b}
+;sub1.example.com.	IN	DNSKEY	257 3 13 3LbmoAShX4cKq4qyIqHLI7+UH4/EVOaXCF7AhJHaRJsgbyCEwn4Ofjh6l15Pxbk/UH851tR8MBaaOz8+ROcL2A== ;{id = 31753 (ksk), size = 256b}
+;sub1.example.com.	IN	DNSKEY	257 3 13 xMfArWljU25/0ePkuncQHH8U+/NMLIqy3IpJ7IqcOKRXmR7hrY2dQ6MgBN1rUBW8Q7Uq3mFbozdJbr3oDeZcdQ== ;{id = 32621 (ksk), size = 256b}
+;sub1.example.com.	IN	DNSKEY	257 3 13 YsXykW60iTTY+1DY7CG9izDd+RAzx+oPUk2UBiHBPengMUmu3R9rgsJHYfjwWgYWB60sy0CPcdAeu+jD2tB4eA== ;{id = 33127 (ksk), size = 256b}
+;sub1.example.com.	IN	DNSKEY	257 3 13 wzS1uBaSWR+bTTYgtLm3jNxNnLSNv6abvnHABXQD5yDFs17rGqDCdvkk6JM3qI4BJ+npNLdADJZt118PWlQ7eQ== ;{id = 37404 (ksk), size = 256b}
+;sub1.example.com.	IN	DNSKEY	257 3 13 9nDuSJ9wRTsvFYubQ7KQyOmzlY+UzG1cESD8NK9eOj9VMX1O71d5GxBwzc4UtBs+kZBi49BLjZIV5qWbD9FbXQ== ;{id = 38693 (ksk), size = 256b}
+;sub1.example.com.	IN	DNSKEY	257 3 13 EFDgOhEi43zsVaJdytsq3HjtAh6dVDaAnR0PY7O0S4q/svucxOVxmJsG/2rXYMHTej9jRTg/qWWbW4gdReDoSQ== ;{id = 40580 (ksk), size = 256b}
+;sub1.example.com.	IN	DNSKEY	257 3 13 wq8UI3DydI9svWJEQ1G0JHGVHykgo3YXFF8CRG055gshZAVyfIiTRwCemG0mbziuobOeZSpCtK05KGp20NHRTA== ;{id = 43985 (ksk), size = 256b}
+;sub1.example.com.	IN	DNSKEY	257 3 13 wRMENWFMd+9c4p9agfd/3qLnum1SS555CP9lgJKtU0t7Q689SrAUwBJP7ymXTDGtWSjlFBzbts6SUARX47SK1Q== ;{id = 44725 (ksk), size = 256b}
+;sub1.example.com.	IN	DNSKEY	257 3 13 zeWh2eFjuwp9K9yaJq16XMVNC8Ys0TOk91eYkGa0Dgez59aG/PvPYV1qi9pxbmG/c4tuXcRV9Z9cxcVev9DdYw== ;{id = 44975 (ksk), size = 256b}
+;sub1.example.com.	IN	DNSKEY	257 3 13 O/y794Mc/kIwRltqnqj+puIS1ejFQeE9Xmjz1NVU82x+UyEvx2InNpwaU2TFNKaT7aned72CE1u//CahV6zeEg== ;{id = 49819 (ksk), size = 256b}
+;sub1.example.com.	IN	DNSKEY	257 3 13 edr2Ai2uObWeVfFjvCF01Xa9SQD706baatsttcUuI4MblMTNG4blOSN1pMpZJ/wymkqt4c7eQSCETlD/mPeWPQ== ;{id = 56088 (ksk), size = 256b}
+;sub1.example.com.	IN	DNSKEY	257 3 13 PlfsudScPXH3VdDVv6nnuBEXQpP6coF6F2w99u4Es5VbJHZrgFhvxL9os0jnfiGCL6VJ0Q+bNKnzfoP3ByP1Kg== ;{id = 58926 (ksk), size = 256b}
+;sub1.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 20 sub1.example.com. p6ScxBgybYLIhpD9SVDSquhPsytpehEUVncg2zRoXTxkuKXUsQIDKUuLhZxgeHNAnkKQn8e3xnoDWCGQbqA7tA==
+
+; The altered keys, with 'AAAA' at the end.
+sub1.example.com.	IN	DNSKEY	257 3 13 n2P99SKaAUDt50U/cToH/0TmGJKG8+Pbiwl1WY/f5EVWZD/auO5QEyY6Tm9kLHzAEOcjWR701V74ZgyFPiAAAA== ;{id = 20 (ksk), size = 256b}
+sub1.example.com.	IN	DNSKEY	257 3 13 2biK+rkC8P/MV/UMDbksGCov08Tya5wrtrjeDOSez5W1qFqqPKXzxuMxecGSXIYgNM8Y/m8XdlwOd8Q6vAAAAA== ;{id = 3539 (ksk), size = 256b}
+sub1.example.com.	IN	DNSKEY	257 3 13 UeL+mKovo+r7+B3egif1JxCHPfmbR4SU4m3s0Fp42ozze0FiMzEwRM85O4aYViPOmu0AKgfwuRjEM5aEM1AAAA== ;{id = 12688 (ksk), size = 256b}
+sub1.example.com.	IN	DNSKEY	257 3 13 iFe//OnLHLGXpE9i+4y3H+NefdDTZAEwYzDv0U+OIzs37lnOEMYTVqBxkLA82JDKMtnjupCOtSXMoru7lQAAAA== ;{id = 13058 (ksk), size = 256b}
+sub1.example.com.	IN	DNSKEY	257 3 13 0/lAWEpW94Rkjion6aUxepvCO6MxoRRJ5aIX9fdEPjUJXCGeHviFLmeDnNzTB0egvC5CgthSnQfyxqMqbbAAAA== ;{id = 18006 (ksk), size = 256b}
+sub1.example.com.	IN	DNSKEY	257 3 13 P1rwuvxZ8tQOxtOHsbzHAIpMNkleGRtg7gynoesq2gSJT+NAmYRrk+BzEGvHWTHKWd5KnusSt2BpBBlWw5AAAA== ;{id = 18279 (ksk), size = 256b}
+sub1.example.com.	IN	DNSKEY	257 3 13 WraqJ/JvyS8xQZOKpVscbAUuYU8lVCiuEHjekR0kADMP/eWOvdJkaPZ++REeHclBejqXp+NcP0dnyweObnAAAA== ;{id = 20669 (ksk), size = 256b}
+sub1.example.com.	IN	DNSKEY	257 3 13 /fci65ankZ0cKOPdJAJBIyXHYGzjngEyqGbBVmeDk2RwAqxmyUB5OORRmlPMY80ipMU+e8Pt3itKpglwpTAAAA== ;{id = 25106 (ksk), size = 256b}
+sub1.example.com.	IN	DNSKEY	257 3 13 MEfZQnvjQI/L/0QlglQ2YrxSCQ6fRruKF2aQ+nD5JV9ecE1AhA/RujbKkg9UrG4ScjqC7f0fhCW+eUqsSoAAAA== ;{id = 25932 (ksk), size = 256b}
+sub1.example.com.	IN	DNSKEY	257 3 13 KbKK1C8ZtHNsBicJnjrvTB56BoTTjL9pvNEbRVwCKIcWYdNP8l3dpsvVEAZ/ujxmKRA/ToA7ua4/IBDtALAAAA== ;{id = 27845 (ksk), size = 256b}
+sub1.example.com.	IN	DNSKEY	257 3 13 G3I9nIlyTOrn12D8luAgZR4ZTK+iNegzz9UG8b5YsC9IV4UtgbdZkoEDRsH2uu429qvezzlUsjTzR+fu/7AAAA== ;{id = 29183 (ksk), size = 256b}
+sub1.example.com.	IN	DNSKEY	257 3 13 fBgVewGRqRmvJUVm/ZQqPLynt1lM6ilPdENMd9uESPh30CzUsi8Q7tbGZoH52CJjpcb17z3zSjJv40ASVEAAAA== ;{id = 30380 (ksk), size = 256b}
+sub1.example.com.	IN	DNSKEY	257 3 13 3LbmoAShX4cKq4qyIqHLI7+UH4/EVOaXCF7AhJHaRJsgbyCEwn4Ofjh6l15Pxbk/UH851tR8MBaaOz8+ROAAAA== ;{id = 31753 (ksk), size = 256b}
+sub1.example.com.	IN	DNSKEY	257 3 13 xMfArWljU25/0ePkuncQHH8U+/NMLIqy3IpJ7IqcOKRXmR7hrY2dQ6MgBN1rUBW8Q7Uq3mFbozdJbr3oDeAAAA== ;{id = 32621 (ksk), size = 256b}
+sub1.example.com.	IN	DNSKEY	257 3 13 YsXykW60iTTY+1DY7CG9izDd+RAzx+oPUk2UBiHBPengMUmu3R9rgsJHYfjwWgYWB60sy0CPcdAeu+jD2tAAAA== ;{id = 33127 (ksk), size = 256b}
+sub1.example.com.	IN	DNSKEY	257 3 13 wzS1uBaSWR+bTTYgtLm3jNxNnLSNv6abvnHABXQD5yDFs17rGqDCdvkk6JM3qI4BJ+npNLdADJZt118PWlAAAA== ;{id = 37404 (ksk), size = 256b}
+sub1.example.com.	IN	DNSKEY	257 3 13 9nDuSJ9wRTsvFYubQ7KQyOmzlY+UzG1cESD8NK9eOj9VMX1O71d5GxBwzc4UtBs+kZBi49BLjZIV5qWbD9AAAA== ;{id = 38693 (ksk), size = 256b}
+sub1.example.com.	IN	DNSKEY	257 3 13 EFDgOhEi43zsVaJdytsq3HjtAh6dVDaAnR0PY7O0S4q/svucxOVxmJsG/2rXYMHTej9jRTg/qWWbW4gdReAAAA== ;{id = 40580 (ksk), size = 256b}
+sub1.example.com.	IN	DNSKEY	257 3 13 wq8UI3DydI9svWJEQ1G0JHGVHykgo3YXFF8CRG055gshZAVyfIiTRwCemG0mbziuobOeZSpCtK05KGp20NAAAA== ;{id = 43985 (ksk), size = 256b}
+sub1.example.com.	IN	DNSKEY	257 3 13 wRMENWFMd+9c4p9agfd/3qLnum1SS555CP9lgJKtU0t7Q689SrAUwBJP7ymXTDGtWSjlFBzbts6SUARX47AAAA== ;{id = 44725 (ksk), size = 256b}
+sub1.example.com.	IN	DNSKEY	257 3 13 zeWh2eFjuwp9K9yaJq16XMVNC8Ys0TOk91eYkGa0Dgez59aG/PvPYV1qi9pxbmG/c4tuXcRV9Z9cxcVev9AAAA== ;{id = 44975 (ksk), size = 256b}
+sub1.example.com.	IN	DNSKEY	257 3 13 O/y794Mc/kIwRltqnqj+puIS1ejFQeE9Xmjz1NVU82x+UyEvx2InNpwaU2TFNKaT7aned72CE1u//CahV6AAAA== ;{id = 49819 (ksk), size = 256b}
+sub1.example.com.	IN	DNSKEY	257 3 13 edr2Ai2uObWeVfFjvCF01Xa9SQD706baatsttcUuI4MblMTNG4blOSN1pMpZJ/wymkqt4c7eQSCETlD/mPAAAA== ;{id = 56088 (ksk), size = 256b}
+sub1.example.com.	IN	DNSKEY	257 3 13 PlfsudScPXH3VdDVv6nnuBEXQpP6coF6F2w99u4Es5VbJHZrgFhvxL9os0jnfiGCL6VJ0Q+bNKnzfoP3ByAAAA== ;{id = 58926 (ksk), size = 256b}
+sub1.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 20 sub1.example.com. p6ScxBgybYLIhpD9SVDSquhPsytpehEUVncg2zRoXTxkuKXUsQIDKUuLhZxgeHNAnkKQn8e3xnoDWCGQbqA7tA==
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.sub1.example.com. IN A
+SECTION ANSWER
+www.sub1.example.com. IN A	10.20.30.41
+www.sub1.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 20 sub1.example.com. utG2+wuHSbmyQCaIjL7ElDe3DJCMqZGrPqsOEyJj8ljGGa5JaTY+KdYvZ6oGmprV7utRPNyRormou1zRWoG8ew==
+ENTRY_END
+RANGE_END
+
+; ns.sub2.example.com.
+; 24 DNSKEYs with 24 RRSIGs on DNSKEY, that works with one DS.
+; 8 DS with 24 DNSKEYs with 40 RRSIGs on DNSKEY.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.6
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.sub2.example.com. IN AAAA
+SECTION ANSWER
+SECTION AUTHORITY
+sub2.example.com. IN SOA a. b. 3600 3600 3600 3600 3600
+sub2.example.com.	3600	IN	RRSIG	SOA 13 3 3600 20070926134150 20070829134150 20 sub2.example.com. Uzdsj01UwK807QiRzTxZffHYpd7uEDEfPwbH4XsVilR238gk/fObaNBVij8Y2HiZHmch8I7GeNqB6RXpKQKU1w==
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+sub2.example.com. IN DNSKEY
+SECTION ANSWER
+sub2.example.com.	IN	DNSKEY	257 3 13 n2P99SKaAUDt50U/cToH/0TmGJKG8+Pbiwl1WY/f5EVWZD/auO5QEyY6Tm9kLHzAEOcjWR701V74ZgyFPirxIA== ;{id = 20 (ksk), size = 256b}
+sub2.example.com.	IN	DNSKEY	257 3 13 2biK+rkC8P/MV/UMDbksGCov08Tya5wrtrjeDOSez5W1qFqqPKXzxuMxecGSXIYgNM8Y/m8XdlwOd8Q6vUuw5A== ;{id = 3539 (ksk), size = 256b}
+sub2.example.com.	IN	DNSKEY	257 3 13 UeL+mKovo+r7+B3egif1JxCHPfmbR4SU4m3s0Fp42ozze0FiMzEwRM85O4aYViPOmu0AKgfwuRjEM5aEM1pBug== ;{id = 12688 (ksk), size = 256b}
+sub2.example.com.	IN	DNSKEY	257 3 13 iFe//OnLHLGXpE9i+4y3H+NefdDTZAEwYzDv0U+OIzs37lnOEMYTVqBxkLA82JDKMtnjupCOtSXMoru7lQcckw== ;{id = 13058 (ksk), size = 256b}
+sub2.example.com.	IN	DNSKEY	257 3 13 0/lAWEpW94Rkjion6aUxepvCO6MxoRRJ5aIX9fdEPjUJXCGeHviFLmeDnNzTB0egvC5CgthSnQfyxqMqbbuMAQ== ;{id = 18006 (ksk), size = 256b}
+sub2.example.com.	IN	DNSKEY	257 3 13 P1rwuvxZ8tQOxtOHsbzHAIpMNkleGRtg7gynoesq2gSJT+NAmYRrk+BzEGvHWTHKWd5KnusSt2BpBBlWw5pLiw== ;{id = 18279 (ksk), size = 256b}
+sub2.example.com.	IN	DNSKEY	257 3 13 WraqJ/JvyS8xQZOKpVscbAUuYU8lVCiuEHjekR0kADMP/eWOvdJkaPZ++REeHclBejqXp+NcP0dnyweObnZDsA== ;{id = 20669 (ksk), size = 256b}
+sub2.example.com.	IN	DNSKEY	257 3 13 /fci65ankZ0cKOPdJAJBIyXHYGzjngEyqGbBVmeDk2RwAqxmyUB5OORRmlPMY80ipMU+e8Pt3itKpglwpT7qSA== ;{id = 25106 (ksk), size = 256b}
+sub2.example.com.	IN	DNSKEY	257 3 13 MEfZQnvjQI/L/0QlglQ2YrxSCQ6fRruKF2aQ+nD5JV9ecE1AhA/RujbKkg9UrG4ScjqC7f0fhCW+eUqsSoUcTg== ;{id = 25932 (ksk), size = 256b}
+sub2.example.com.	IN	DNSKEY	257 3 13 KbKK1C8ZtHNsBicJnjrvTB56BoTTjL9pvNEbRVwCKIcWYdNP8l3dpsvVEAZ/ujxmKRA/ToA7ua4/IBDtALFWvg== ;{id = 27845 (ksk), size = 256b}
+sub2.example.com.	IN	DNSKEY	257 3 13 G3I9nIlyTOrn12D8luAgZR4ZTK+iNegzz9UG8b5YsC9IV4UtgbdZkoEDRsH2uu429qvezzlUsjTzR+fu/74Saw== ;{id = 29183 (ksk), size = 256b}
+sub2.example.com.	IN	DNSKEY	257 3 13 fBgVewGRqRmvJUVm/ZQqPLynt1lM6ilPdENMd9uESPh30CzUsi8Q7tbGZoH52CJjpcb17z3zSjJv40ASVEBhNw== ;{id = 30380 (ksk), size = 256b}
+sub2.example.com.	IN	DNSKEY	257 3 13 3LbmoAShX4cKq4qyIqHLI7+UH4/EVOaXCF7AhJHaRJsgbyCEwn4Ofjh6l15Pxbk/UH851tR8MBaaOz8+ROcL2A== ;{id = 31753 (ksk), size = 256b}
+sub2.example.com.	IN	DNSKEY	257 3 13 xMfArWljU25/0ePkuncQHH8U+/NMLIqy3IpJ7IqcOKRXmR7hrY2dQ6MgBN1rUBW8Q7Uq3mFbozdJbr3oDeZcdQ== ;{id = 32621 (ksk), size = 256b}
+sub2.example.com.	IN	DNSKEY	257 3 13 YsXykW60iTTY+1DY7CG9izDd+RAzx+oPUk2UBiHBPengMUmu3R9rgsJHYfjwWgYWB60sy0CPcdAeu+jD2tB4eA== ;{id = 33127 (ksk), size = 256b}
+sub2.example.com.	IN	DNSKEY	257 3 13 wzS1uBaSWR+bTTYgtLm3jNxNnLSNv6abvnHABXQD5yDFs17rGqDCdvkk6JM3qI4BJ+npNLdADJZt118PWlQ7eQ== ;{id = 37404 (ksk), size = 256b}
+sub2.example.com.	IN	DNSKEY	257 3 13 9nDuSJ9wRTsvFYubQ7KQyOmzlY+UzG1cESD8NK9eOj9VMX1O71d5GxBwzc4UtBs+kZBi49BLjZIV5qWbD9FbXQ== ;{id = 38693 (ksk), size = 256b}
+sub2.example.com.	IN	DNSKEY	257 3 13 EFDgOhEi43zsVaJdytsq3HjtAh6dVDaAnR0PY7O0S4q/svucxOVxmJsG/2rXYMHTej9jRTg/qWWbW4gdReDoSQ== ;{id = 40580 (ksk), size = 256b}
+sub2.example.com.	IN	DNSKEY	257 3 13 wq8UI3DydI9svWJEQ1G0JHGVHykgo3YXFF8CRG055gshZAVyfIiTRwCemG0mbziuobOeZSpCtK05KGp20NHRTA== ;{id = 43985 (ksk), size = 256b}
+sub2.example.com.	IN	DNSKEY	257 3 13 wRMENWFMd+9c4p9agfd/3qLnum1SS555CP9lgJKtU0t7Q689SrAUwBJP7ymXTDGtWSjlFBzbts6SUARX47SK1Q== ;{id = 44725 (ksk), size = 256b}
+sub2.example.com.	IN	DNSKEY	257 3 13 zeWh2eFjuwp9K9yaJq16XMVNC8Ys0TOk91eYkGa0Dgez59aG/PvPYV1qi9pxbmG/c4tuXcRV9Z9cxcVev9DdYw== ;{id = 44975 (ksk), size = 256b}
+sub2.example.com.	IN	DNSKEY	257 3 13 O/y794Mc/kIwRltqnqj+puIS1ejFQeE9Xmjz1NVU82x+UyEvx2InNpwaU2TFNKaT7aned72CE1u//CahV6zeEg== ;{id = 49819 (ksk), size = 256b}
+sub2.example.com.	IN	DNSKEY	257 3 13 edr2Ai2uObWeVfFjvCF01Xa9SQD706baatsttcUuI4MblMTNG4blOSN1pMpZJ/wymkqt4c7eQSCETlD/mPeWPQ== ;{id = 56088 (ksk), size = 256b}
+sub2.example.com.	IN	DNSKEY	257 3 13 PlfsudScPXH3VdDVv6nnuBEXQpP6coF6F2w99u4Es5VbJHZrgFhvxL9os0jnfiGCL6VJ0Q+bNKnzfoP3ByP1Kg== ;{id = 58926 (ksk), size = 256b}
+
+; 44 invalid signatures, modified with different tags.
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 22 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 23 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 24 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 25 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 26 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 27 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 28 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 29 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 30 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 31 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 32 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 33 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 34 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 35 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 36 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 37 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 38 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 39 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 40 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 41 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 42 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 43 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 44 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 45 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 46 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 47 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 48 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 49 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 50 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 51 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 52 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 53 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 54 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 55 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 56 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 57 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 58 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 59 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 60 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 61 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 62 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 63 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 64 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 65 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+
+; this signature is valid
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 20 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.sub2.example.com. IN A
+SECTION ANSWER
+www.sub2.example.com. IN A	10.20.30.42
+www.sub2.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 20 sub2.example.com. VCy6Ggk2HZ+fQ8Bube9UIVDXfF6iWo6Gm5MFRVikWdgqTNizrP5F/z2HzgYFPd+K9WNzsWbi4n+9m4sgYRHAnA==
+ENTRY_END
+RANGE_END
+
+; ns.sub3.example.com.
+; 24 DNSKEYs and 24 RRSIGs on A
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.7
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.sub3.example.com. IN AAAA
+SECTION ANSWER
+SECTION AUTHORITY
+sub3.example.com. IN SOA a. b. 3600 3600 3600 3600 3600
+sub3.example.com.	3600	IN	RRSIG	SOA 13 3 3600 20070926134150 20070829134150 20 sub3.example.com. ghR8Y1uUeoJaADEVdXMkNTE2/LtCBt/lmnTX5TOYZSWsT2+Ut6RclRrR9gi771T8IihYwvcf3ZsNyfjfEENSfw==
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+sub3.example.com. IN DNSKEY
+SECTION ANSWER
+sub3.example.com.	IN	DNSKEY	257 3 13 n2P99SKaAUDt50U/cToH/0TmGJKG8+Pbiwl1WY/f5EVWZD/auO5QEyY6Tm9kLHzAEOcjWR701V74ZgyFPirxIA== ;{id = 20 (ksk), size = 256b}
+sub3.example.com.	IN	DNSKEY	257 3 13 2biK+rkC8P/MV/UMDbksGCov08Tya5wrtrjeDOSez5W1qFqqPKXzxuMxecGSXIYgNM8Y/m8XdlwOd8Q6vUuw5A== ;{id = 3539 (ksk), size = 256b}
+sub3.example.com.	IN	DNSKEY	257 3 13 UeL+mKovo+r7+B3egif1JxCHPfmbR4SU4m3s0Fp42ozze0FiMzEwRM85O4aYViPOmu0AKgfwuRjEM5aEM1pBug== ;{id = 12688 (ksk), size = 256b}
+sub3.example.com.	IN	DNSKEY	257 3 13 iFe//OnLHLGXpE9i+4y3H+NefdDTZAEwYzDv0U+OIzs37lnOEMYTVqBxkLA82JDKMtnjupCOtSXMoru7lQcckw== ;{id = 13058 (ksk), size = 256b}
+sub3.example.com.	IN	DNSKEY	257 3 13 0/lAWEpW94Rkjion6aUxepvCO6MxoRRJ5aIX9fdEPjUJXCGeHviFLmeDnNzTB0egvC5CgthSnQfyxqMqbbuMAQ== ;{id = 18006 (ksk), size = 256b}
+sub3.example.com.	IN	DNSKEY	257 3 13 P1rwuvxZ8tQOxtOHsbzHAIpMNkleGRtg7gynoesq2gSJT+NAmYRrk+BzEGvHWTHKWd5KnusSt2BpBBlWw5pLiw== ;{id = 18279 (ksk), size = 256b}
+sub3.example.com.	IN	DNSKEY	257 3 13 WraqJ/JvyS8xQZOKpVscbAUuYU8lVCiuEHjekR0kADMP/eWOvdJkaPZ++REeHclBejqXp+NcP0dnyweObnZDsA== ;{id = 20669 (ksk), size = 256b}
+sub3.example.com.	IN	DNSKEY	257 3 13 /fci65ankZ0cKOPdJAJBIyXHYGzjngEyqGbBVmeDk2RwAqxmyUB5OORRmlPMY80ipMU+e8Pt3itKpglwpT7qSA== ;{id = 25106 (ksk), size = 256b}
+sub3.example.com.	IN	DNSKEY	257 3 13 MEfZQnvjQI/L/0QlglQ2YrxSCQ6fRruKF2aQ+nD5JV9ecE1AhA/RujbKkg9UrG4ScjqC7f0fhCW+eUqsSoUcTg== ;{id = 25932 (ksk), size = 256b}
+sub3.example.com.	IN	DNSKEY	257 3 13 KbKK1C8ZtHNsBicJnjrvTB56BoTTjL9pvNEbRVwCKIcWYdNP8l3dpsvVEAZ/ujxmKRA/ToA7ua4/IBDtALFWvg== ;{id = 27845 (ksk), size = 256b}
+sub3.example.com.	IN	DNSKEY	257 3 13 G3I9nIlyTOrn12D8luAgZR4ZTK+iNegzz9UG8b5YsC9IV4UtgbdZkoEDRsH2uu429qvezzlUsjTzR+fu/74Saw== ;{id = 29183 (ksk), size = 256b}
+sub3.example.com.	IN	DNSKEY	257 3 13 fBgVewGRqRmvJUVm/ZQqPLynt1lM6ilPdENMd9uESPh30CzUsi8Q7tbGZoH52CJjpcb17z3zSjJv40ASVEBhNw== ;{id = 30380 (ksk), size = 256b}
+sub3.example.com.	IN	DNSKEY	257 3 13 3LbmoAShX4cKq4qyIqHLI7+UH4/EVOaXCF7AhJHaRJsgbyCEwn4Ofjh6l15Pxbk/UH851tR8MBaaOz8+ROcL2A== ;{id = 31753 (ksk), size = 256b}
+sub3.example.com.	IN	DNSKEY	257 3 13 xMfArWljU25/0ePkuncQHH8U+/NMLIqy3IpJ7IqcOKRXmR7hrY2dQ6MgBN1rUBW8Q7Uq3mFbozdJbr3oDeZcdQ== ;{id = 32621 (ksk), size = 256b}
+sub3.example.com.	IN	DNSKEY	257 3 13 YsXykW60iTTY+1DY7CG9izDd+RAzx+oPUk2UBiHBPengMUmu3R9rgsJHYfjwWgYWB60sy0CPcdAeu+jD2tB4eA== ;{id = 33127 (ksk), size = 256b}
+sub3.example.com.	IN	DNSKEY	257 3 13 wzS1uBaSWR+bTTYgtLm3jNxNnLSNv6abvnHABXQD5yDFs17rGqDCdvkk6JM3qI4BJ+npNLdADJZt118PWlQ7eQ== ;{id = 37404 (ksk), size = 256b}
+sub3.example.com.	IN	DNSKEY	257 3 13 9nDuSJ9wRTsvFYubQ7KQyOmzlY+UzG1cESD8NK9eOj9VMX1O71d5GxBwzc4UtBs+kZBi49BLjZIV5qWbD9FbXQ== ;{id = 38693 (ksk), size = 256b}
+sub3.example.com.	IN	DNSKEY	257 3 13 EFDgOhEi43zsVaJdytsq3HjtAh6dVDaAnR0PY7O0S4q/svucxOVxmJsG/2rXYMHTej9jRTg/qWWbW4gdReDoSQ== ;{id = 40580 (ksk), size = 256b}
+sub3.example.com.	IN	DNSKEY	257 3 13 wq8UI3DydI9svWJEQ1G0JHGVHykgo3YXFF8CRG055gshZAVyfIiTRwCemG0mbziuobOeZSpCtK05KGp20NHRTA== ;{id = 43985 (ksk), size = 256b}
+sub3.example.com.	IN	DNSKEY	257 3 13 wRMENWFMd+9c4p9agfd/3qLnum1SS555CP9lgJKtU0t7Q689SrAUwBJP7ymXTDGtWSjlFBzbts6SUARX47SK1Q== ;{id = 44725 (ksk), size = 256b}
+sub3.example.com.	IN	DNSKEY	257 3 13 zeWh2eFjuwp9K9yaJq16XMVNC8Ys0TOk91eYkGa0Dgez59aG/PvPYV1qi9pxbmG/c4tuXcRV9Z9cxcVev9DdYw== ;{id = 44975 (ksk), size = 256b}
+sub3.example.com.	IN	DNSKEY	257 3 13 O/y794Mc/kIwRltqnqj+puIS1ejFQeE9Xmjz1NVU82x+UyEvx2InNpwaU2TFNKaT7aned72CE1u//CahV6zeEg== ;{id = 49819 (ksk), size = 256b}
+sub3.example.com.	IN	DNSKEY	257 3 13 edr2Ai2uObWeVfFjvCF01Xa9SQD706baatsttcUuI4MblMTNG4blOSN1pMpZJ/wymkqt4c7eQSCETlD/mPeWPQ== ;{id = 56088 (ksk), size = 256b}
+sub3.example.com.	IN	DNSKEY	257 3 13 PlfsudScPXH3VdDVv6nnuBEXQpP6coF6F2w99u4Es5VbJHZrgFhvxL9os0jnfiGCL6VJ0Q+bNKnzfoP3ByP1Kg== ;{id = 58926 (ksk), size = 256b}
+sub3.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 20 sub3.example.com. bHMk1YyEhCSaG4zvIeEyy0CKrMVKx+LctpKLCGWhfFGmItIlEdsT/GPwpWUPrTpp990tSSzUFvxkRc+unavAVA==
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.sub3.example.com. IN A
+SECTION ANSWER
+www.sub3.example.com. IN A	10.20.30.43
+; invalid signatures, with wrong keytag.
+www.sub3.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 22 sub3.example.com. mqnO7+cyQw79Lt+TwcZhvt5ybNidAjIaap2/NuNnYZeJhluveSoiwzyT+vvLLluD97nuGHym6+d4vrdFLaFYFw==
+www.sub3.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 23 sub3.example.com. mqnO7+cyQw79Lt+TwcZhvt5ybNidAjIaap2/NuNnYZeJhluveSoiwzyT+vvLLluD97nuGHym6+d4vrdFLaFYFw==
+www.sub3.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 24 sub3.example.com. mqnO7+cyQw79Lt+TwcZhvt5ybNidAjIaap2/NuNnYZeJhluveSoiwzyT+vvLLluD97nuGHym6+d4vrdFLaFYFw==
+www.sub3.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 25 sub3.example.com. mqnO7+cyQw79Lt+TwcZhvt5ybNidAjIaap2/NuNnYZeJhluveSoiwzyT+vvLLluD97nuGHym6+d4vrdFLaFYFw==
+www.sub3.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 26 sub3.example.com. mqnO7+cyQw79Lt+TwcZhvt5ybNidAjIaap2/NuNnYZeJhluveSoiwzyT+vvLLluD97nuGHym6+d4vrdFLaFYFw==
+www.sub3.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 27 sub3.example.com. mqnO7+cyQw79Lt+TwcZhvt5ybNidAjIaap2/NuNnYZeJhluveSoiwzyT+vvLLluD97nuGHym6+d4vrdFLaFYFw==
+www.sub3.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 28 sub3.example.com. mqnO7+cyQw79Lt+TwcZhvt5ybNidAjIaap2/NuNnYZeJhluveSoiwzyT+vvLLluD97nuGHym6+d4vrdFLaFYFw==
+www.sub3.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 29 sub3.example.com. mqnO7+cyQw79Lt+TwcZhvt5ybNidAjIaap2/NuNnYZeJhluveSoiwzyT+vvLLluD97nuGHym6+d4vrdFLaFYFw==
+www.sub3.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 30 sub3.example.com. mqnO7+cyQw79Lt+TwcZhvt5ybNidAjIaap2/NuNnYZeJhluveSoiwzyT+vvLLluD97nuGHym6+d4vrdFLaFYFw==
+www.sub3.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 31 sub3.example.com. mqnO7+cyQw79Lt+TwcZhvt5ybNidAjIaap2/NuNnYZeJhluveSoiwzyT+vvLLluD97nuGHym6+d4vrdFLaFYFw==
+www.sub3.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 32 sub3.example.com. mqnO7+cyQw79Lt+TwcZhvt5ybNidAjIaap2/NuNnYZeJhluveSoiwzyT+vvLLluD97nuGHym6+d4vrdFLaFYFw==
+www.sub3.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 33 sub3.example.com. mqnO7+cyQw79Lt+TwcZhvt5ybNidAjIaap2/NuNnYZeJhluveSoiwzyT+vvLLluD97nuGHym6+d4vrdFLaFYFw==
+www.sub3.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 34 sub3.example.com. mqnO7+cyQw79Lt+TwcZhvt5ybNidAjIaap2/NuNnYZeJhluveSoiwzyT+vvLLluD97nuGHym6+d4vrdFLaFYFw==
+www.sub3.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 35 sub3.example.com. mqnO7+cyQw79Lt+TwcZhvt5ybNidAjIaap2/NuNnYZeJhluveSoiwzyT+vvLLluD97nuGHym6+d4vrdFLaFYFw==
+www.sub3.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 36 sub3.example.com. mqnO7+cyQw79Lt+TwcZhvt5ybNidAjIaap2/NuNnYZeJhluveSoiwzyT+vvLLluD97nuGHym6+d4vrdFLaFYFw==
+www.sub3.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 37 sub3.example.com. mqnO7+cyQw79Lt+TwcZhvt5ybNidAjIaap2/NuNnYZeJhluveSoiwzyT+vvLLluD97nuGHym6+d4vrdFLaFYFw==
+www.sub3.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 38 sub3.example.com. mqnO7+cyQw79Lt+TwcZhvt5ybNidAjIaap2/NuNnYZeJhluveSoiwzyT+vvLLluD97nuGHym6+d4vrdFLaFYFw==
+www.sub3.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 39 sub3.example.com. mqnO7+cyQw79Lt+TwcZhvt5ybNidAjIaap2/NuNnYZeJhluveSoiwzyT+vvLLluD97nuGHym6+d4vrdFLaFYFw==
+www.sub3.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 40 sub3.example.com. mqnO7+cyQw79Lt+TwcZhvt5ybNidAjIaap2/NuNnYZeJhluveSoiwzyT+vvLLluD97nuGHym6+d4vrdFLaFYFw==
+www.sub3.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 41 sub3.example.com. mqnO7+cyQw79Lt+TwcZhvt5ybNidAjIaap2/NuNnYZeJhluveSoiwzyT+vvLLluD97nuGHym6+d4vrdFLaFYFw==
+www.sub3.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 42 sub3.example.com. mqnO7+cyQw79Lt+TwcZhvt5ybNidAjIaap2/NuNnYZeJhluveSoiwzyT+vvLLluD97nuGHym6+d4vrdFLaFYFw==
+www.sub3.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 43 sub3.example.com. mqnO7+cyQw79Lt+TwcZhvt5ybNidAjIaap2/NuNnYZeJhluveSoiwzyT+vvLLluD97nuGHym6+d4vrdFLaFYFw==
+www.sub3.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 44 sub3.example.com. mqnO7+cyQw79Lt+TwcZhvt5ybNidAjIaap2/NuNnYZeJhluveSoiwzyT+vvLLluD97nuGHym6+d4vrdFLaFYFw==
+www.sub3.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 45 sub3.example.com. mqnO7+cyQw79Lt+TwcZhvt5ybNidAjIaap2/NuNnYZeJhluveSoiwzyT+vvLLluD97nuGHym6+d4vrdFLaFYFw==
+
+; valid signature.
+www.sub3.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 20 sub3.example.com. mqnO7+cyQw79Lt+TwcZhvt5ybNidAjIaap2/NuNnYZeJhluveSoiwzyT+vvLLluD97nuGHym6+d4vrdFLaFYFw==
+
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AD DO NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
+ENTRY_END
+
+; sub1.example.com.
+STEP 20 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.sub1.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 30 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ednsdata
+REPLY QR RD RA DO SERVFAIL
+SECTION QUESTION
+www.sub1.example.com. IN A
+SECTION ANSWER
+;www.sub1.example.com. IN A	10.20.30.41
+SECTION ADDITIONAL
+HEX_EDNSDATA_BEGIN
+; EDE: DNSSEC Bogus "validation failure <www.sub1.example.com. A IN>: DS verify has too many tag matches from 1.2.3.5 for key sub1.example.com. while building chain of trust"
+000F009A000676616C69646174696F6E206661696C757265203C7777772E737562312E
+6578616D706C652E636F6D2E204120494E3E3A20445320766572696679206861732074
+6F6F206D616E7920746167206D6174636865732066726F6D20312E322E332E3520666F
+72206B657920737562312E6578616D706C652E636F6D2E207768696C65206275696C64
+696E6720636861696E206F66207472757374
+HEX_EDNSDATA_END
+ENTRY_END
+
+; sub2.example.com.
+STEP 40 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.sub2.example.com. IN A
+ENTRY_END
+
+STEP 50 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ede=6
+;ednsdata
+REPLY QR RD RA DO SERVFAIL
+SECTION QUESTION
+www.sub2.example.com. IN A
+SECTION ANSWER
+;www.sub2.example.com. IN A	10.20.30.42
+;www.sub2.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 20 sub2.example.com. VCy6Ggk2HZ+fQ8Bube9UIVDXfF6iWo6Gm5MFRVikWdgqTNizrP5F/z2HzgYFPd+K9WNzsWbi4n+9m4sgYRHAnA==
+SECTION ADDITIONAL
+;HEX_EDNSDATA_BEGIN
+;; EDE: DNSSEC Bogus "validation failure <www.sub2.example.com. A IN>: DS verify has too many DNSKEY to RRSIG tag matches from 1.2.3.6 for key sub2.example.com. while building chain of trust"
+;000F00AA000676616C69646174696F6E206661696C757265203C7777772E737562322E
+;6578616D706C652E636F6D2E204120494E3E3A20445320766572696679206861732074
+;6F6F206D616E7920444E534B455920746F20525253494720746167206D617463686573
+;2066726F6D20312E322E332E3620666F72206B657920737562322E6578616D706C652E
+;636F6D2E207768696C65206275696C64696E6720636861696E206F66207472757374
+;HEX_EDNSDATA_END
+ENTRY_END
+
+; sub3.example.com.
+STEP 60 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.sub3.example.com. IN A
+ENTRY_END
+
+STEP 70 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ede=9
+;ednsdata
+REPLY QR RD RA DO SERVFAIL
+SECTION QUESTION
+www.sub3.example.com. IN A
+SECTION ANSWER
+;www.sub3.example.com. IN A	10.20.30.43
+SECTION ADDITIONAL
+;HEX_EDNSDATA_BEGIN
+;; EDE: DNSSEC Bogus "validation failure <www.sub3.example.com. A IN>: too many tag matches from 1.2.3.7"
+;000F0054000676616C69646174696F6E206661696C757265203C7777772E737562332E
+;6578616D706C652E636F6D2E204120494E3E3A20746F6F206D616E7920746167206D61
+;74636865732066726F6D20312E322E332E37
+;HEX_EDNSDATA_END
+ENTRY_END
+
+SCENARIO_END
@@ -0,0 +1,82 @@
+; config options
+server:
+	; This is the test key 29332 in the testdata.
+	trust-anchor: ". 3600 IN DS 29332 8 2 b75e26316631b6e37cbc977323a08769f86e36a10fee888676d35f61e2ff4181"
+	val-override-date: "20201020135527"
+	target-fetch-policy: "0 0 0 0 0"
+	qname-minimisation: no
+	fake-sha1: yes
+	trust-anchor-signaling: no
+	minimal-responses: no
+	log-servfail: yes
+
+forward-zone:
+	name: "."
+	forward-addr: 10.5.5.5
+CONFIG_END
+
+SCENARIO_BEGIN Test nxdomain that gets unsigned response
+; and the DS lookup that it makes gets an NSEC NXDOMAIN response.
+
+; 10.5.5.5 forwarder
+RANGE_BEGIN 0 100
+	ADDRESS 10.5.5.5
+
+; unsigned NXDOMAIN response, from the first forwarder, here it is served
+; from the upstream.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NXDOMAIN
+SECTION QUESTION
+example.veryinvalid. IN TXT
+SECTION AUTHORITY
+. 3600 IN SOA ns.root. host.root. 1 3600 3600 3600 3600
+ENTRY_END
+
+; DNSKEY answer, using CSK for test simplicity.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN DNSKEY
+SECTION ANSWER
+.       IN      DNSKEY  257 3 8 AwEAAb4WMOTBLTFvmBra5m6SK4VfViOzmvyUAU0qv861ZQXeEFvwlndqNU9rwRsMxrSWAYs5nHErKDn49usC/HyxxW1477iGFHhfgL4mjNreJm9zft2QFB1VLbRbEPYdDMLCn4co0qnG7/KG8W2i8Pym1L7f+aREwbLo+/716AS2PbaKMhfWLKLiq5wnBcUClQMNzCiwhqxDJp1oePqfkVdeUgXOtgi0dYRIKyQFhJ5VWJ22npoi/Gif0XLCADAlAwRLKc8o/yJkCxskzgpHpw5Cki1lclg0aq4ssOuPRQ+ne6IHYCz9D2mwzulblhLFamKdq7aHzNt4NlyxhpANVFiKLD8= ;{id = 29332 (ksk), size = 2048b}
+.	3600	IN	RRSIG	DNSKEY 8 0 3600 20201116135527 20201019135527 29332 . ToK8hJrGa+kNu6y8FpRwZq2FjDPBAk5Ctchia3Vu9yTth2dR7BhK2ALTWVBwAQGwiwxXKoVK9QCxdQM0ti7CVb9x75bejkd2E6UGWVmqyTRPpn3D43qYARm87y3ZVKG7LlWHp8UOf21XLp1H7R+wuipIvBJ1XA+QGXThPdbV9EEz1kKGdprBfdpFkQdcAiuYYrOTa5cJ11z32mGiQ12fWjpb4UUbfcoDD9YOoa/S5a6h7jYBOfm75ZB8UCW3Z/SlsN8KIfYZsg5CZphpf38XH5uNLMmzpaWYhfamJZJve9Isx4eILNmdMLK4E8ESwDFCVNzMIqdf20VRg6Lh7nwQeA==
+ENTRY_END
+
+; answer for DS, from another forwarder, here returned from the test upstream.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NXDOMAIN
+SECTION QUESTION
+veryinvalid. IN DS
+SECTION AUTHORITY
+versicherung.	3600	IN	NSEC	vet. NS DS RRSIG NSEC
+versicherung.	3600	IN	RRSIG	NSEC 8 1 3600 20201116135527 20201019135527 29332 . AVAON9Y7AVwX9YWQK8JPcB6Wk/tEfQT7JrLiCRlBBQA0+mpVYYYtMyrm4aMjkhusqYcnpIZoLGOI/dxJjIwDgnMkd4EqY2oICea3I260f8z2v9e7zNobyUTjkoWsmLPc7VRLtEGKu1XyVpt7DX6ElGoSUhU4JsTx7wkkXU0SGAakL0bhK8K68B92NEVwgKX4D7+kVfpjc0aHaB3rAkhQCM/G0jEFp0RuhTX1aru6IuYrZmjW0dvQ2niec6NaYzvuGnbhMLlFLuXqSmI2B7uIFx894usd1cVWnSRg49bAkuiEv5q04ltRel1huJBGGiZlLEwanS5g53C5DHfq10OUrw==
+.	3600	IN	NSEC	aaa. NS SOA RRSIG NSEC DNSKEY ZONEMD
+.	3600	IN	RRSIG	NSEC 8 0 3600 20201116135527 20201019135527 29332 . E8r6rpFgFBUda2GnFSMzHZLtjy1dT+ZS0wPRE12RNwVK547bo2vByv9EFhOHS6sEIFqX+AmIJotuiEPKnCFUTr6FKscaxtw38dJRZ3wldqV6dmqUiRmz91crDCV5nSL45FIbkWKk1Q+tnXie3sZ4zwBc12kGg2BttMAQ0i4sbMbf6EUNYZGwYzSB0/VhXVJcl8gl+5lfpiVqfWNZI7vTEaHqrC2gBC3UK1cQE9lQOqhJ6H5ThA1FR9j/mZFM9sG5vQ2Mqlzl2iiN2Y6mCptDY1vwfff6AnT0YeDwJ/XwGisMZrSvTCYaiRndb8CUUmCr23AFy5OER1rmeFGkHX5+WQ==
+.	3600	IN	SOA	ns.root. host.root. 1 3600 3600 3600 3600
+.	3600	IN	RRSIG	SOA 8 0 3600 20201116135527 20201019135527 29332 . tVeReLMXPnl6rk4QX94xy9lCodQ+xc39lokbNkvbXnTURNCOAwtNiMMPlAAJ3/HTpIxo175gPfupACIveBtgajdp85jUIvLMOM5B6lX80+dUPBGZ4gHVjf+8EGnr7q2wnW2+KcJu0OhN2g+YqCV6aPi8pzuAp+AMsBYcMfXqEQq9Lxqv6TL50MUCJN3GPCyBIdjbs/A+ZB7D1EOO1YgdbsMHK/pWKYt4UfBFfekoA6joIGf4vBKKRTWnoo0BcrFob3AW1SyJkoxoqEsN3YAVL9jNkJCkU0/adLypHgDNayLgsWI5/o4Ng8LxN6tNxAilkMhcGY80T5g0uo+ukY7McA==
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+example.veryinvalid. IN TXT
+ENTRY_END
+
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA DO SERVFAIL
+SECTION QUESTION
+example.veryinvalid. IN TXT
+SECTION ANSWER
+ENTRY_END
+
+SCENARIO_END
@@ -11,6 +11,7 @@ server:
 	trust-anchor-signaling: no
 	iter-scrub-promiscuous: no
 	rrset-roundrobin: no
+	val-clean-additional: yes

 stub-zone:
 	name: "."
@@ -12,6 +12,7 @@ server:
 	minimal-responses: no
 	iter-scrub-promiscuous: no
 	rrset-roundrobin: no
+	val-clean-additional: yes

 stub-zone:
 	name: "."
@@ -243,6 +243,7 @@ config_create(void)
 	cfg->views = NULL;
 	cfg->acls = NULL;
 	cfg->tcp_connection_limits = NULL;
+	cfg->auth_task_threads = 0;
 	cfg->harden_short_bufsize = 1;
 	cfg->harden_large_queries = 0;
 	cfg->harden_glue = 1;
@@ -252,6 +253,7 @@ config_create(void)
 	cfg->harden_referral_path = 0;
 	cfg->harden_algo_downgrade = 0;
 	cfg->harden_unknown_additional = 0;
+	cfg->harden_cname_follow = 1;
 	cfg->use_caps_bits_for_id = 0;
 	cfg->caps_whitelist = NULL;
 	cfg->private_address = NULL;
@@ -278,7 +280,7 @@ config_create(void)
 	cfg->val_sig_skew_min = 3600; /* at least daylight savings trouble */
 	cfg->val_sig_skew_max = 86400; /* at most timezone settings trouble */
 	cfg->val_max_restart = 5;
-	cfg->val_clean_additional = 1;
+	cfg->val_clean_additional = 0; /* off to protect against much data. */
 	cfg->val_log_level = 0;
 	cfg->val_log_squelch = 0;
 	cfg->val_permissive_mode = 0;
@@ -429,6 +431,8 @@ config_create(void)
 	cfg->iter_scrub_rrsig = 8;
 	cfg->iter_scrub_promiscuous = 1;
 	cfg->max_global_quota = 200;
+	cfg->val_validation_attempts = 32;
+	cfg->val_hash_attempts = 32;
 	return cfg;
 error_exit:
 	config_delete(cfg);
@@ -457,6 +461,7 @@ struct config_file* config_create_forlib(void)
 	cfg->neg_cache_size = 100 * 1024;
 	cfg->donotquery_localhost = 0; /* allow, so that you can ask a
 		forward nameserver running on localhost */
+	cfg->auth_task_threads = 0; /* no extra threads to spawn in library */
 	cfg->val_log_level = 2; /* to fill why_bogus with */
 	cfg->val_log_squelch = 1;
 	cfg->minimal_responses = 0;
@@ -737,11 +742,13 @@ int config_set_option(struct config_file* cfg, const char* opt,
 	else S_YNO("harden-referral-path:", harden_referral_path)
 	else S_YNO("harden-algo-downgrade:", harden_algo_downgrade)
 	else S_YNO("harden-unknown-additional:", harden_unknown_additional)
+	else S_YNO("harden-cname-follow:", harden_cname_follow)
 	else S_YNO("use-caps-for-id:", use_caps_bits_for_id)
 	else S_STRLIST("caps-whitelist:", caps_whitelist)
 	else S_SIZET_OR_ZERO("unwanted-reply-threshold:", unwanted_threshold)
 	else S_STRLIST("private-address:", private_address)
 	else S_STRLIST("private-domain:", private_domain)
+	else S_NUMBER_OR_ZERO("auth-task-threads:", auth_task_threads)
 	else S_YNO("do-not-query-localhost:", donotquery_localhost)
 	else S_STRLIST("do-not-query-address:", donotqueryaddrs)
 	else S_STRLIST("auto-trust-anchor-file:", auto_trust_anchor_file_list)
@@ -785,6 +792,8 @@ int config_set_option(struct config_file* cfg, const char* opt,
 	else S_NUMBER_OR_ZERO("iter-scrub-rrsig:", iter_scrub_rrsig)
 	else S_YNO("iter-scrub-promiscuous:", iter_scrub_promiscuous)
 	else S_NUMBER_OR_ZERO("max-global-quota:", max_global_quota)
+	else S_NUMBER_OR_ZERO("val-validation-attempts:", val_validation_attempts)
+	else S_NUMBER_OR_ZERO("val-hash-attempts:", val_hash_attempts)
 	else S_YNO("serve-original-ttl:", serve_original_ttl)
 	else S_STR("val-nsec3-keysize-iterations:", val_nsec3_key_iterations)
 	else S_YNO("zonemd-permissive-mode:", zonemd_permissive_mode)
@@ -1240,6 +1249,7 @@ config_get_option(struct config_file* cfg, const char* opt,
 	else O_YNO(opt, "harden-referral-path", harden_referral_path)
 	else O_YNO(opt, "harden-algo-downgrade", harden_algo_downgrade)
 	else O_YNO(opt, "harden-unknown-additional", harden_unknown_additional)
+	else O_YNO(opt, "harden-cname-follow", harden_cname_follow)
 	else O_YNO(opt, "use-caps-for-id", use_caps_bits_for_id)
 	else O_LST(opt, "caps-whitelist", caps_whitelist)
 	else O_DEC(opt, "unwanted-reply-threshold", unwanted_threshold)
@@ -1265,6 +1275,8 @@ config_get_option(struct config_file* cfg, const char* opt,
 	else O_DEC(opt, "iter-scrub-rrsig", iter_scrub_rrsig)
 	else O_YNO(opt, "iter-scrub-promiscuous", iter_scrub_promiscuous)
 	else O_DEC(opt, "max-global-quota", max_global_quota)
+	else O_DEC(opt, "val-validation-attempts", val_validation_attempts)
+	else O_DEC(opt, "val-hash-attempts", val_hash_attempts)
 	else O_YNO(opt, "serve-original-ttl", serve_original_ttl)
 	else O_STR(opt, "val-nsec3-keysize-iterations",val_nsec3_key_iterations)
 	else O_YNO(opt, "zonemd-permissive-mode", zonemd_permissive_mode)
@@ -1284,6 +1296,7 @@ config_get_option(struct config_file* cfg, const char* opt,
 	else O_LST(opt, "root-hints", root_hints)
 	else O_LS2(opt, "access-control", acls)
 	else O_LS2(opt, "tcp-connection-limit", tcp_connection_limits)
+	else O_DEC(opt, "auth-task-threads", auth_task_threads)
 	else O_LST(opt, "do-not-query-address", donotqueryaddrs)
 	else O_LST(opt, "private-address", private_address)
 	else O_LST(opt, "private-domain", private_domain)
@@ -3087,3 +3100,40 @@ file_get_mtime(const char* file, time_t* mtime, long* ns, int* nonexist)
 #endif
 	return 1;
 }
+
+int cfg_local_zone_type_value_check(const char* str)
+{
+	if(strcmp(str, "static")!=0 && strcmp(str, "deny")!=0 &&
+	   strcmp(str, "refuse")!=0 && strcmp(str, "redirect")!=0 &&
+	   strcmp(str, "transparent")!=0 && strcmp(str, "nodefault")!=0
+	   && strcmp(str, "typetransparent")!=0
+	   && strcmp(str, "always_transparent")!=0
+	   && strcmp(str, "block_a")!=0
+	   && strcmp(str, "block_aaaa")!=0
+	   && strcmp(str, "block_a_wdata")!=0
+	   && strcmp(str, "block_aaaa_wdata")!=0
+	   && strcmp(str, "always_refuse")!=0
+	   && strcmp(str, "always_nxdomain")!=0
+	   && strcmp(str, "always_nodata")!=0
+	   && strcmp(str, "always_deny")!=0
+	   && strcmp(str, "always_null")!=0
+	   && strcmp(str, "noview")!=0
+	   && strcmp(str, "inform")!=0 && strcmp(str, "inform_deny")!=0
+	   && strcmp(str, "inform_redirect") != 0
+	   && strcmp(str, "ipset") != 0)
+		return 0;
+	return 1;
+}
+
+const char* cfg_local_zone_type_list(void)
+{
+	return "static, deny, "
+		"refuse, redirect, transparent, "
+		"typetransparent, inform, inform_deny, "
+		"inform_redirect, always_transparent, "
+		"block_a, block_aaaa, "
+		"block_a_wdata, block_aaaa_wdata, "
+		"always_refuse, always_nxdomain, "
+		"always_nodata, always_deny, always_null, "
+		"noview, nodefault or ipset";
+}
@@ -291,6 +291,8 @@ struct config_file {

 	/** list of tcp connection limitss, linked list */
 	struct config_str2list* tcp_connection_limits;
+	/** auth task threads, or 0 disabled. */
+	int auth_task_threads;

 	/** harden against very small edns buffer sizes */
 	int harden_short_bufsize;
@@ -311,6 +313,8 @@ struct config_file {
 	/** harden against unknown records in the authority section and in
 	 * the additional section */
 	int harden_unknown_additional;
+	/** harden to follow cname redirections */
+	int harden_cname_follow;
 	/** use 0x20 bits in query as random ID bits */
 	int use_caps_bits_for_id;
 	/** 0x20 whitelist, domains that do not use capsforid */
@@ -798,6 +802,10 @@ struct config_file {
 	int iter_scrub_rrsig;
 	/** limit on upstream queries for an incoming query and subqueries. */
 	int max_global_quota;
+	/** limit on validator validation attempts. */
+	int val_validation_attempts;
+	/** limit on validator hash attempts. */
+	int val_hash_attempts;
 	/** Should the iterator scrub promiscuous NS rrsets, from positive
 	 * answers. */
 	int iter_scrub_promiscuous;
@@ -1517,4 +1525,10 @@ void cfg_tls_protocols_allowed(const char* tls_protocols, int* allow12, int* all
 /** get the file mtime stat (or error, with errno and nonexist) */
 int file_get_mtime(const char* file, time_t* mtime, long* ns, int* nonexist);

+/** check local-zone type for correctness */
+int cfg_local_zone_type_value_check(const char* str);
+
+/** the list of local-zone types, for error printout. */
+const char* cfg_local_zone_type_list(void);
+
 #endif /* UTIL_CONFIG_FILE_H */
@@ -323,6 +323,7 @@ harden-below-nxdomain{COLON}	{ YDVAR(1, VAR_HARDEN_BELOW_NXDOMAIN) }
 harden-referral-path{COLON}	{ YDVAR(1, VAR_HARDEN_REFERRAL_PATH) }
 harden-algo-downgrade{COLON}	{ YDVAR(1, VAR_HARDEN_ALGO_DOWNGRADE) }
 harden-unknown-additional{COLON}	{ YDVAR(1, VAR_HARDEN_UNKNOWN_ADDITIONAL) }
+harden-cname-follow{COLON}	{ YDVAR(1, VAR_HARDEN_CNAME_FOLLOW) }
 use-caps-for-id{COLON}		{ YDVAR(1, VAR_USE_CAPS_FOR_ID) }
 caps-whitelist{COLON}		{ YDVAR(1, VAR_CAPS_WHITELIST) }
 caps-exempt{COLON}		{ YDVAR(1, VAR_CAPS_WHITELIST) }
@@ -595,6 +596,7 @@ name-v4{COLON}			{ YDVAR(1, VAR_IPSET_NAME_V4) }
 name-v6{COLON}			{ YDVAR(1, VAR_IPSET_NAME_V6) }
 udp-upstream-without-downstream{COLON} { YDVAR(1, VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM) }
 tcp-connection-limit{COLON}	{ YDVAR(2, VAR_TCP_CONNECTION_LIMIT) }
+auth-task-threads{COLON}	{ YDVAR(1, VAR_AUTH_TASK_THREADS) }
 answer-cookie{COLON}		{ YDVAR(1, VAR_ANSWER_COOKIE ) }
 cookie-secret{COLON}		{ YDVAR(1, VAR_COOKIE_SECRET) }
 cookie-secret-file{COLON}	{ YDVAR(1, VAR_COOKIE_SECRET_FILE) }
@@ -608,6 +610,8 @@ iter-scrub-ns{COLON}		{ YDVAR(1, VAR_ITER_SCRUB_NS) }
 iter-scrub-cname{COLON}		{ YDVAR(1, VAR_ITER_SCRUB_CNAME) }
 iter-scrub-rrsig{COLON}		{ YDVAR(1, VAR_ITER_SCRUB_RRSIG) }
 max-global-quota{COLON}		{ YDVAR(1, VAR_MAX_GLOBAL_QUOTA) }
+val-validation-attempts{COLON}	{ YDVAR(1, VAR_VAL_VALIDATION_ATTEMPTS) }
+val-hash-attempts{COLON}	{ YDVAR(1, VAR_VAL_HASH_ATTEMPTS) }
 max-transfer-size{COLON}	{ YDVAR(1, VAR_MAX_TRANSFER_SIZE) }
 max-transfer-time{COLON}	{ YDVAR(1, VAR_MAX_TRANSFER_TIME) }
 iter-scrub-promiscuous{COLON}	{ YDVAR(1, VAR_ITER_SCRUB_PROMISCUOUS) }
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
W.C.A. Wijngaards	cd0a585fbe	Merge branch 'master' into auth-load-thread	2026-10-13 15:56:17 +02:00
Yorgos Thessalonikefs	d1ea227e94	- Fix #1526 : Root Server h.root-servers.net has been included for Zone Transfer Service by including it in the example configuration.	2026-10-13 14:49:39 +02:00
W.C.A. Wijngaards	18d8676e9c	- Fix dns64 synthesis and cache with subnet module enabled. The subnet module stopped a cache store, that caused later dns64 replies to have a nodata answer for the AAAA.	2026-10-13 09:51:19 +02:00
W.C.A. Wijngaards	7c624d1dcd	- auth-load-thread, fix pick up of active transfer after full list. Add unit test for list of auth transfers.	2026-10-09 15:55:21 +02:00
W.C.A. Wijngaards	e23010c18e	- auth-load-thread, more generic result handling of the thread.	2026-10-09 09:47:13 +02:00
W.C.A. Wijngaards	ddcbc291fe	- auth-load-thread, delete threads postorder.	2026-10-07 11:48:21 +02:00
W.C.A. Wijngaards	a119b1abc6	- auth-load-thread, init tree after stopping authloadthreads for worker.	2026-10-07 11:26:17 +02:00
W.C.A. Wijngaards	f62214e714	- auth-load-thread, account write threads, unit test for zonefile write.	2026-10-07 11:10:16 +02:00
W.C.A. Wijngaards	3d1aaae57a	- auth-load-thread, track thread in worker tree insertion. Remove unused lines from compare function.	2026-10-07 10:30:57 +02:00
W.C.A. Wijngaards	614dcbf675	- auth-load-thread, quit auth load threads on exit and reload, and also when fast_reload changes or deletes a zone.	2026-10-06 16:51:23 +02:00
W.C.A. Wijngaards	add0065c43	- auth-load-thread, write to zonefile polls for thread quit.	2026-10-06 15:07:54 +02:00
W.C.A. Wijngaards	3d53f08bd8	- auth-load-thread, write to zonefile with thread.	2026-10-06 14:39:41 +02:00
W.C.A. Wijngaards	0dcd4cd2e8	- auth-load-thread, fix unit test for auth load rpz threads check.	2026-10-06 11:45:57 +02:00
W.C.A. Wijngaards	b449d6f713	- auth-load-thread, documentation for auth-task-threads and tests disable when there is no threading.	2026-10-06 11:44:29 +02:00
W.C.A. Wijngaards	6932ae18f5	- auth-load-thread, swap rpz contents, not config. Test for auth load rpz.	2026-10-06 11:29:54 +02:00
W.C.A. Wijngaards	e2537840ba	- auth-load-thread, setup RPZ after IXFR and AXFR processing.	2026-10-06 10:38:32 +02:00
W.C.A. Wijngaards	b425be8e10	- auth-load-thread, resume waiting transfers.	2026-10-06 09:54:03 +02:00
W.C.A. Wijngaards	bb408e503c	- auth-load-thread, add num auth transfers and wait_transfer list.	2026-10-05 16:44:10 +02:00
W.C.A. Wijngaards	8942d11bb3	- auth-load-thread, fix for merge and http chunk list delete.	2026-10-05 09:19:59 +02:00
W.C.A. Wijngaards	cb027ae649	Merge branch 'master' into auth-load-thread	2026-10-05 09:02:28 +02:00
Yorgos Thessalonikefs	eafb027166	- Document libunbound's context lifetime during an async callback. Thanks to Omar Mousa for the suggestion.	2026-10-02 16:01:19 +02:00
W.C.A. Wijngaards	40d36cda61	- Fix to allow for large (64Kb) packets with testbound.	2026-09-28 14:47:00 +02:00
W.C.A. Wijngaards	8cf2202c52	Changelog note and remove hash call assertion. - Merge #1518 from nshopik: rrset: rehash copies after changing the key.	2026-09-28 11:56:09 +02:00
Nikolay ShopikandGitHub	f6fff9efcb	rrset: rehash copies after changing the key (#1518 ) Copied rrsets that got a new owner name or flags kept the hash of the source, so the rrset cache filed all of them in one hash bin. Recompute the hash at each such site and assert it on cache update.	2026-09-28 11:53:24 +02:00
W.C.A. Wijngaards	97c001f9dd	- Fix to log the errno for trust anchor write close fail.	2026-09-28 09:40:44 +02:00
Yorgos Thessalonikefs	1e12bef540	- Update generated man pages.	2026-09-22 12:17:02 +02:00
Yorgos Thessalonikefs	b49f452f0a	- Clarify man page text for harden-short-bufsize.	2026-09-22 12:14:14 +02:00
Yorgos Thessalonikefs	8820254637	- Move NORMAL_UDP_SIZE around.	2026-09-22 12:01:42 +02:00
Yorgos Thessalonikefs	5483a73856	- Fix #1513 : [FR] Size of harden-large-queries in the man page.	2026-09-22 11:59:45 +02:00
Yorgos Thessalonikefs	0e2470450c	- Fix #1514 : [FR] do-not-query-localhost is not including 0.0.0.0/8 and ‘::’ in the manpage.	2026-09-22 10:43:25 +02:00
Yorgos Thessalonikefs	65814ad6f3	Changelog entry for #1510 : - Merge #1510 from Andy Warner: Move unlink of temp file to before fatal exit.	2026-09-21 14:13:00 +02:00
Yorgos ThessalonikefsandGitHub	97d6cc3643	Merge pull request #1510 from aww-aww/patch-1 Move unlink of temp file to before fatal exit	2026-09-21 14:08:55 +02:00
Andy WarnerandGitHub	e79365ec61	Move unlink of temp file to before fatal exit Ensure temporary file is deleted only on failure. As written this would never be executed.	2026-09-21 03:51:24 -06:00
W.C.A. Wijngaards	a7fc80d8c5	- Unit test for CVE-2026-85501.	2026-09-16 10:47:44 +02:00
W.C.A. Wijngaards	5d89e0c2a7	- Unit test for CVE-2026-82717.	2026-09-16 10:44:49 +02:00
W.C.A. Wijngaards	b45c8b4b53	- The code repository continues with 1.26.2 under development, that includes the changes from before the 1.26.1 commits.	2026-09-16 10:34:06 +02:00
W.C.A. Wijngaards	a6586ced92	Merge branch 'branch-1.26.1'	2026-09-16 10:26:54 +02:00
W.C.A. Wijngaards	13b6717f17	- Fix CVE-2026-85501, Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC. Thanks to Zuyao Xu and Xiang Li from Nankai University, AOSP Lab for the report. In addition, thanks to Qifan Zhang from Palo Alto Networks for a complimentary report.	2026-09-16 09:30:25 +02:00
W.C.A. Wijngaards	0d4a6a63dd	- Fix CVE-2026-82717, CNAME synthesis could lead to heap corruption. Thanks to Ben Morris from Anthropic for the report.	2026-09-16 09:29:32 +02:00
W.C.A. Wijngaards	bd71e3b8a6	- Fix CVE-2026-77860, 'serve-expired' can bypass Unbound 'wait-limit'. Thanks to Xuanchao Xie, Lutong Chen, and Kaiping Xue from the University of Science and Technology of China (USTC) for the report.	2026-09-16 09:29:04 +02:00
W.C.A. Wijngaards	3a6ba0da81	- Unit test for CVE-2026-81642 fix.	2026-09-16 09:28:11 +02:00
W.C.A. Wijngaards	3d65973d38	- Fix CVE-2026-81634, Possible heap buffer overflow during DNSSEC canonicalization. Thanks to Vlatko Kosturjak with Marlink Cyber, for the report.	2026-09-16 09:27:17 +02:00
W.C.A. Wijngaards	565651cd02	- Fix CVE-2026-77955, Possible ZONEMD verification bypass window. Thanks to Yuqi Qiu and Xiang Li from Nankai University, AOSP Lab, for the report. In addition, thanks to Qifan Zhang from Palo Alto Networks for also reporting this issue.	2026-09-16 09:26:00 +02:00
W.C.A. Wijngaards	7914901915	- Fix CVE-2026-78227, Use-after-free in DoQ stream output buffer on reset re-transmission. Thanks to Yuqi Qiu and Xiang Li from Nankai University, AOSP Lab for the report.	2026-09-16 09:25:05 +02:00
W.C.A. Wijngaards	eba3d35ad4	- Fix CVE-2026-82720, Use-after-free in DoH stream cleanup code path. Thanks to Yuqi Qiu and Xiang Li from Nankai University, AOSP Lab, for the report.	2026-09-16 09:24:29 +02:00
W.C.A. Wijngaards	8c2e0fd6cc	- Fix CVE-2026-81642, Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY. Thanks to Yuqi Qiu and Xiang Li from Nankai University, AOSP Lab for the report.	2026-09-16 09:18:49 +02:00
W.C.A. Wijngaards	e619ead2db	- Fix CVE-2026-80225, Possible degradation of service from continuous queries on the same TCP/DoT connection. Thanks to Qifan Zhang from Palo Alto Networks for the report.	2026-09-16 09:16:29 +02:00
W.C.A. Wijngaards	eb86d9bc50	Set version to 1.26.1	2026-09-16 09:11:14 +02:00
W.C.A. Wijngaards	3ad9b6aade	- For #1507 : TOCTOU race in store_rrsets() can return a CNAME chain whose target owns no address.	2026-09-15 13:03:24 +02:00
W.C.A. Wijngaards	5ccee67af2	- Fix to error on missing close parenthesis for zone file read and for url content read. Thanks to Qifan Zhang, Palo Alto Networks, for the report.	2026-09-10 16:12:49 +02:00
W.C.A. Wijngaards	b8577a9c04	- Fix to construct the delegation point during DS NS find as a child side delegation point if that was the response. Thanks to Qifan Zhang, Palo Alto Networks, for the report.	2026-09-10 11:09:39 +02:00
W.C.A. Wijngaards	18d9a5519e	- Fix to elevate the diagnostic for no matches for a wildcard trusted-keys-file, make it more descriptive, and more man page content for it. Thanks to Qifan Zhang, Palo Alto Networks, for the report.	2026-09-08 16:01:08 +02:00
W.C.A. Wijngaards	2df646e05f	- Fix to not change the action override in rpz_config, before the cname override has succeeded.	2026-09-04 17:20:15 +02:00
W.C.A. Wijngaards	bdfa4d4c5d	- Fix to make rpz_config leave the rpz with correct set up on failure. The struct is not half configured on exit. Thanks to Qifan Zhang, Palo Alto Networks, for the report.	2026-09-04 17:06:34 +02:00
W.C.A. Wijngaards	bd210d124b	- Fix that when a partial EDNS option is in a query, the response is a more RFC conformant FORMERR, since the EDNS option is malformed. Also fix to have an EDNS size for the reply error encoding for failed EDNS parse of the query. Thanks to Qifan Zhang, Palo Alto Networks, for the report.	2026-09-03 17:20:35 +02:00
W.C.A. Wijngaards	11900cc2b0	- Fix that when extended EDNS RCODE does not fit, at short udpsize, the reply is truncated with TC and fix for the rcode in that short reply to be a sensible rcode. Thanks to Qifan Zhang, Palo Alto Networks, for the report.	2026-09-03 15:27:10 +02:00
W.C.A. Wijngaards	c04a5efb07	- Fix to reorder SVCB and HTTPS svcparams for unknown RR form zonefile input. If it can not be parsed it is leniently accepted, much like as a secondary it leniently accepts it. Thanks to Qifan Zhang, Palo Alto Networks, for the report.	2026-09-03 10:59:08 +02:00
W.C.A. Wijngaards	1060760650	- Remove unused .travis.yml for ci integration.	2026-09-03 10:25:31 +02:00
W.C.A. Wijngaards	f251a1157b	- Remove unused .travis.yml for ci integration.	2026-09-03 10:24:51 +02:00
W.C.A. Wijngaards	292cf6526b	- Fix to match NSEC3 hash length to the NSEC3 algorithm, this stops negative cache overdeletion. It also contrains the hash label length and checks if the NSEC nextowner is valid. Thanks to Yuqi Qiu & Xiang Li (Nankai University, AOSP Lab).	2026-09-03 08:38:46 +02:00
W.C.A. Wijngaards	ac935b9144	- Fix to not commit to have_zone at apply AXFR time for auth zone transfers, so that later failure rolls back to not. The have_zone value is set later when the SOA is retrieved. Also fix to clear the zone data when a transfer does not have a valid SOA record in the zone for it. Thanks to Qifan Zhang, Palo Alto Networks, for the report.	2026-09-02 11:42:31 +02:00
W.C.A. Wijngaards	9dd370ba04	- Fix LOC RR parse to avoid double to uint32 cast overflow. Thanks to Qifan Zhang, Palo Alto Networks, for the report.	2026-09-01 17:21:45 +02:00
W.C.A. Wijngaards	a6ccb2f74d	- Fix to allow block_a and other local-zone types in a view.	2026-09-01 08:48:27 +02:00
W.C.A. Wijngaards	32ff948a5b	- Fix notify for auth-zone during initial start up. It performs the transfer and not only lookup.	2026-08-26 16:50:33 +02:00
W.C.A. Wijngaards	2ec2afd6b0	- Fix #132 : Add `harden-cname-follow: yes` config option, that can be used to disable cname scrubbing. That can be useful for when the traffic is on localhost only.	2026-08-24 16:06:17 +02:00
W.C.A. Wijngaards	7fb79b0677	- Fix to defend against double event deletion, that could cause event corruption and use after free, for comm_timer_disable.	2026-08-21 10:29:58 +02:00
W.C.A. Wijngaards	48d0aea60a	- auth-load-thread, unit test for auth_load_http.	2026-08-11 16:50:24 +02:00
W.C.A. Wijngaards	17bbcac979	- auth-load-thread, fix buffer free in http processing.	2026-08-11 16:50:00 +02:00
W.C.A. Wijngaards	fd8ebbb19c	Merge branch 'master' into auth-load-thread	2026-08-11 16:23:20 +02:00
W.C.A. Wijngaards	2adbbea365	- auth-load-thread, print thread details in log at high verbosity, 8.	2026-08-11 16:23:03 +02:00
W.C.A. Wijngaards	8ee0bca833	- Fix stat_values.tdir test to have less test failures.	2026-08-11 10:07:38 +02:00
W.C.A. Wijngaards	c58e6add2b	- Fix #1492 from zacek: Data race in log_init() on key_created/log_lock when calling ub_ctx_create() concurrently from multiple threads.	2026-08-11 09:42:30 +02:00
W.C.A. Wijngaards	156c00a727	Merge branch 'master' into auth-load-thread	2026-08-10 16:42:59 +02:00
W.C.A. Wijngaards	d753f95956	- auth-load-thread, print time taken during auth load processing.	2026-08-10 16:42:04 +02:00
W.C.A. Wijngaards	93a56205cf	- Fix #1489 from jplesnik: Replace removed Python 2 C API macros for SWIG 4.5.0 compatibility.	2026-08-07 08:57:32 +02:00
W.C.A. Wijngaards	709f622658	Note issue number in Changlog entry.	2026-08-06 17:15:55 +02:00
akhanin-dnsfandGitHub	307fc6f062	- Fix bounds check in packed_rr_to_string, it checked the (#1488 ) assembled rr length against the output string length dest_len, instead of against the size of the rr buffer it writes into. Callers in cachedump.c and remote.c pass a dest_len larger than that buffer. - Unit test for packed_rr_to_string.	2026-08-06 17:04:05 +02:00
W.C.A. Wijngaards	8b33c5d7ff	- Fix #1487 : regression in 1.26.0, ipsecmod is now always partly enabled.	2026-08-06 09:46:18 +02:00
W.C.A. Wijngaards	36bd52afb9	Fix typo in Changelog.	2026-08-06 09:08:33 +02:00
W.C.A. Wijngaards	b7d13ff12b	- Fix ##1485: the list_forwards command omits port numbers. The list_forwards and list_stubs commands for unbound-control print port and tls auth name.	2026-08-06 09:08:17 +02:00
W.C.A. Wijngaards	bdfcfb861f	- Fix to set makedist.sh to not wget config.sub and config.guess from git repo. The fetch times out, and the version from libtoolize is much more recent now than that it was when the wget was added.	2026-08-04 10:04:34 +02:00
W.C.A. Wijngaards	b444deffd2	Note 1.26.0 release.	2026-08-04 10:01:59 +02:00
W.C.A. Wijngaards	ff28b7e5cf	- For #1483 : The failure reason when an NSEC NXDOMAIN is encountered when looking for an insecure delegation, is fixed to mention the NSEC records, instead of nonexistent NSEC3 records, that it attempted.	2026-07-31 09:53:47 +02:00
W.C.A. Wijngaards	79b84bbc91	- Fix #1482 : DNS-over-QUIC doesn't work with simple config. That fixes interface-automatic for use with doq service.	2026-07-30 08:24:42 +02:00
W.C.A. Wijngaards	cbfc3b0342	- Tag for 1.26.0rc1. The repo continues with version 1.26.1.	2026-07-28 09:45:59 +02:00
W.C.A. Wijngaards	61d6c0e766	- auth-load-thread, implement active thread counter for auth load threads.	2026-07-07 17:21:16 +02:00
W.C.A. Wijngaards	b4daa2d0fa	- auth-load-thread, use define for constant for number of records before poll.	2026-07-07 16:26:42 +02:00
W.C.A. Wijngaards	425b701fb9	- auth-load-thread, fix memory leak on alloc failure when appending rrset copy for ixfr main zone data copy.	2026-07-03 16:39:28 +02:00
W.C.A. Wijngaards	0a5cde80f1	- auth-load-thread, auth-task-threads: num config option that enables and disables the auth load thread.	2026-07-03 14:03:15 +02:00
W.C.A. Wijngaards	58ede90fdb	Merge branch 'master' into auth-load-thread	2026-07-02 15:28:24 +02:00
W.C.A. Wijngaards	55ae8da032	- auth-load-thread, basic test and fixes so it works.	2026-07-02 11:10:06 +02:00
W.C.A. Wijngaards	6bd86df72e	- auth-load-thread, simplify cleanup in end transfer load process.	2026-07-02 08:55:13 +02:00
W.C.A. Wijngaards	0efd3605cc	Merge branch 'master' into auth-load-thread	2026-07-01 16:54:55 +02:00
W.C.A. Wijngaards	a2f2f53ef9	- auth-load-thread, process end of successful transfer.	2026-07-01 16:54:36 +02:00
W.C.A. Wijngaards	b5a03093f6	- auth-load-thread, check for quit during the processing.	2026-07-01 14:41:40 +02:00
W.C.A. Wijngaards	8eba898135	- auth-load-thread, process AXFR, by loading, swap in, delete of old.	2026-07-01 14:27:31 +02:00
W.C.A. Wijngaards	56f66de89f	- auth-load-thread, process IXFR, by making a copy, adjust changes, swap in.	2026-07-01 13:05:19 +02:00
W.C.A. Wijngaards	2fbaee2255	- auth-load-thread, process transfer content and swap result back in.	2026-06-30 16:53:27 +02:00
W.C.A. Wijngaards	a122490461	- auth-load-thread, poll for quit and process load transfer end.	2026-06-29 16:52:20 +02:00
W.C.A. Wijngaards	7826b4f306	Merge branch 'master' into auth-load-thread	2026-06-29 16:00:01 +02:00
W.C.A. Wijngaards	380994219f	- auth-load-thread, make and run auth load thread.	2026-06-26 17:11:12 +02:00
W.C.A. Wijngaards	153accb8de	- auth-load-thread, put create_socketpair and sock_poll_timeout into util/net_help.h	2026-06-26 15:22:08 +02:00
W.C.A. Wijngaards	7bb1c62263	- auth-load-thread, add authload.c to Makefile.in.	2026-06-26 14:27:12 +02:00
W.C.A. Wijngaards	1578b6e180	- auth-load-thread, add services/authload.c and services/authload.h	2026-06-26 14:00:04 +02:00