modify tdir to ignore localzone tests

Merge branch 'master' into review-rfc8914-ede
remove debug line
2026-10-16 13:35:17 +02:00 · 2022-01-13 14:50:43 +01:00 · 2022-01-11 09:26:49 +01:00 · 2022-01-10 16:28:54 +01:00 · 2021-12-22 15:47:50 +01:00 · 2021-12-22 14:39:06 +01:00
219 changed files with 8236 additions and 14752 deletions
@@ -57,7 +57,7 @@ LEX=@LEX@
 STRIP=@STRIP@
 CC=@CC@
 CPPFLAGS=-I. @CPPFLAGS@
-PYTHON_CPPFLAGS=-I. -I$(srcdir) @PYTHON_CPPFLAGS@
+PYTHON_CPPFLAGS=-I. @PYTHON_CPPFLAGS@
 CFLAGS=-DSRCDIR=$(srcdir) @CFLAGS@
 LDFLAGS=@LDFLAGS@
 LIBS=@LIBS@
@@ -344,16 +344,7 @@ longcheck: longtest
 test:	unittest$(EXEEXT) testbound$(EXEEXT)
 	./unittest$(EXEEXT)
 	./testbound$(EXEEXT) -s
-	for x in $(srcdir)/testdata/*.rpl; do \
-		output=`./testbound$(EXEEXT) -p $$x -o -vvvvv 2>&1`; \
-		if test $$? -eq 0; then \
-			printf "%s OK\n" "$$x "; \
-		else \
-			printf "%s\n" "$$output "; \
-			printf "%s failed\n" "$$x "; \
-			exit 1; \
-		fi; \
-	done
+	for x in $(srcdir)/testdata/*.rpl; do printf "%s" "$$x "; if ./testbound$(EXEEXT) -p $$x >/dev/null 2>&1; then echo OK; else echo failed; exit 1; fi done
 	@echo test OK

 longtest:	tests
@@ -565,7 +556,7 @@ pythonmod-install:

 pyunbound-install:
 	$(INSTALL) -m 755 -d $(DESTDIR)$(PYTHON_SITE_PKG)
-	$(INSTALL) -c -m 644 libunbound/python/unbound.py $(DESTDIR)$(PYTHON_SITE_PKG)/unbound.py
+	$(INSTALL) -c -m 644 $(srcdir)/libunbound/python/unbound.py $(DESTDIR)$(PYTHON_SITE_PKG)/unbound.py
 	$(LIBTOOL) --mode=install cp _unbound.la $(DESTDIR)$(PYTHON_SITE_PKG)
 	$(LIBTOOL) --mode=finish $(DESTDIR)$(PYTHON_SITE_PKG)

@@ -592,8 +583,6 @@ install-lib:	lib $(UNBOUND_EVENT_INSTALL)
 		echo ".so man3/libunbound.3" > $(DESTDIR)$(mandir)/man3/$$mpage.3 ; \
 	done
 	$(LIBTOOL) --mode=install cp unbound.h $(DESTDIR)$(includedir)/unbound.h
-	$(INSTALL) -m 755 -d $(DESTDIR)$(libdir)/pkgconfig
-	$(INSTALL) -m 644 contrib/libunbound.pc $(DESTDIR)$(libdir)/pkgconfig
 	$(LIBTOOL) --mode=install cp libunbound.la $(DESTDIR)$(libdir)
 	$(LIBTOOL) --mode=finish $(DESTDIR)$(libdir)

@@ -603,6 +592,8 @@ install-all:	all $(PYTHONMOD_INSTALL) $(PYUNBOUND_INSTALL) $(UNBOUND_EVENT_INSTA
 	$(INSTALL) -m 755 -d $(DESTDIR)$(mandir)/man8
 	$(INSTALL) -m 755 -d $(DESTDIR)$(mandir)/man5
 	$(INSTALL) -m 755 -d $(DESTDIR)$(mandir)/man1
+	$(INSTALL) -m 755 -d $(DESTDIR)$(libdir)/pkgconfig
+	$(INSTALL) -m 644 contrib/libunbound.pc $(DESTDIR)$(libdir)/pkgconfig
 	$(LIBTOOL) --mode=install cp -f unbound$(EXEEXT) $(DESTDIR)$(sbindir)/unbound$(EXEEXT)
 	$(LIBTOOL) --mode=install cp -f unbound-checkconf$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-checkconf$(EXEEXT)
 	$(LIBTOOL) --mode=install cp -f unbound-control$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-control$(EXEEXT)
@@ -1257,7 +1248,7 @@ cachedump.lo cachedump.o: $(srcdir)/daemon/cachedump.c config.h $(srcdir)/daemon
 $(srcdir)/util/regional.h $(srcdir)/util/net_help.h $(srcdir)/util/data/dname.h $(srcdir)/iterator/iterator.h \
 $(srcdir)/services/outbound_list.h $(srcdir)/iterator/iter_delegpt.h $(srcdir)/iterator/iter_utils.h \
 $(srcdir)/iterator/iter_resptype.h $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h \
- $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h $(srcdir)/util/config_file.h $(srcdir)/services/outside_network.h
+ $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h
 daemon.lo daemon.o: $(srcdir)/daemon/daemon.c config.h $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h \
 $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h  \
  $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h \
@@ -1,31 +0,0 @@
-# Security Policy
-
-## Supported Versions
-
-NLnet Labs adheres to the straightforward, semantic versioning scheme that is
-commonly used in the software industry.
-
-Support is provided in respect of the latest release, i.e. releases with the
-highest minor and patch version level. We do not backport security fixes to
-older (minor) versions. In the event a new major version is released (e.g.  from
-3.2.18 to 4.0.0), support will also be provided on the latest minor  version of
-the previous major version (3.2.18) for a period of one year from the release of
-the new major version (4.0.0).
-
-In the event that, during this period, a new patch or minor version of the
-previous major version is released, then support on these versions will only be
-provided for the remainder of the one-year-period.
-
-You can find detailed information on our software support policy here:
-
-https://www.nlnetlabs.nl/support/software-support-policy/
-
-## Reporting a Vulnerability
-
-We take security very seriously. If you have discovered a security vulnerability
-in one of our projects and you would like to report it to us, you can send an
-encrypted message to our Security Entry Point.
-
-Details are described here:
-
-https://www.nlnetlabs.nl/security-report/
@@ -18,45 +18,27 @@ AC_DEFUN([AC_PYTHON_DEVEL],[
 			print(sys.version.split()[[0]])"`
 	fi

-	# Check if you have sysconfig
-	AC_MSG_CHECKING([for the sysconfig Python module])
-        if ac_sysconfig_result=`$PYTHON -c "import sysconfig" 2>&1`; then
+        #
+        # Check if you have distutils, else fail
+        #
+        AC_MSG_CHECKING([for the distutils Python package])
+        if ac_distutils_result=`$PYTHON -c "import distutils" 2>&1`; then
                AC_MSG_RESULT([yes])
-		sysconfig_module="sysconfig"
-		# if yes, use sysconfig, because distutils is deprecated.
-	else
+        else
                AC_MSG_RESULT([no])
-		# if no, try to use distutils
-
-		#
-		# Check if you have distutils, else fail
-		#
-		AC_MSG_CHECKING([for the distutils Python package])
-		if ac_distutils_result=`$PYTHON -c "import distutils" 2>&1`; then
-			AC_MSG_RESULT([yes])
-		else
-			AC_MSG_RESULT([no])
-			AC_MSG_ERROR([cannot import Python module "distutils".
-	Please check your Python installation. The error was:
-	$ac_distutils_result])
-			PYTHON_VERSION=""
-		fi
-
-		sysconfig_module="distutils.sysconfig"
-	fi
+                AC_MSG_ERROR([cannot import Python module "distutils".
+Please check your Python installation. The error was:
+$ac_distutils_result])
+                PYTHON_VERSION=""
+        fi

        #
        # Check for Python include path
        #
        AC_MSG_CHECKING([for Python include path])
        if test -z "$PYTHON_CPPFLAGS"; then
-		if test "$sysconfig_module" = "sysconfig"; then
-			python_path=`$PYTHON -c 'import sysconfig; \
-				print(sysconfig.get_path("include"));'`
-		else
-			python_path=`$PYTHON -c "import distutils.sysconfig; \
-				print(distutils.sysconfig.get_python_inc());"`
-		fi
+                python_path=`$PYTHON -c "import distutils.sysconfig; \
+                        print(distutils.sysconfig.get_python_inc());"`
                if test -n "${python_path}"; then
                        python_path="-I$python_path"
                fi
@@ -70,14 +52,14 @@ AC_DEFUN([AC_PYTHON_DEVEL],[
        #
        AC_MSG_CHECKING([for Python library path])
        if test -z "$PYTHON_LDFLAGS"; then
-                PYTHON_LDFLAGS=`$PYTHON -c "from $sysconfig_module import *; \
+                PYTHON_LDFLAGS=`$PYTHON -c "from distutils.sysconfig import *; \
                        print('-L'+get_config_var('LIBDIR')+' -L'+get_config_var('LIBDEST')+' '+get_config_var('BLDLIBRARY'));"`
        fi
        AC_MSG_RESULT([$PYTHON_LDFLAGS])
        AC_SUBST([PYTHON_LDFLAGS])

        if test -z "$PYTHON_LIBDIR"; then
-                PYTHON_LIBDIR=`$PYTHON -c "from $sysconfig_module import *; \
+                PYTHON_LIBDIR=`$PYTHON -c "from distutils.sysconfig import *; \
                        print(get_config_var('LIBDIR'));"`
        fi

@@ -86,13 +68,8 @@ AC_DEFUN([AC_PYTHON_DEVEL],[
        #
        AC_MSG_CHECKING([for Python site-packages path])
        if test -z "$PYTHON_SITE_PKG"; then
-		if test "$sysconfig_module" = "sysconfig"; then
-			PYTHON_SITE_PKG=`$PYTHON -c 'import sysconfig; \
-				print(sysconfig.get_path("platlib"));'`
-		else
-			PYTHON_SITE_PKG=`$PYTHON -c "import distutils.sysconfig; \
-				print(distutils.sysconfig.get_python_lib(1,0));"`
-		fi
+                PYTHON_SITE_PKG=`$PYTHON -c "import distutils.sysconfig; \
+                        print(distutils.sysconfig.get_python_lib(1,0));"`
        fi
        AC_MSG_RESULT([$PYTHON_SITE_PKG])
        AC_SUBST([PYTHON_SITE_PKG])
@@ -662,7 +662,7 @@ cachedb_intcache_store(struct module_qstate* qstate)
 		return;
 	(void)dns_cache_store(qstate->env, &qstate->qinfo,
 		qstate->return_msg->rep, 0, qstate->prefetch_leeway, 0,
-		qstate->region, store_flags, qstate->qstarttime);
+		qstate->region, store_flags);
 }

 /**
@@ -222,10 +222,6 @@
 /* Define to 1 if you have the `EVP_cleanup' function. */
 #undef HAVE_EVP_CLEANUP

-/* Define to 1 if you have the `EVP_default_properties_is_fips_enabled'
-   function. */
-#undef HAVE_EVP_DEFAULT_PROPERTIES_IS_FIPS_ENABLED
-
 /* Define to 1 if you have the `EVP_DigestVerify' function. */
 #undef HAVE_EVP_DIGESTVERIFY

@@ -975,10 +971,6 @@
 /* Define to 1 if you need to in order for `stat' and other things to work. */
 #undef _POSIX_SOURCE

-/* defined to use gcc ansi snprintf and sscanf that understands %lld when
-   compiled for windows. */
-#undef __USE_MINGW_ANSI_STDIO
-
 /* Define to empty if `const' does not conform to ANSI C. */
 #undef const

@@ -1158,7 +1150,7 @@
 #include <ws2tcpip.h>
 #endif

-#if !defined(USE_WINSOCK) || !defined(HAVE_SNPRINTF) || defined(SNPRINTF_RET_BROKEN) || defined(__USE_MINGW_ANSI_STDIO)
+#ifndef USE_WINSOCK
 #define ARG_LL "%ll"
 #else
 #define ARG_LL "%I64"
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for unbound 1.16.2.
+# Generated by GNU Autoconf 2.69 for unbound 1.14.1.
 #
 # Report bugs to <unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues>.
 #
@@ -591,8 +591,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='unbound'
 PACKAGE_TARNAME='unbound'
-PACKAGE_VERSION='1.16.2'
-PACKAGE_STRING='unbound 1.16.2'
+PACKAGE_VERSION='1.14.1'
+PACKAGE_STRING='unbound 1.14.1'
 PACKAGE_BUGREPORT='unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues'
 PACKAGE_URL=''

@@ -813,7 +813,6 @@ infodir
 docdir
 oldincludedir
 includedir
-runstatedir
 localstatedir
 sharedstatedir
 sysconfdir
@@ -965,7 +964,6 @@ datadir='${datarootdir}'
 sysconfdir='${prefix}/etc'
 sharedstatedir='${prefix}/com'
 localstatedir='${prefix}/var'
-runstatedir='${localstatedir}/run'
 includedir='${prefix}/include'
 oldincludedir='/usr/include'
 docdir='${datarootdir}/doc/${PACKAGE_TARNAME}'
@@ -1218,15 +1216,6 @@ do
  | -silent | --silent | --silen | --sile | --sil)
    silent=yes ;;

-  -runstatedir | --runstatedir | --runstatedi | --runstated \
-  | --runstate | --runstat | --runsta | --runst | --runs \
-  | --run | --ru | --r)
-    ac_prev=runstatedir ;;
-  -runstatedir=* | --runstatedir=* | --runstatedi=* | --runstated=* \
-  | --runstate=* | --runstat=* | --runsta=* | --runst=* | --runs=* \
-  | --run=* | --ru=* | --r=*)
-    runstatedir=$ac_optarg ;;
-
  -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb)
    ac_prev=sbindir ;;
  -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \
@@ -1364,7 +1353,7 @@ fi
 for ac_var in	exec_prefix prefix bindir sbindir libexecdir datarootdir \
 		datadir sysconfdir sharedstatedir localstatedir includedir \
 		oldincludedir docdir infodir htmldir dvidir pdfdir psdir \
-		libdir localedir mandir runstatedir
+		libdir localedir mandir
 do
  eval ac_val=\$$ac_var
  # Remove trailing slashes.
@@ -1477,7 +1466,7 @@ if test "$ac_init_help" = "long"; then
  # Omit some internal or obsolete options to make the list less imposing.
  # This message is too long to be a string in the A/UX 3.1 sh.
  cat <<_ACEOF
-\`configure' configures unbound 1.16.2 to adapt to many kinds of systems.
+\`configure' configures unbound 1.14.1 to adapt to many kinds of systems.

 Usage: $0 [OPTION]... [VAR=VALUE]...

@@ -1517,7 +1506,6 @@ Fine tuning of the installation directories:
  --sysconfdir=DIR        read-only single-machine data [PREFIX/etc]
  --sharedstatedir=DIR    modifiable architecture-independent data [PREFIX/com]
  --localstatedir=DIR     modifiable single-machine data [PREFIX/var]
-  --runstatedir=DIR       modifiable per-process data [LOCALSTATEDIR/run]
  --libdir=DIR            object code libraries [EPREFIX/lib]
  --includedir=DIR        C header files [PREFIX/include]
  --oldincludedir=DIR     C header files for non-gcc [/usr/include]
@@ -1543,7 +1531,7 @@ fi

 if test -n "$ac_init_help"; then
  case $ac_init_help in
-     short | recursive ) echo "Configuration of unbound 1.16.2:";;
+     short | recursive ) echo "Configuration of unbound 1.14.1:";;
   esac
  cat <<\_ACEOF

@@ -1785,7 +1773,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
  cat <<\_ACEOF
-unbound configure 1.16.2
+unbound configure 1.14.1
 generated by GNU Autoconf 2.69

 Copyright (C) 2012 Free Software Foundation, Inc.
@@ -2494,7 +2482,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.

-It was created by unbound $as_me 1.16.2, which was
+It was created by unbound $as_me 1.14.1, which was
 generated by GNU Autoconf 2.69.  Invocation command line was

  $ $0 $@
@@ -2844,13 +2832,13 @@ ac_compiler_gnu=$ac_cv_c_compiler_gnu

 UNBOUND_VERSION_MAJOR=1

-UNBOUND_VERSION_MINOR=16
+UNBOUND_VERSION_MINOR=14

-UNBOUND_VERSION_MICRO=2
+UNBOUND_VERSION_MICRO=1


 LIBUNBOUND_CURRENT=9
-LIBUNBOUND_REVISION=18
+LIBUNBOUND_REVISION=15
 LIBUNBOUND_AGE=1
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -2932,10 +2920,7 @@ LIBUNBOUND_AGE=1
 # 1.13.1 had 9:12:1
 # 1.13.2 had 9:13:1
 # 1.14.0 had 9:14:1
-# 1.15.0 had 9:15:1
-# 1.16.0 had 9:16:1
-# 1.16.1 had 9:17:1
-# 1.16.2 had 9:18:1
+# 1.14.1 had 9:15:1

 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -17470,38 +17455,22 @@ fi
 			print(sys.version.split()[0])"`
 	fi

-	# Check if you have sysconfig
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for the sysconfig Python module" >&5
-$as_echo_n "checking for the sysconfig Python module... " >&6; }
-        if ac_sysconfig_result=`$PYTHON -c "import sysconfig" 2>&1`; then
+        #
+        # Check if you have distutils, else fail
+        #
+        { $as_echo "$as_me:${as_lineno-$LINENO}: checking for the distutils Python package" >&5
+$as_echo_n "checking for the distutils Python package... " >&6; }
+        if ac_distutils_result=`$PYTHON -c "import distutils" 2>&1`; then
                { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
 $as_echo "yes" >&6; }
-		sysconfig_module="sysconfig"
-		# if yes, use sysconfig, because distutils is deprecated.
-	else
+        else
                { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 $as_echo "no" >&6; }
-		# if no, try to use distutils
-
-		#
-		# Check if you have distutils, else fail
-		#
-		{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for the distutils Python package" >&5
-$as_echo_n "checking for the distutils Python package... " >&6; }
-		if ac_distutils_result=`$PYTHON -c "import distutils" 2>&1`; then
-			{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
-		else
-			{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
-			as_fn_error $? "cannot import Python module \"distutils\".
-	Please check your Python installation. The error was:
-	$ac_distutils_result" "$LINENO" 5
-			PYTHON_VERSION=""
-		fi
-
-		sysconfig_module="distutils.sysconfig"
-	fi
+                as_fn_error $? "cannot import Python module \"distutils\".
+Please check your Python installation. The error was:
+$ac_distutils_result" "$LINENO" 5
+                PYTHON_VERSION=""
+        fi

        #
        # Check for Python include path
@@ -17509,13 +17478,8 @@ $as_echo "no" >&6; }
        { $as_echo "$as_me:${as_lineno-$LINENO}: checking for Python include path" >&5
 $as_echo_n "checking for Python include path... " >&6; }
        if test -z "$PYTHON_CPPFLAGS"; then
-		if test "$sysconfig_module" = "sysconfig"; then
-			python_path=`$PYTHON -c 'import sysconfig; \
-				print(sysconfig.get_path("include"));'`
-		else
-			python_path=`$PYTHON -c "import distutils.sysconfig; \
-				print(distutils.sysconfig.get_python_inc());"`
-		fi
+                python_path=`$PYTHON -c "import distutils.sysconfig; \
+                        print(distutils.sysconfig.get_python_inc());"`
                if test -n "${python_path}"; then
                        python_path="-I$python_path"
                fi
@@ -17531,7 +17495,7 @@ $as_echo "$PYTHON_CPPFLAGS" >&6; }
        { $as_echo "$as_me:${as_lineno-$LINENO}: checking for Python library path" >&5
 $as_echo_n "checking for Python library path... " >&6; }
        if test -z "$PYTHON_LDFLAGS"; then
-                PYTHON_LDFLAGS=`$PYTHON -c "from $sysconfig_module import *; \
+                PYTHON_LDFLAGS=`$PYTHON -c "from distutils.sysconfig import *; \
                        print('-L'+get_config_var('LIBDIR')+' -L'+get_config_var('LIBDEST')+' '+get_config_var('BLDLIBRARY'));"`
        fi
        { $as_echo "$as_me:${as_lineno-$LINENO}: result: $PYTHON_LDFLAGS" >&5
@@ -17539,7 +17503,7 @@ $as_echo "$PYTHON_LDFLAGS" >&6; }


        if test -z "$PYTHON_LIBDIR"; then
-                PYTHON_LIBDIR=`$PYTHON -c "from $sysconfig_module import *; \
+                PYTHON_LIBDIR=`$PYTHON -c "from distutils.sysconfig import *; \
                        print(get_config_var('LIBDIR'));"`
        fi

@@ -17549,13 +17513,8 @@ $as_echo "$PYTHON_LDFLAGS" >&6; }
        { $as_echo "$as_me:${as_lineno-$LINENO}: checking for Python site-packages path" >&5
 $as_echo_n "checking for Python site-packages path... " >&6; }
        if test -z "$PYTHON_SITE_PKG"; then
-		if test "$sysconfig_module" = "sysconfig"; then
-			PYTHON_SITE_PKG=`$PYTHON -c 'import sysconfig; \
-				print(sysconfig.get_path("platlib"));'`
-		else
-			PYTHON_SITE_PKG=`$PYTHON -c "import distutils.sysconfig; \
-				print(distutils.sysconfig.get_python_lib(1,0));"`
-		fi
+                PYTHON_SITE_PKG=`$PYTHON -c "import distutils.sysconfig; \
+                        print(distutils.sysconfig.get_python_lib(1,0));"`
        fi
        { $as_echo "$as_me:${as_lineno-$LINENO}: result: $PYTHON_SITE_PKG" >&5
 $as_echo "$PYTHON_SITE_PKG" >&6; }
@@ -17982,7 +17941,7 @@ if test "`uname`" = "NetBSD"; then

 fi

-if test "`uname`" = "Linux"; then
+if test "`uname -o`" = "GNU/Linux"; then
 	# splint cannot parse modern c99 header files
 	GCC_DOCKER_LINTFLAGS='-syntax'

@@ -18547,7 +18506,7 @@ fi

 done

-for ac_func in OPENSSL_config EVP_sha1 EVP_sha256 EVP_sha512 FIPS_mode EVP_default_properties_is_fips_enabled EVP_MD_CTX_new OpenSSL_add_all_digests OPENSSL_init_crypto EVP_cleanup ENGINE_cleanup ERR_load_crypto_strings CRYPTO_cleanup_all_ex_data ERR_free_strings RAND_cleanup DSA_SIG_set0 EVP_dss1 EVP_DigestVerify EVP_aes_256_cbc EVP_EncryptInit_ex HMAC_Init_ex CRYPTO_THREADID_set_callback EVP_MAC_CTX_set_params OSSL_PARAM_BLD_new BIO_set_callback_ex
+for ac_func in OPENSSL_config EVP_sha1 EVP_sha256 EVP_sha512 FIPS_mode EVP_MD_CTX_new OpenSSL_add_all_digests OPENSSL_init_crypto EVP_cleanup ENGINE_cleanup ERR_load_crypto_strings CRYPTO_cleanup_all_ex_data ERR_free_strings RAND_cleanup DSA_SIG_set0 EVP_dss1 EVP_DigestVerify EVP_aes_256_cbc EVP_EncryptInit_ex HMAC_Init_ex CRYPTO_THREADID_set_callback EVP_MAC_CTX_set_params OSSL_PARAM_BLD_new BIO_set_callback_ex
 do :
  as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
 ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
@@ -19969,46 +19928,7 @@ if test x_$enable_static_exe = x_yes; then
 		else
 			LIBS="$LIBS -lgdi32"
 		fi
-		{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for compress in -lz" >&5
-$as_echo_n "checking for compress in -lz... " >&6; }
-if ${ac_cv_lib_z_compress+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
-  ac_check_lib_save_LIBS=$LIBS
-LIBS="-lz  $LIBS"
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-
-/* Override any GCC internal prototype to avoid an error.
-   Use char because int might match the return type of a GCC
-   builtin and then its argument prototype would still apply.  */
-#ifdef __cplusplus
-extern "C"
-#endif
-char compress ();
-int
-main ()
-{
-return compress ();
-  ;
-  return 0;
-}
-_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
-  ac_cv_lib_z_compress=yes
-else
-  ac_cv_lib_z_compress=no
-fi
-rm -f core conftest.err conftest.$ac_objext \
-    conftest$ac_exeext conftest.$ac_ext
-LIBS=$ac_check_lib_save_LIBS
-fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_z_compress" >&5
-$as_echo "$ac_cv_lib_z_compress" >&6; }
-if test "x$ac_cv_lib_z_compress" = xyes; then :
-   LIBS="$LIBS -lz"
-fi
-
+		LIBS="$LIBS -lz"
 		LIBS="$LIBS -l:libssp.a"
 	fi
 fi
@@ -20028,46 +19948,7 @@ if test x_$enable_fully_static = x_yes; then
 		else
 			LIBS="$LIBS -lgdi32"
 		fi
-		{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for compress in -lz" >&5
-$as_echo_n "checking for compress in -lz... " >&6; }
-if ${ac_cv_lib_z_compress+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
-  ac_check_lib_save_LIBS=$LIBS
-LIBS="-lz  $LIBS"
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-
-/* Override any GCC internal prototype to avoid an error.
-   Use char because int might match the return type of a GCC
-   builtin and then its argument prototype would still apply.  */
-#ifdef __cplusplus
-extern "C"
-#endif
-char compress ();
-int
-main ()
-{
-return compress ();
-  ;
-  return 0;
-}
-_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
-  ac_cv_lib_z_compress=yes
-else
-  ac_cv_lib_z_compress=no
-fi
-rm -f core conftest.err conftest.$ac_objext \
-    conftest$ac_exeext conftest.$ac_ext
-LIBS=$ac_check_lib_save_LIBS
-fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_z_compress" >&5
-$as_echo "$ac_cv_lib_z_compress" >&6; }
-if test "x$ac_cv_lib_z_compress" = xyes; then :
-   LIBS="$LIBS -lz"
-fi
-
+		LIBS="$LIBS -lz"
 		LIBS="$LIBS -l:libssp.a"
 	fi
 fi
@@ -20300,9 +20181,6 @@ fi

 	WIN_CHECKCONF_OBJ_LINK="rsrc_unbound_checkconf.o"

-
-$as_echo "#define __USE_MINGW_ANSI_STDIO 1" >>confdefs.h
-
 fi
 if test $ac_cv_func_getaddrinfo = no; then
 	case " $LIBOBJS " in
@@ -21800,16 +21678,10 @@ $as_echo_n "checking for libmnl... " >&6; }
 			withval="/usr/local /opt/local /usr/lib /usr/pkg /usr/sfw /usr"
 		fi
 		for dir in $withval ; do
-			if test -f "$dir/include/libmnl/libmnl.h" -o -f "$dir/include/libmnl/libmnl/libmnl.h"; then
+			if test -f "$dir/include/libmnl/libmnl.h"; then
 				found_libmnl="yes"
-								extralibmnl=""
-				if test -f "$dir/include/libmnl/libmnl/libmnl.h"; then
-					extralibmnl="/libmnl"
-				fi
-				if test "$dir" != "/usr" -o -n "$extralibmnl"; then
-					CPPFLAGS="$CPPFLAGS -I$dir/include$extralibmnl"
-				fi
-				if test "$dir" != "/usr"; then
+								if test "$dir" != "/usr"; then
+					CPPFLAGS="$CPPFLAGS -I$dir/include"
 					LDFLAGS="$LDFLAGS -L$dir/lib"
 				fi
 				{ $as_echo "$as_me:${as_lineno-$LINENO}: result: found in $dir" >&5
@@ -22014,7 +21886,7 @@ _ACEOF



-version=1.16.2
+version=1.14.1

 date=`date +'%b %e, %Y'`

@@ -22533,7 +22405,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by unbound $as_me 1.16.2, which was
+This file was extended by unbound $as_me 1.14.1, which was
 generated by GNU Autoconf 2.69.  Invocation command line was

  CONFIG_FILES    = $CONFIG_FILES
@@ -22599,7 +22471,7 @@ _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-unbound config.status 1.16.2
+unbound config.status 1.14.1
 configured by $0, generated by GNU Autoconf 2.69,
  with options \\"\$ac_cs_config\\"

@@ -10,15 +10,15 @@ sinclude(dnscrypt/dnscrypt.m4)

 # must be numbers. ac_defun because of later processing
 m4_define([VERSION_MAJOR],[1])
-m4_define([VERSION_MINOR],[16])
-m4_define([VERSION_MICRO],[2])
+m4_define([VERSION_MINOR],[14])
+m4_define([VERSION_MICRO],[1])
 AC_INIT([unbound],m4_defn([VERSION_MAJOR]).m4_defn([VERSION_MINOR]).m4_defn([VERSION_MICRO]),[unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues],[unbound])
 AC_SUBST(UNBOUND_VERSION_MAJOR, [VERSION_MAJOR])
 AC_SUBST(UNBOUND_VERSION_MINOR, [VERSION_MINOR])
 AC_SUBST(UNBOUND_VERSION_MICRO, [VERSION_MICRO])

 LIBUNBOUND_CURRENT=9
-LIBUNBOUND_REVISION=18
+LIBUNBOUND_REVISION=15
 LIBUNBOUND_AGE=1
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -100,10 +100,7 @@ LIBUNBOUND_AGE=1
 # 1.13.1 had 9:12:1
 # 1.13.2 had 9:13:1
 # 1.14.0 had 9:14:1
-# 1.15.0 had 9:15:1
-# 1.16.0 had 9:16:1
-# 1.16.1 had 9:17:1
-# 1.16.2 had 9:18:1
+# 1.14.1 had 9:15:1

 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -819,7 +816,7 @@ if test "`uname`" = "NetBSD"; then
 	AC_SUBST(NETBSD_LINTFLAGS)
 fi

-if test "`uname`" = "Linux"; then
+if test "`uname -o`" = "GNU/Linux"; then
 	# splint cannot parse modern c99 header files
 	GCC_DOCKER_LINTFLAGS='-syntax'
 	AC_SUBST(GCC_DOCKER_LINTFLAGS)
@@ -908,7 +905,7 @@ else
 	AC_MSG_RESULT([no])
 fi
 AC_CHECK_HEADERS([openssl/conf.h openssl/engine.h openssl/bn.h openssl/dh.h openssl/dsa.h openssl/rsa.h openssl/core_names.h openssl/param_build.h],,, [AC_INCLUDES_DEFAULT])
-AC_CHECK_FUNCS([OPENSSL_config EVP_sha1 EVP_sha256 EVP_sha512 FIPS_mode EVP_default_properties_is_fips_enabled EVP_MD_CTX_new OpenSSL_add_all_digests OPENSSL_init_crypto EVP_cleanup ENGINE_cleanup ERR_load_crypto_strings CRYPTO_cleanup_all_ex_data ERR_free_strings RAND_cleanup DSA_SIG_set0 EVP_dss1 EVP_DigestVerify EVP_aes_256_cbc EVP_EncryptInit_ex HMAC_Init_ex CRYPTO_THREADID_set_callback EVP_MAC_CTX_set_params OSSL_PARAM_BLD_new BIO_set_callback_ex])
+AC_CHECK_FUNCS([OPENSSL_config EVP_sha1 EVP_sha256 EVP_sha512 FIPS_mode EVP_MD_CTX_new OpenSSL_add_all_digests OPENSSL_init_crypto EVP_cleanup ENGINE_cleanup ERR_load_crypto_strings CRYPTO_cleanup_all_ex_data ERR_free_strings RAND_cleanup DSA_SIG_set0 EVP_dss1 EVP_DigestVerify EVP_aes_256_cbc EVP_EncryptInit_ex HMAC_Init_ex CRYPTO_THREADID_set_callback EVP_MAC_CTX_set_params OSSL_PARAM_BLD_new BIO_set_callback_ex])

 # these check_funcs need -lssl
 BAKLIBS="$LIBS"
@@ -1501,7 +1498,7 @@ if test x_$enable_static_exe = x_yes; then
 		else
 			LIBS="$LIBS -lgdi32"
 		fi
-		AC_CHECK_LIB([z], [compress], [ LIBS="$LIBS -lz" ])
+		LIBS="$LIBS -lz"
 		LIBS="$LIBS -l:libssp.a"
 	fi
 fi
@@ -1518,7 +1515,7 @@ if test x_$enable_fully_static = x_yes; then
 		else
 			LIBS="$LIBS -lgdi32"
 		fi
-		AC_CHECK_LIB([z], [compress], [ LIBS="$LIBS -lz" ])
+		LIBS="$LIBS -lz"
 		LIBS="$LIBS -l:libssp.a"
 	fi
 fi
@@ -1556,7 +1553,6 @@ if test "$USE_WINSOCK" = 1; then
 	AC_SUBST(WIN_CONTROL_OBJ_LINK)
 	WIN_CHECKCONF_OBJ_LINK="rsrc_unbound_checkconf.o"
 	AC_SUBST(WIN_CHECKCONF_OBJ_LINK)
-	AC_DEFINE(__USE_MINGW_ANSI_STDIO, 1, [defined to use gcc ansi snprintf and sscanf that understands %lld when compiled for windows.])
 fi
 if test $ac_cv_func_getaddrinfo = no; then
 	AC_LIBOBJ([fake-rfc2553])
@@ -1882,17 +1878,11 @@ case "$enable_ipset" in
 			withval="/usr/local /opt/local /usr/lib /usr/pkg /usr/sfw /usr"
 		fi
 		for dir in $withval ; do
-			if test -f "$dir/include/libmnl/libmnl.h" -o -f "$dir/include/libmnl/libmnl/libmnl.h"; then
+			if test -f "$dir/include/libmnl/libmnl.h"; then
 				found_libmnl="yes"
 				dnl assume /usr is in default path.
-				extralibmnl=""
-				if test -f "$dir/include/libmnl/libmnl/libmnl.h"; then
-					extralibmnl="/libmnl"
-				fi
-				if test "$dir" != "/usr" -o -n "$extralibmnl"; then
-					CPPFLAGS="$CPPFLAGS -I$dir/include$extralibmnl"
-				fi
 				if test "$dir" != "/usr"; then
+					CPPFLAGS="$CPPFLAGS -I$dir/include"
 					LDFLAGS="$LDFLAGS -L$dir/lib"
 				fi
 				AC_MSG_RESULT(found in $dir)
@@ -2070,7 +2060,7 @@ dnl includes
 #include <ws2tcpip.h>
 #endif

-#if !defined(USE_WINSOCK) || !defined(HAVE_SNPRINTF) || defined(SNPRINTF_RET_BROKEN) || defined(__USE_MINGW_ANSI_STDIO)
+#ifndef USE_WINSOCK
 #define ARG_LL "%ll"
 #else
 #define ARG_LL "%I64"
@@ -1,5 +1,5 @@
 diff --git a/doc/unbound.conf.5.in b/doc/unbound.conf.5.in
-index 5a75e319..c6c6dbe2 100644
+index 50f9224..09456f5 100644
 --- a/doc/unbound.conf.5.in
 +++ b/doc/unbound.conf.5.in
@@ -970,6 +970,13 @@ potentially broken nameservers. A lot of domains will not be resolvable when
@@ -17,14 +17,13 @@ index 5a75e319..c6c6dbe2 100644
 Aggressive NSEC uses the DNSSEC NSEC chain to synthesize NXDOMAIN
 and other denials, using information from previous NXDOMAINs answers.
 diff --git a/iterator/iter_scrub.c b/iterator/iter_scrub.c
-index f093c1bf..e55a2246 100644
+index f093c1b..e55a224 100644
 --- a/iterator/iter_scrub.c
 +++ b/iterator/iter_scrub.c
-@@ -679,6 +679,32 @@ static int sanitize_nsec_is_overreach(sldns_buffer* pkt,
- 	return 0;
+@@ -680,6 +680,32 @@ static int sanitize_nsec_is_overreach(sldns_buffer* pkt,
 }
 
-+/**
+ /**
 + * ASN: Lookup A records from rrset cache.
 + * @param qinfo: the question originally asked.
 + * @param env: module environment with config and cache.
@@ -50,9 +49,10 @@ index f093c1bf..e55a2246 100644
 +	return 0;
 +}
 +
- /**
+/**
  * Given a response event, remove suspect RRsets from the response.
  * "Suspect" rrsets are potentially poison. Note that this routine expects
+  * the response to be in a "normalized" state -- that is, all "irrelevant"
@@ -698,6 +724,7 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
 	struct query_info* qinfo, uint8_t* zonename, struct module_env* env,
 	struct iter_env* ie)
@@ -101,7 +101,7 @@ index f093c1bf..e55a2246 100644
 		if( (rrset->type == LDNS_RR_TYPE_A || 
 			rrset->type == LDNS_RR_TYPE_AAAA)) {
 diff --git a/iterator/iter_utils.c b/iterator/iter_utils.c
-index 2482a1f4..bd5ba243 100644
+index 2482a1f..bd5ba24 100644
 --- a/iterator/iter_utils.c
 +++ b/iterator/iter_utils.c
@@ -177,6 +177,7 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)
@@ -113,10 +113,10 @@ index 2482a1f4..bd5ba243 100644
 }
 
 diff --git a/iterator/iterator.c b/iterator/iterator.c
-index 54006940..768fe202 100644
+index 48238a2..34ba249 100644
 --- a/iterator/iterator.c
 +++ b/iterator/iterator.c
-@@ -2155,6 +2155,53 @@ processDSNSFind(struct module_qstate* qstate, struct iter_qstate* iq, int id)
+@@ -2184,6 +2184,53 @@ processDSNSFind(struct module_qstate* qstate, struct iter_qstate* iq, int id)
 
 	return 0;
 }
@@ -170,7 +170,7 @@ index 54006940..768fe202 100644
 	
 /** 
  * This is the request event state where the request will be sent to one of
-@@ -2216,6 +2263,13 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
+@@ -2243,6 +2290,13 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 		return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
 	}
 	
@@ -184,7 +184,7 @@ index 54006940..768fe202 100644
 	/* Make sure we have a delegation point, otherwise priming failed
 	 * or another failure occurred */
 	if(!iq->dp) {
-@@ -3648,6 +3702,61 @@ processFinished(struct module_qstate* qstate, struct iter_qstate* iq,
+@@ -3688,6 +3742,61 @@ processFinished(struct module_qstate* qstate, struct iter_qstate* iq,
 	return 0;
 }
 
@@ -246,7 +246,7 @@ index 54006940..768fe202 100644
 /*
  * Return priming query results to interested super querystates.
  * 
-@@ -3667,6 +3776,9 @@ iter_inform_super(struct module_qstate* qstate, int id,
+@@ -3707,6 +3816,9 @@ iter_inform_super(struct module_qstate* qstate, int id,
 	else if(super->qinfo.qtype == LDNS_RR_TYPE_DS && ((struct iter_qstate*)
 		super->minfo[id])->state == DSNS_FIND_STATE)
 		processDSNSResponse(qstate, id, super);
@@ -256,7 +256,7 @@ index 54006940..768fe202 100644
 	else if(qstate->return_rcode != LDNS_RCODE_NOERROR)
 		error_supers(qstate, id, super);
 	else if(qstate->is_priming)
-@@ -3704,6 +3816,9 @@ iter_handle(struct module_qstate* qstate, struct iter_qstate* iq,
+@@ -3744,6 +3856,9 @@ iter_handle(struct module_qstate* qstate, struct iter_qstate* iq,
 			case INIT_REQUEST_3_STATE:
 				cont = processInitRequest3(qstate, iq, id);
 				break;
@@ -266,7 +266,7 @@ index 54006940..768fe202 100644
 			case QUERYTARGETS_STATE:
 				cont = processQueryTargets(qstate, iq, ie, id);
 				break;
-@@ -4040,6 +4155,8 @@ iter_state_to_string(enum iter_state state)
+@@ -4080,6 +4195,8 @@ iter_state_to_string(enum iter_state state)
 		return "INIT REQUEST STATE (stage 2)";
 	case INIT_REQUEST_3_STATE:
 		return "INIT REQUEST STATE (stage 3)";
@@ -275,7 +275,7 @@ index 54006940..768fe202 100644
 	case QUERYTARGETS_STATE :
 		return "QUERY TARGETS STATE";
 	case PRIME_RESP_STATE :
-@@ -4064,6 +4181,7 @@ iter_state_is_responsestate(enum iter_state s)
+@@ -4104,6 +4221,7 @@ iter_state_is_responsestate(enum iter_state s)
 		case INIT_REQUEST_STATE :
 		case INIT_REQUEST_2_STATE :
 		case INIT_REQUEST_3_STATE :
@@ -284,7 +284,7 @@ index 54006940..768fe202 100644
 		case COLLECT_CLASS_STATE :
 			return 0;
 diff --git a/iterator/iterator.h b/iterator/iterator.h
-index 8b840528..a61c4195 100644
+index a9e5856..ace68c6 100644
 --- a/iterator/iterator.h
 +++ b/iterator/iterator.h
@@ -133,6 +133,9 @@ struct iter_env {
@@ -297,11 +297,10 @@ index 8b840528..a61c4195 100644
 	/** lock on ratelimit counter */
 	lock_basic_type queries_ratelimit_lock;
 	/** number of queries that have been ratelimited */
-@@ -187,6 +190,14 @@ enum iter_state {
- 	 */
+@@ -188,6 +191,14 @@ enum iter_state {
 	INIT_REQUEST_3_STATE,
 
-+	/**
+ 	/**
 +	 * This state is responsible for intercepting AAAA queries,
 +	 * and launch a A subquery on the same target, to populate the
 +	 * cache with A records, so the AAAA filter scrubbing logic can
@@ -309,9 +308,10 @@ index 8b840528..a61c4195 100644
 +	 */
 +	ASN_FETCH_A_FOR_AAAA_STATE,
 +
- 	/**
+	/**
 	 * Each time a delegation point changes for a given query or a 
 	 * query times out and/or wakes up, this state is (re)visited. 
+ 	 * This state is responsible for iterating through a list of 
@@ -376,6 +387,13 @@ struct iter_qstate {
 	 */
 	int refetch_glue;
@@ -327,10 +327,10 @@ index 8b840528..a61c4195 100644
 	struct outbound_list outlist;
 
 diff --git a/pythonmod/interface.i b/pythonmod/interface.i
-index 1ca8686a..d91b19ec 100644
+index 03483ab..a8c30b5 100644
 --- a/pythonmod/interface.i
 +++ b/pythonmod/interface.i
-@@ -995,6 +995,7 @@ struct config_file {
+@@ -994,6 +994,7 @@ struct config_file {
    int harden_dnssec_stripped;
    int harden_referral_path;
    int use_caps_bits_for_id;
@@ -339,7 +339,7 @@ index 1ca8686a..d91b19ec 100644
    struct config_strlist* private_domain;
    size_t unwanted_threshold;
 diff --git a/util/config_file.c b/util/config_file.c
-index 969d664b..8d94b008 100644
+index 39050f5..326b0b9 100644
 --- a/util/config_file.c
 +++ b/util/config_file.c
@@ -231,6 +231,7 @@ config_create(void)
@@ -351,7 +351,7 @@ index 969d664b..8d94b008 100644
 	cfg->private_address = NULL;
 	cfg->private_domain = NULL;
 diff --git a/util/config_file.h b/util/config_file.h
-index c7c9a0a4..e3aa15b0 100644
+index 18910be..bd59144 100644
 --- a/util/config_file.h
 +++ b/util/config_file.h
@@ -285,6 +285,8 @@ struct config_file {
@@ -364,7 +364,7 @@ index c7c9a0a4..e3aa15b0 100644
 	struct config_strlist* caps_whitelist;
 	/** strip away these private addrs from answers, no DNS Rebinding */
 diff --git a/util/configlexer.lex b/util/configlexer.lex
-index 34a0e5dd..c890be2a 100644
+index 71da924..b58b4b6 100644
 --- a/util/configlexer.lex
 +++ b/util/configlexer.lex
@@ -317,6 +317,7 @@ use-caps-for-id{COLON}		{ YDVAR(1, VAR_USE_CAPS_FOR_ID) }
@@ -376,7 +376,7 @@ index 34a0e5dd..c890be2a 100644
 private-domain{COLON}		{ YDVAR(1, VAR_PRIVATE_DOMAIN) }
 prefetch-key{COLON}		{ YDVAR(1, VAR_PREFETCH_KEY) }
 diff --git a/util/configparser.y b/util/configparser.y
-index d4f965f9..8cc237c6 100644
+index 1daf853..cd39618 100644
 --- a/util/configparser.y
 +++ b/util/configparser.y
@@ -97,6 +97,7 @@ extern struct config_parser_state* cfg_parser;
@@ -387,7 +387,7 @@ index d4f965f9..8cc237c6 100644
 %token VAR_PRIVATE_DOMAIN VAR_REMOTE_CONTROL VAR_CONTROL_ENABLE
 %token VAR_CONTROL_INTERFACE VAR_CONTROL_PORT VAR_SERVER_KEY_FILE
 %token VAR_SERVER_CERT_FILE VAR_CONTROL_KEY_FILE VAR_CONTROL_CERT_FILE
-@@ -247,6 +248,7 @@ content_server: server_num_threads | server_verbosity | server_port |
+@@ -245,6 +246,7 @@ content_server: server_num_threads | server_verbosity | server_port |
 	server_dlv_anchor_file | server_dlv_anchor | server_neg_cache_size |
 	server_harden_referral_path | server_private_address |
 	server_private_domain | server_extended_statistics |
@@ -395,7 +395,7 @@ index d4f965f9..8cc237c6 100644
 	server_local_data_ptr | server_jostle_timeout |
 	server_unwanted_reply_threshold | server_log_time_ascii |
 	server_domain_insecure | server_val_sig_skew_min |
-@@ -1754,6 +1756,15 @@ server_caps_whitelist: VAR_CAPS_WHITELIST STRING_ARG
+@@ -1742,6 +1744,15 @@ server_caps_whitelist: VAR_CAPS_WHITELIST STRING_ARG
 			yyerror("out of memory");
 	}
 	;
@@ -28,7 +28,6 @@ END {
 	print "unbound_hits_queries{type=\"total.num.prefetch\"} " val["total.num.prefetch"];
 	print "unbound_hits_queries{type=\"num.query.tcp\"} " val["num.query.tcp"];
 	print "unbound_hits_queries{type=\"num.query.tcpout\"} " val["num.query.tcpout"];
-	print "unbound_hits_queries{type=\"num.query.udpout\"} " val["num.query.udpout"];
 	print "unbound_hits_queries{type=\"num.query.tls\"} " val["num.query.tls"];
 	print "unbound_hits_queries{type=\"num.query.tls.resume\"} " val["num.query.tls.resume"];
 	print "unbound_hits_queries{type=\"num.query.ipv6\"} " val["num.query.ipv6"];
@@ -253,7 +253,6 @@ if test "$1" = "config" ; then
 		p_config "total.num.prefetch" "cache prefetch" "ABSOLUTE"
 		p_config "num.query.tcp" "TCP queries" "ABSOLUTE"
 		p_config "num.query.tcpout" "TCP out queries" "ABSOLUTE"
-		p_config "num.query.udpout" "UDP out queries" "ABSOLUTE"
 		p_config "num.query.tls" "TLS queries" "ABSOLUTE"
 		p_config "num.query.tls.resume" "TLS resumes" "ABSOLUTE"
 		p_config "num.query.ipv6" "IPv6 queries" "ABSOLUTE"
@@ -453,7 +452,7 @@ hits)
 	for x in `grep "^thread[0-9][0-9]*\.num\.queries=" $state |
 		sed -e 's/=.*//'` total.num.queries \
 		total.num.cachehits total.num.prefetch num.query.tcp \
-		num.query.tcpout num.query.udpout num.query.tls num.query.tls.resume \
+		num.query.tcpout num.query.tls num.query.tls.resume \
 		num.query.ipv6 unwanted.queries \
 		unwanted.replies; do
 		if grep "^"$x"=" $state >/dev/null 2>&1; then
@@ -487,38 +487,3 @@ acl_list_get_mem(struct acl_list* acl)
 	if(!acl) return 0;
 	return sizeof(*acl) + regional_get_mem(acl->region);
 }
-
-const char* acl_access_to_str(enum acl_access acl)
-{
-	switch(acl) {
-	case acl_deny: return "deny";
-	case acl_refuse: return "refuse";
-	case acl_deny_non_local: return "deny_non_local";
-	case acl_refuse_non_local: return "refuse_non_local";
-	case acl_allow: return "allow";
-	case acl_allow_snoop: return "allow_snoop";
-	case acl_allow_setrd: return "allow_setrd";
-	default: break;
-	}
-	return "unknown";
-}
-
-void
-log_acl_action(const char* action, struct sockaddr_storage* addr,
-	socklen_t addrlen, enum acl_access acl, struct acl_addr* acladdr)
-{
-	char a[128], n[128];
-	uint16_t port;
-	addr_to_str(addr, addrlen, a, sizeof(a));
-	port = ntohs(((struct sockaddr_in*)addr)->sin_port);
-	if(acladdr) {
-		addr_to_str(&acladdr->node.addr, acladdr->node.addrlen,
-			n, sizeof(n));
-		verbose(VERB_ALGO, "%s query from %s port %d because of "
-			"%s/%d %s", action, a, (int)port, n, acladdr->node.net,
-			acl_access_to_str(acl));
-	} else {
-		verbose(VERB_ALGO, "%s query from %s port %d", action, a,
-			(int)port);
-	}
-}
@@ -154,15 +154,4 @@ acl_addr_lookup(struct acl_list* acl, struct sockaddr_storage* addr,
 */
 size_t acl_list_get_mem(struct acl_list* acl);

-/*
- * Get string for acl access specification
- * @param acl: access type value
- * @return string
- */
-const char* acl_access_to_str(enum acl_access acl);
-
-/* log acl and addr for action */
-void log_acl_action(const char* action, struct sockaddr_storage* addr,
-	socklen_t addrlen, enum acl_access acl, struct acl_addr* acladdr);
-
 #endif /* DAEMON_ACL_LIST_H */
@@ -47,12 +47,10 @@
 #include "services/cache/rrset.h"
 #include "services/cache/dns.h"
 #include "services/cache/infra.h"
-#include "services/outside_network.h"
 #include "util/data/msgreply.h"
 #include "util/regional.h"
 #include "util/net_help.h"
 #include "util/data/dname.h"
-#include "util/config_file.h"
 #include "iterator/iterator.h"
 #include "iterator/iter_delegpt.h"
 #include "iterator/iter_utils.h"
@@ -679,8 +677,7 @@ load_msg(RES* ssl, sldns_buffer* buf, struct worker* worker)
 	if(!go_on) 
 		return 1; /* skip this one, not all references satisfied */

-	if(!dns_cache_store(&worker->env, &qinf, &rep, 0, 0, 0, NULL, flags,
-		*worker->env.now)) {
+	if(!dns_cache_store(&worker->env, &qinf, &rep, 0, 0, 0, NULL, flags)) {
 		log_warn("error out of memory");
 		return 0;
 	}
@@ -851,15 +848,13 @@ int print_deleg_lookup(RES* ssl, struct worker* worker, uint8_t* nm,
 	while(1) {
 		dp = dns_cache_find_delegation(&worker->env, nm, nmlen, 
 			qinfo.qtype, qinfo.qclass, region, &msg, 
-			*worker->env.now, 0, NULL, 0);
+			*worker->env.now);
 		if(!dp) {
 			return ssl_printf(ssl, "no delegation from "
 				"cache; goes to configured roots\n");
 		}
 		/* go up? */
-		if(iter_dp_is_useless(&qinfo, BIT_RD, dp,
-			(worker->env.cfg->do_ip4 && worker->back->num_ip4 != 0),
-			(worker->env.cfg->do_ip6 && worker->back->num_ip6 != 0))) {
+		if(iter_dp_is_useless(&qinfo, BIT_RD, dp)) {
 			print_dp_main(ssl, dp, msg);
 			print_dp_details(ssl, worker, dp);
 			if(!ssl_printf(ssl, "cache delegation was "
@@ -795,7 +795,7 @@ daemon_delete(struct daemon* daemon)
 	ub_c_lex_destroy();
 	/* libcrypto cleanup */
 #ifdef HAVE_SSL
-#  if defined(USE_GOST)
+#  if defined(USE_GOST) && defined(HAVE_LDNS_KEY_EVP_UNLOAD_GOST)
 	sldns_key_EVP_unload_gost();
 #  endif
 #  if HAVE_DECL_SSL_COMP_GET_COMPRESSION_METHODS && HAVE_DECL_SK_SSL_COMP_POP_FREE
@@ -988,8 +988,6 @@ print_ext(RES* ssl, struct ub_stats_info* s)
 		(unsigned long)s->svr.qtcp)) return 0;
 	if(!ssl_printf(ssl, "num.query.tcpout"SQ"%lu\n", 
 		(unsigned long)s->svr.qtcp_outgoing)) return 0;
-	if(!ssl_printf(ssl, "num.query.udpout"SQ"%lu\n",
-		(unsigned long)s->svr.qudp_outgoing)) return 0;
 	if(!ssl_printf(ssl, "num.query.tls"SQ"%lu\n", 
 		(unsigned long)s->svr.qtls)) return 0;
 	if(!ssl_printf(ssl, "num.query.tls.resume"SQ"%lu\n", 
@@ -1287,6 +1285,62 @@ do_zone_remove(RES* ssl, struct local_zones* zones, char* arg)
 	send_ok(ssl);
 }

+/** Enable or disable EDE (RFC 8914) responses in this local-zone */
+static int
+do_zone_enable_disable_ede(RES* ssl, struct local_zones* zones, char* arg,
+	int enable)
+{
+	uint8_t* name;
+	int namelabels;
+	size_t namelen;
+	struct local_zone* z;
+
+	if(!parse_arg_name(ssl, arg, &name, &namelen, &namelabels)) {
+		free(name);
+		return 0;
+	}
+
+	lock_rw_wrlock(&zones->lock);
+
+	if(!(z=local_zones_find(zones, name, namelen, 
+		namelabels, LDNS_RR_CLASS_IN))) {
+		ssl_printf(ssl, "local-zone: %s not found\n", arg);
+		free(name);
+		lock_rw_unlock(&zones->lock);
+		return 0;
+	}
+	/* found local-zone in tree */
+	lock_rw_wrlock(&z->lock);
+	if (enable) {
+		z->do_ede = 1;
+	}
+	else
+		z->do_ede = 0;
+	lock_rw_unlock(&z->lock);
+	
+	free(name);
+	lock_rw_unlock(&zones->lock);
+	return 1;
+}
+
+/** Perform the do_zone_enable_ede command */
+static void
+do_zone_enable_ede(RES* ssl, struct local_zones* zones, char* arg)
+{
+	if(!(do_zone_enable_disable_ede(ssl, zones, arg, 1)))
+		return;
+	send_ok(ssl);
+}
+
+/** Perform the do_zone_disable_ede command */
+static void
+do_zone_disable_ede(RES* ssl, struct local_zones* zones, char* arg)
+{
+	if(!(do_zone_enable_disable_ede(ssl, zones, arg, 0)))
+		return;
+	send_ok(ssl);
+}
+
 /** Do the local_zones_remove command */
 static void
 do_zones_remove(RES* ssl, struct local_zones* zones)
@@ -2017,7 +2071,7 @@ print_root_fwds(RES* ssl, struct iter_forwards* fwds, uint8_t* root)

 /** parse args into delegpt */
 static struct delegpt*
-parse_delegpt(RES* ssl, char* args, uint8_t* nm)
+parse_delegpt(RES* ssl, char* args, uint8_t* nm, int allow_names)
 {
 	/* parse args and add in */
 	char* p = args;
@@ -2039,35 +2093,40 @@ parse_delegpt(RES* ssl, char* args, uint8_t* nm)
 		}
 		/* parse address */
 		if(!authextstrtoaddr(todo, &addr, &addrlen, &auth_name)) {
-			uint8_t* dname= NULL;
-			int port;
-			dname = authextstrtodname(todo, &port, &auth_name);
-			if(!dname) {
+			if(allow_names) {
+				uint8_t* n = NULL;
+				size_t ln;
+				int lb;
+				if(!parse_arg_name(ssl, todo, &n, &ln, &lb)) {
+					(void)ssl_printf(ssl, "error cannot "
+						"parse IP address or name "
+						"'%s'\n", todo);
+					delegpt_free_mlc(dp);
+					return NULL;
+				}
+				if(!delegpt_add_ns_mlc(dp, n, 0)) {
+					(void)ssl_printf(ssl, "error out of memory\n");
+					free(n);
+					delegpt_free_mlc(dp);
+					return NULL;
+				}
+				free(n);
+
+			} else {
 				(void)ssl_printf(ssl, "error cannot parse"
-					" '%s'\n", todo);
-				delegpt_free_mlc(dp);
-				return NULL;
-			}
-#if ! defined(HAVE_SSL_SET1_HOST) && ! defined(HAVE_X509_VERIFY_PARAM_SET1_HOST)
-			if(auth_name)
-				log_err("no name verification functionality in "
-				"ssl library, ignored name for %s", todo);
-#endif
-			if(!delegpt_add_ns_mlc(dp, dname, 0, auth_name, port)) {
-				(void)ssl_printf(ssl, "error out of memory\n");
-				free(dname);
+					" IP address '%s'\n", todo);
 				delegpt_free_mlc(dp);
 				return NULL;
 			}
 		} else {
 #if ! defined(HAVE_SSL_SET1_HOST) && ! defined(HAVE_X509_VERIFY_PARAM_SET1_HOST)
 			if(auth_name)
-				log_err("no name verification functionality in "
+			  log_err("no name verification functionality in "
 				"ssl library, ignored name for %s", todo);
 #endif
 			/* add address */
 			if(!delegpt_add_addr_mlc(dp, &addr, addrlen, 0, 0,
-				auth_name, -1)) {
+				auth_name)) {
 				(void)ssl_printf(ssl, "error out of memory\n");
 				delegpt_free_mlc(dp);
 				return NULL;
@@ -2100,7 +2159,7 @@ do_forward(RES* ssl, struct worker* worker, char* args)
 		forwards_delete_zone(fwd, LDNS_RR_CLASS_IN, root);
 	} else {
 		struct delegpt* dp;
-		if(!(dp = parse_delegpt(ssl, args, root)))
+		if(!(dp = parse_delegpt(ssl, args, root, 0)))
 			return;
 		if(!forwards_add_zone(fwd, LDNS_RR_CLASS_IN, dp)) {
 			(void)ssl_printf(ssl, "error out of memory\n");
@@ -2146,7 +2205,7 @@ parse_fs_args(RES* ssl, char* args, uint8_t** nm, struct delegpt** dp,

 	/* parse dp */
 	if(dp) {
-		if(!(*dp = parse_delegpt(ssl, args, *nm))) {
+		if(!(*dp = parse_delegpt(ssl, args, *nm, 1))) {
 			free(*nm);
 			return 0;
 		}
@@ -2862,8 +2921,6 @@ struct ratelimit_list_arg {
 	int all;
 	/** current time */
 	time_t now;
-	/** if backoff is enabled */
-	int backoff;
 };

 #define ip_ratelimit_list_arg ratelimit_list_arg
@@ -2877,7 +2934,7 @@ rate_list(struct lruhash_entry* e, void* arg)
 	struct rate_data* d = (struct rate_data*)e->data;
 	char buf[257];
 	int lim = infra_find_ratelimit(a->infra, k->name, k->namelen);
-	int max = infra_rate_max(d, a->now, a->backoff);
+	int max = infra_rate_max(d, a->now);
 	if(a->all == 0) {
 		if(max < lim)
 			return;
@@ -2895,7 +2952,7 @@ ip_rate_list(struct lruhash_entry* e, void* arg)
 	struct ip_rate_key* k = (struct ip_rate_key*)e->key;
 	struct ip_rate_data* d = (struct ip_rate_data*)e->data;
 	int lim = infra_ip_ratelimit;
-	int max = infra_rate_max(d, a->now, a->backoff);
+	int max = infra_rate_max(d, a->now);
 	if(a->all == 0) {
 		if(max < lim)
 			return;
@@ -2913,7 +2970,6 @@ do_ratelimit_list(RES* ssl, struct worker* worker, char* arg)
 	a.infra = worker->env.infra_cache;
 	a.now = *worker->env.now;
 	a.ssl = ssl;
-	a.backoff = worker->env.cfg->ratelimit_backoff;
 	arg = skipwhite(arg);
 	if(strcmp(arg, "+a") == 0)
 		a.all = 1;
@@ -2932,7 +2988,6 @@ do_ip_ratelimit_list(RES* ssl, struct worker* worker, char* arg)
 	a.infra = worker->env.infra_cache;
 	a.now = *worker->env.now;
 	a.ssl = ssl;
-	a.backoff = worker->env.cfg->ip_ratelimit_backoff;
 	arg = skipwhite(arg);
 	if(strcmp(arg, "+a") == 0)
 		a.all = 1;
@@ -2993,6 +3048,60 @@ do_rpz_disable(RES* ssl, struct worker* worker, char* arg)
    do_rpz_enable_disable(ssl, worker, arg, 0);
 }

+/** enable/disable EDE (RFC 8914) responses this zone */
+static void
+do_rpz_do_ede_enable_disable(RES* ssl, struct worker* worker, char* arg, int enable) {
+    size_t namelen;
+    int namelabels;
+    uint8_t *name = NULL;
+    struct auth_zones *az = worker->env.auth_zones;
+    struct auth_zone *z = NULL;
+    if (!parse_arg_name(ssl, arg, &name, &namelen, &namelabels))
+        return;
+
+    (void)ssl_printf(ssl, "NAME: %s", name);
+
+    if (az) {
+        lock_rw_rdlock(&az->lock);
+        z = auth_zone_find(az, name, namelen, LDNS_RR_CLASS_IN);
+        if (z) {
+            lock_rw_wrlock(&z->lock);
+        }
+        lock_rw_unlock(&az->lock);
+    }
+    free(name);
+    if (!z) {
+        (void) ssl_printf(ssl, "error no auth-zone %s\n", arg);
+        return;
+    }
+    if (!z->rpz) {
+        (void) ssl_printf(ssl, "error auth-zone %s not RPZ\n", arg);
+        lock_rw_unlock(&z->lock);
+        return;
+    }
+    if (enable) {
+        rpz_do_ede_enable(z->rpz);
+    } else {
+        rpz_do_ede_disable(z->rpz);
+    }
+    lock_rw_unlock(&z->lock);
+    send_ok(ssl);
+}
+
+/** do the rpz_enable command */
+static void
+do_rpz_do_ede_enable(RES* ssl, struct worker* worker, char* arg)
+{
+    do_rpz_enable_disable(ssl, worker, arg, 1);
+}
+
+/** do the rpz_disable command */
+static void
+do_rpz_do_ede_disable(RES* ssl, struct worker* worker, char* arg)
+{
+    do_rpz_do_ede_enable_disable(ssl, worker, arg, 0);
+}
+
 /** tell other processes to execute the command */
 static void
 distribute_cmd(struct daemon_remote* rc, RES* ssl, char* cmd)
@@ -3155,6 +3264,12 @@ execute_cmd(struct daemon_remote* rc, RES* ssl, char* cmd,
 		do_data_remove(ssl, worker->daemon->local_zones, skipwhite(p+17));
 	} else if(cmdcmp(p, "local_datas_remove", 18)) {
 		do_datas_remove(ssl, worker->daemon->local_zones);
+
+	} else if(cmdcmp(p, "local_zone_do_ede_enable", 24)) {
+		do_zone_enable_ede(ssl, worker->daemon->local_zones, skipwhite(p+24));
+	} else if(cmdcmp(p, "local_zone_do_ede_disable", 25)) {
+		do_zone_disable_ede(ssl, worker->daemon->local_zones, skipwhite(p+25));
+
 	} else if(cmdcmp(p, "local_data", 10)) {
 		do_data_add(ssl, worker->daemon->local_zones, skipwhite(p+10));
 	} else if(cmdcmp(p, "local_datas", 11)) {
@@ -3197,6 +3312,10 @@ execute_cmd(struct daemon_remote* rc, RES* ssl, char* cmd,
        do_rpz_enable(ssl, worker, skipwhite(p+10));
    } else if(cmdcmp(p, "rpz_disable", 11)) {
        do_rpz_disable(ssl, worker, skipwhite(p+11));
+    } else if(cmdcmp(p, "rpz_do_ede_enable", 17)) {
+        do_rpz_do_ede_enable(ssl, worker, skipwhite(p+17));
+    } else if(cmdcmp(p, "rpz_do_ede_disable", 18)) {
+        do_rpz_do_ede_disable(ssl, worker, skipwhite(p+18));
 	} else {
 		(void)ssl_printf(ssl, "error unknown command '%s'\n", p);
 	}
@@ -281,7 +281,6 @@ server_stats_compile(struct worker* worker, struct ub_stats_info* s, int reset)
 	/* values from outside network */
 	s->svr.unwanted_replies = (long long)worker->back->unwanted_replies;
 	s->svr.qtcp_outgoing = (long long)worker->back->num_tcp_outgoing;
-	s->svr.qudp_outgoing = (long long)worker->back->num_udp_outgoing;

 	/* get and reset validator rrset bogus number */
 	s->svr.rrset_bogus = (long long)get_rrset_bogus(worker, reset);
@@ -425,7 +424,6 @@ void server_stats_add(struct ub_stats_info* total, struct ub_stats_info* a)
 		total->svr.qclass_big += a->svr.qclass_big;
 		total->svr.qtcp += a->svr.qtcp;
 		total->svr.qtcp_outgoing += a->svr.qtcp_outgoing;
-		total->svr.qudp_outgoing += a->svr.qudp_outgoing;
 		total->svr.qtls += a->svr.qtls;
 		total->svr.qtls_resume += a->svr.qtls_resume;
 		total->svr.qhttps += a->svr.qhttps;
@@ -98,7 +98,7 @@
 /** ratelimit for error responses */
 #define ERROR_RATELIMIT 100 /* qps */

-/**
+/** 
 * seconds to add to prefetch leeway.  This is a TTL that expires old rrsets
 * earlier than they should in order to put the new update into the cache.
 * This additional value is to make sure that if not all TTLs are equal in
@@ -459,7 +459,7 @@ answer_norec_from_cache(struct worker* worker, struct query_info* qinfo,

 	dp = dns_cache_find_delegation(&worker->env, qinfo->qname, 
 		qinfo->qname_len, qinfo->qtype, qinfo->qclass,
-		worker->scratchpad, &msg, timenow, 0, NULL, 0);
+		worker->scratchpad, &msg, timenow);
 	if(!dp) { /* no delegation, need to reprime */
 		return 0;
 	}
@@ -484,12 +484,8 @@ answer_norec_from_cache(struct worker* worker, struct query_info* qinfo,
 				msg->rep, LDNS_RCODE_SERVFAIL, edns, repinfo, worker->scratchpad,
 				worker->env.now_tv))
 					return 0;
-			/* TODO store the reason for the bogus reply in cache
-			 * and implement in here instead of the hardcoded EDE */
-			if (worker->env.cfg->ede) {
-				EDNS_OPT_LIST_APPEND_EDE(&edns->opt_list_out,
-					worker->scratchpad, LDNS_EDE_DNSSEC_BOGUS, "");
-			}
+			EDNS_OPT_LIST_APPEND_EDE(&edns->opt_list_out,
+				worker->scratchpad, LDNS_EDE_DNSSEC_BOGUS, "");
 			error_encode(repinfo->c->buffer, LDNS_RCODE_SERVFAIL, 
 				&msg->qinfo, id, flags, edns);
 			if(worker->stats.extended) {
@@ -505,6 +501,9 @@ answer_norec_from_cache(struct worker* worker, struct query_info* qinfo,
 			secure = 1;
 			break;
 		case sec_status_indeterminate:
+			EDNS_OPT_LIST_APPEND_EDE(&edns->opt_list_out,
+				worker->scratchpad, LDNS_EDE_DNSSEC_INDETERMINATE, "");
+			/* fallthrough */
 		case sec_status_insecure:
 		default:
 			/* not secure */
@@ -559,7 +558,7 @@ apply_respip_action(struct worker* worker, const struct query_info* qinfo,
 		return 1;

 	if(!respip_rewrite_reply(qinfo, cinfo, rep, encode_repp, &actinfo,
-		alias_rrset, 0, worker->scratchpad, az, NULL))
+		alias_rrset, 0, worker->scratchpad, az))
 		return 0;

 	/* xxx_deny actions mean dropping the reply, unless the original reply
@@ -660,12 +659,8 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
 			LDNS_RCODE_SERVFAIL, edns, repinfo, worker->scratchpad,
 			worker->env.now_tv))
 			goto bail_out;
-		/* TODO store the reason for the bogus reply in cache
-		 * and implement in here instead of the hardcoded EDE */
-		if (worker->env.cfg->ede) {
-			EDNS_OPT_LIST_APPEND_EDE(&edns->opt_list_out,
-				worker->scratchpad, LDNS_EDE_DNSSEC_BOGUS, "");
-		}
+		EDNS_OPT_LIST_APPEND_EDE(&edns->opt_list_out,
+			worker->scratchpad, LDNS_EDE_DNSSEC_BOGUS, "");
 		error_encode(repinfo->c->buffer, LDNS_RCODE_SERVFAIL,
 			qinfo, id, flags, edns);
 		rrset_array_unlock_touch(worker->env.rrset_cache,
@@ -728,25 +723,15 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
 			if(!*partial_repp)
 				goto bail_out;
 		}
-	} else {
-		/* We don't check the global ede as this is a warning, not
-		 * an error */
-		if (*is_expired_answer == 1 &&
-			worker->env.cfg->ede_serve_expired && worker->env.cfg->ede) {
-			EDNS_OPT_LIST_APPEND_EDE(&edns->opt_list_out,
-				worker->scratchpad, LDNS_EDE_STALE_ANSWER, "");
-		}
-		if(!reply_info_answer_encode(qinfo, encode_rep, id, flags,
-			repinfo->c->buffer, timenow, 1, worker->scratchpad,
-			udpsize, edns, (int)(edns->bits & EDNS_DO),
-			*is_secure_answer)) {
-			if(!inplace_cb_reply_servfail_call(&worker->env, qinfo,
-				NULL, NULL, LDNS_RCODE_SERVFAIL, edns, repinfo,
-				worker->scratchpad, worker->env.now_tv))
-					edns->opt_list_inplace_cb_out = NULL;
-			error_encode(repinfo->c->buffer, LDNS_RCODE_SERVFAIL,
-				qinfo, id, flags, edns);
-		}
+	} else if(!reply_info_answer_encode(qinfo, encode_rep, id, flags,
+		repinfo->c->buffer, timenow, 1, worker->scratchpad,
+		udpsize, edns, (int)(edns->bits & EDNS_DO), *is_secure_answer)) {
+		if(!inplace_cb_reply_servfail_call(&worker->env, qinfo, NULL, NULL,
+			LDNS_RCODE_SERVFAIL, edns, repinfo, worker->scratchpad,
+			worker->env.now_tv))
+				edns->opt_list_inplace_cb_out = NULL;
+		error_encode(repinfo->c->buffer, LDNS_RCODE_SERVFAIL, 
+			qinfo, id, flags, edns);
 	}
 	/* cannot send the reply right now, because blocking network syscall
 	 * is bad while holding locks. */
@@ -763,12 +748,10 @@ bail_out:

 /** Reply to client and perform prefetch to keep cache up to date. */
 static void
-reply_and_prefetch(struct worker* worker, struct query_info* qinfo,
-	uint16_t flags, struct comm_reply* repinfo, time_t leeway, int noreply,
-	int rpz_passthru, struct edns_option* opt_list)
+reply_and_prefetch(struct worker* worker, struct query_info* qinfo, 
+	uint16_t flags, struct comm_reply* repinfo, time_t leeway, int noreply)
 {
-	(void)opt_list;
-	/* first send answer to client to keep its latency
+	/* first send answer to client to keep its latency 
 	 * as small as a cachereply */
 	if(!noreply) {
 		if(repinfo->c->tcp_req_info) {
@@ -779,23 +762,13 @@ reply_and_prefetch(struct worker* worker, struct query_info* qinfo,
 		comm_point_send_reply(repinfo);
 	}
 	server_stats_prefetch(&worker->stats, worker);
-#ifdef CLIENT_SUBNET
-	/* Check if the subnet module is enabled. In that case pass over the
-	 * comm_reply information for ECS generation later. The mesh states are
-	 * unique when subnet is enabled. */
-	if(modstack_find(&worker->env.mesh->mods, "subnetcache") != -1
-		&& worker->env.unique_mesh) {
-		mesh_new_prefetch(worker->env.mesh, qinfo, flags, leeway +
-			PREFETCH_EXPIRY_ADD, rpz_passthru, repinfo, opt_list);
-		return;
-	}
-#endif
+	
 	/* create the prefetch in the mesh as a normal lookup without
 	 * client addrs waiting, which has the cache blacklisted (to bypass
 	 * the cache and go to the network for the data). */
 	/* this (potentially) runs the mesh for the new query */
-	mesh_new_prefetch(worker->env.mesh, qinfo, flags, leeway +
-		PREFETCH_EXPIRY_ADD, rpz_passthru, NULL, NULL);
+	mesh_new_prefetch(worker->env.mesh, qinfo, flags, leeway + 
+		PREFETCH_EXPIRY_ADD);
 }

 /**
@@ -1046,15 +1019,9 @@ answer_notify(struct worker* w, struct query_info* qinfo,
 static int
 deny_refuse(struct comm_point* c, enum acl_access acl,
 	enum acl_access deny, enum acl_access refuse,
-	struct worker* worker, struct comm_reply* repinfo,
-	struct acl_addr* acladdr, int ede)
+	struct worker* worker, struct comm_reply* repinfo)
 {
 	if(acl == deny) {
-		if(verbosity >= VERB_ALGO) {
-			log_acl_action("dropped", &repinfo->addr,
-				repinfo->addrlen, acl, acladdr);
-			log_buf(VERB_ALGO, "dropped", c->buffer);
-		}
 		comm_point_drop_reply(repinfo);
 		if(worker->stats.extended)
 			worker->stats.unwanted_queries++;
@@ -1062,62 +1029,30 @@ deny_refuse(struct comm_point* c, enum acl_access acl,
 	} else if(acl == refuse) {
 		size_t opt_rr_mark;

-		if(verbosity >= VERB_ALGO) {
-			log_acl_action("refused", &repinfo->addr,
-				repinfo->addrlen, acl, acladdr);
-			log_buf(VERB_ALGO, "refuse", c->buffer);
-		}
-
+		log_addr(VERB_ALGO, "refused query from",
+			&repinfo->addr, repinfo->addrlen);
+		log_buf(VERB_ALGO, "refuse", c->buffer);
 		if(worker->stats.extended)
 			worker->stats.unwanted_queries++;
 		if(worker_check_request(c->buffer, worker) == -1) {
 			comm_point_drop_reply(repinfo);
 			return 0; /* discard this */
 		}
-		/* worker_check_request() above guarantees that the buffer contains at
-		 * least a header and that qdcount == 1
-		 */
-		log_assert(sldns_buffer_limit(c->buffer) >= LDNS_HEADER_SIZE
-			&& LDNS_QDCOUNT(sldns_buffer_begin(c->buffer)) == 1);
+		log_assert(LDNS_QDCOUNT(sldns_buffer_begin(c->buffer)) == 1);

 		sldns_buffer_skip(c->buffer, LDNS_HEADER_SIZE); /* skip header */

-		/* check additional section is present and that we respond with EDEs */
-		if(LDNS_ARCOUNT(sldns_buffer_begin(c->buffer)) != 1
-			|| !ede) {
-			LDNS_QDCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_QR_SET(sldns_buffer_begin(c->buffer));
-			LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
-				LDNS_RCODE_REFUSED);
-			sldns_buffer_flip(c->buffer);
-			return 1;
-		}
-
 		if (!query_dname_len(c->buffer)) {
-			LDNS_QDCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
 			LDNS_QR_SET(sldns_buffer_begin(c->buffer));
 			LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
 				LDNS_RCODE_FORMERR);
-			sldns_buffer_set_position(c->buffer, LDNS_HEADER_SIZE);
 			sldns_buffer_flip(c->buffer);
 			return 1;
 		}
-		/* space available for query type and class? */
 		if (sldns_buffer_remaining(c->buffer) < 2 * sizeof(uint16_t)) {
                        LDNS_QR_SET(sldns_buffer_begin(c->buffer));
                        LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
 				 LDNS_RCODE_FORMERR);
-			LDNS_QDCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			sldns_buffer_set_position(c->buffer, LDNS_HEADER_SIZE);
                        sldns_buffer_flip(c->buffer);
 			return 1;
 		}
@@ -1127,7 +1062,24 @@ deny_refuse(struct comm_point* c, enum acl_access acl,

 		sldns_buffer_skip(c->buffer, (ssize_t)sizeof(uint16_t)); /* skip qtype */

-		sldns_buffer_skip(c->buffer, (ssize_t)sizeof(uint16_t)); /* skip qclass */
+		/* check the qclass */
+		if (sldns_buffer_read_u16(c->buffer) != LDNS_RR_CLASS_IN) {
+			LDNS_QDCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			sldns_buffer_flip(c->buffer);
+			return 1;
+		}
+
+		/* check edns section is present */
+		if(LDNS_ARCOUNT(sldns_buffer_begin(c->buffer)) != 1) {
+			LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			sldns_buffer_flip(c->buffer);
+			return 1;
+		}

 		/* The OPT RR to be returned should come directly after
 		 * the query, so mark this spot.
@@ -1142,32 +1094,21 @@ deny_refuse(struct comm_point* c, enum acl_access acl,
 				((int)LDNS_NSCOUNT(sldns_buffer_begin(c->buffer))))) {
 				LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
 					LDNS_RCODE_FORMERR);
-				LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-				LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-				LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-				sldns_buffer_set_position(c->buffer, opt_rr_mark);
 				sldns_buffer_flip(c->buffer);
 				return 1;
 			}
 		}
-		/* Do we have a valid OPT RR here? If not return REFUSED (could be a valid TSIG or something so no FORMERR) */
+		/* Do we have a valid OPT RR here? If not return FORMERR */
 		/* domain name must be the root of length 1. */
-		if(sldns_buffer_remaining(c->buffer) < 1 || *sldns_buffer_current(c->buffer) != 0) {
-			LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			sldns_buffer_set_position(c->buffer, opt_rr_mark);
-			sldns_buffer_flip(c->buffer);
+		if(pkt_dname_len(c->buffer) != 1) {
+			LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
+				LDNS_RCODE_FORMERR);
 			return 1;
-		} else {
-			sldns_buffer_skip(c->buffer, 1); /* skip root label */
 		}
 		if(sldns_buffer_remaining(c->buffer) < 2 ||
 			sldns_buffer_read_u16(c->buffer) != LDNS_RR_TYPE_OPT) {
-			LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			sldns_buffer_set_position(c->buffer, opt_rr_mark);
+			LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
+				LDNS_RCODE_FORMERR);
 			sldns_buffer_flip(c->buffer);
 			return 1;
 		}
@@ -1176,7 +1117,6 @@ deny_refuse(struct comm_point* c, enum acl_access acl,
 		 */
 		LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
 		LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-		sldns_buffer_clear(c->buffer); /* reset write limit */
 		sldns_buffer_set_position(c->buffer, opt_rr_mark);

 		/* Check if OPT record can be written
@@ -1214,8 +1154,6 @@ deny_refuse(struct comm_point* c, enum acl_access acl,

 		sldns_buffer_flip(c->buffer);

-		verbose(VERB_ALGO, "attached EDE code: %d", LDNS_EDE_PROHIBITED);
-
 		return 1;

 	}
@@ -1225,20 +1163,16 @@ deny_refuse(struct comm_point* c, enum acl_access acl,

 static int
 deny_refuse_all(struct comm_point* c, enum acl_access acl,
-	struct worker* worker, struct comm_reply* repinfo,
-	struct acl_addr* acladdr, int ede)
+	struct worker* worker, struct comm_reply* repinfo)
 {
-	return deny_refuse(c, acl, acl_deny, acl_refuse, worker, repinfo,
-		acladdr, ede);
+	return deny_refuse(c, acl, acl_deny, acl_refuse, worker, repinfo);
 }

 static int
 deny_refuse_non_local(struct comm_point* c, enum acl_access acl,
-	struct worker* worker, struct comm_reply* repinfo,
-	struct acl_addr* acladdr, int ede)
+	struct worker* worker, struct comm_reply* repinfo)
 {
-	return deny_refuse(c, acl, acl_deny_non_local, acl_refuse_non_local,
-		worker, repinfo, acladdr, ede);
+	return deny_refuse(c, acl, acl_deny_non_local, acl_refuse_non_local, worker, repinfo);
 }

 int 
@@ -1251,14 +1185,12 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 	struct lruhash_entry* e;
 	struct query_info qinfo;
 	struct edns_data edns;
-	struct edns_option* original_edns_list = NULL;
 	enum acl_access acl;
 	struct acl_addr* acladdr;
 	int rc = 0;
 	int need_drop = 0;
 	int is_expired_answer = 0;
 	int is_secure_answer = 0;
-	int rpz_passthru = 0;
 	/* We might have to chase a CNAME chain internally, in which case
 	 * we'll have up to two replies and combine them to build a complete
 	 * answer.  These variables control this case. */
@@ -1331,9 +1263,7 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 	acladdr = acl_addr_lookup(worker->daemon->acl, &repinfo->addr, 
 		repinfo->addrlen);
 	acl = acl_get_control(acladdr);
-
-	if((ret=deny_refuse_all(c, acl, worker, repinfo, acladdr,
-		worker->env.cfg->ede)) != -1)
+	if((ret=deny_refuse_all(c, acl, worker, repinfo)) != -1)
 	{
 		if(ret == 1)
 			goto send_reply;
@@ -1355,8 +1285,7 @@ worker_handle_request(struct comm_point* c, void* arg, int error,

 	/* check if this query should be dropped based on source ip rate limiting */
 	if(!infra_ip_ratelimit_inc(worker->env.infra_cache, repinfo,
-			*worker->env.now,
-			worker->env.cfg->ip_ratelimit_backoff, c->buffer)) {
+			*worker->env.now, c->buffer)) {
 		/* See if we are passed through with slip factor */
 		if(worker->env.cfg->ip_ratelimit_factor != 0 &&
 			ub_random_max(worker->env.rnd,
@@ -1526,8 +1455,7 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 	if(worker->env.auth_zones &&
 		rpz_callback_from_worker_request(worker->env.auth_zones,
 		&worker->env, &qinfo, &edns, c->buffer, worker->scratchpad,
-		repinfo, acladdr->taglist, acladdr->taglen, &worker->stats,
-		&rpz_passthru)) {
+		repinfo, acladdr->taglist, acladdr->taglen, &worker->stats)) {
 		regional_free_all(worker->scratchpad);
 		if(sldns_buffer_limit(c->buffer) == 0) {
 			comm_point_drop_reply(repinfo);
@@ -1553,8 +1481,7 @@ worker_handle_request(struct comm_point* c, void* arg, int error,

 	/* We've looked in our local zones. If the answer isn't there, we
 	 * might need to bail out based on ACLs now. */
-	if((ret=deny_refuse_non_local(c, acl, worker, repinfo, acladdr,
-		worker->env.cfg->ede)) != -1)
+	if((ret=deny_refuse_non_local(c, acl, worker, repinfo)) != -1)
 	{
 		regional_free_all(worker->scratchpad);
 		if(ret == 1)
@@ -1573,10 +1500,8 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 	 * ACLs allow the snooping. */
 	if(!(LDNS_RD_WIRE(sldns_buffer_begin(c->buffer))) &&
 		acl != acl_allow_snoop ) {
-		if (worker->env.cfg->ede) {
-			EDNS_OPT_LIST_APPEND_EDE(&edns.opt_list_out,
-				worker->scratchpad, LDNS_EDE_NOT_AUTHORITATIVE, "");
-		}
+		EDNS_OPT_LIST_APPEND_EDE(&edns.opt_list_out,
+			worker->scratchpad, LDNS_EDE_NOT_AUTHORITATIVE, "");
 		error_encode(c->buffer, LDNS_RCODE_REFUSED, &qinfo,
 			*(uint16_t*)(void *)sldns_buffer_begin(c->buffer),
 			sldns_buffer_read_u16_at(c->buffer, 2), &edns);
@@ -1624,11 +1549,6 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		cinfo = &cinfo_tmp;
 	}

-	/* Keep the original edns list around. The pointer could change if there is
-	 * a cached answer (through the inplace callback function there).
-	 * No need to actually copy the contents as they shouldn't change.
-	 * Used while prefetching and subnet is enabled. */
-	original_edns_list = edns.opt_list_in;
 lookup_cache:
 	/* Lookup the cache.  In case we chase an intermediate CNAME chain
 	 * this is a two-pass operation, and lookup_qinfo is different for
@@ -1639,11 +1559,10 @@ lookup_cache:
 		is_secure_answer = 0;
 		h = query_info_hash(lookup_qinfo, sldns_buffer_read_u16_at(c->buffer, 2));
 		if((e=slabhash_lookup(worker->env.msg_cache, h, lookup_qinfo, 0))) {
-			struct reply_info* rep = (struct reply_info*)e->data;
 			/* answer from cache - we have acquired a readlock on it */
-			if(answer_from_cache(worker, &qinfo, cinfo, &need_drop,
-				&is_expired_answer, &is_secure_answer,
-				&alias_rrset, &partial_rep, rep,
+			if(answer_from_cache(worker, &qinfo,
+				cinfo, &need_drop, &is_expired_answer, &is_secure_answer,
+				&alias_rrset, &partial_rep, (struct reply_info*)e->data,
 				*(uint16_t*)(void *)sldns_buffer_begin(c->buffer),
 				sldns_buffer_read_u16_at(c->buffer, 2), repinfo,
 				&edns)) {
@@ -1651,22 +1570,34 @@ lookup_cache:
 				 * Note that if there is more than one pass
 				 * its qname must be that used for cache
 				 * lookup. */
-				if((worker->env.cfg->prefetch &&
-					*worker->env.now >= rep->prefetch_ttl) ||
-					(worker->env.cfg->serve_expired &&
-					*worker->env.now > rep->ttl)) {
+				if((worker->env.cfg->prefetch && *worker->env.now >=
+							((struct reply_info*)e->data)->prefetch_ttl) ||
+						(worker->env.cfg->serve_expired &&
+						*worker->env.now >= ((struct reply_info*)e->data)->ttl)) {

-					time_t leeway = rep->ttl - *worker->env.now;
-					if(rep->ttl < *worker->env.now)
+					time_t leeway = ((struct reply_info*)e->
+						data)->ttl - *worker->env.now;
+					if(((struct reply_info*)e->data)->ttl
+						< *worker->env.now)
 						leeway = 0;
 					lock_rw_unlock(&e->lock);

+					// @TODO test this
+					// // stale answer? 
+					// if (worker->env.cfg->serve_expired &&
+					// 	*worker->env.now >= ((struct reply_info*)e->data)->ttl) {
+					// 	EDNS_OPT_LIST_APPEND_EDE(&edns.opt_list_out,
+					// 		worker->scratchpad, LDNS_EDE_STALE_ANSWER, "");
+					// }
+
+					// add EDNS struct?
 					reply_and_prefetch(worker, lookup_qinfo,
 						sldns_buffer_read_u16_at(c->buffer, 2),
 						repinfo, leeway,
-						(partial_rep || need_drop),
-						rpz_passthru,
-						original_edns_list);
+						(partial_rep || need_drop));
+
+
+
 					if(!partial_rep) {
 						rc = 0;
 						regional_free_all(worker->scratchpad);
@@ -1704,6 +1635,8 @@ lookup_cache:
 			lock_rw_unlock(&e->lock);
 		}

+		// @TODO Extended DNS Error Code 13 - Cached Error? place not clear
+
 		if(!LDNS_RD_WIRE(sldns_buffer_begin(c->buffer))) {
 			if(answer_norec_from_cache(worker, &qinfo,
 				*(uint16_t*)(void *)sldns_buffer_begin(c->buffer), 
@@ -1730,8 +1663,7 @@ lookup_cache:
 	/* grab a work request structure for this new request */
 	mesh_new_client(worker->env.mesh, &qinfo, cinfo,
 		sldns_buffer_read_u16_at(c->buffer, 2),
-		&edns, repinfo, *(uint16_t*)(void *)sldns_buffer_begin(c->buffer),
-		rpz_passthru);
+		&edns, repinfo, *(uint16_t*)(void *)sldns_buffer_begin(c->buffer));
 	regional_free_all(worker->scratchpad);
 	worker_mem_report(worker, NULL);
 	return 0;
@@ -1795,9 +1727,6 @@ worker_sighandler(int sig, void* arg)
 		case SIGHUP:
 			comm_base_exit(worker->base);
 			break;
-#endif
-#ifdef SIGBREAK
-		case SIGBREAK:
 #endif
 		case SIGINT:
 			worker->need_to_exit = 1;
@@ -1916,9 +1845,6 @@ worker_init(struct worker* worker, struct config_file *cfg,
 	if(do_sigs) {
 #ifdef SIGHUP
 		ub_thread_sig_unblock(SIGHUP);
-#endif
-#ifdef SIGBREAK
-		ub_thread_sig_unblock(SIGBREAK);
 #endif
 		ub_thread_sig_unblock(SIGINT);
 #ifdef SIGQUIT
@@ -1936,9 +1862,6 @@ worker_init(struct worker* worker, struct config_file *cfg,
 			|| !comm_signal_bind(worker->comsig, SIGQUIT)
 #endif
 			|| !comm_signal_bind(worker->comsig, SIGTERM)
-#ifdef SIGBREAK
-			|| !comm_signal_bind(worker->comsig, SIGBREAK)
-#endif
 			|| !comm_signal_bind(worker->comsig, SIGINT)) {
 			log_err("could not create signal handlers");
 			worker_delete(worker);
@@ -2181,10 +2104,9 @@ worker_delete(struct worker* worker)

 struct outbound_entry*
 worker_send_query(struct query_info* qinfo, uint16_t flags, int dnssec,
-	int want_dnssec, int nocaps, int check_ratelimit,
-	struct sockaddr_storage* addr, socklen_t addrlen, uint8_t* zone,
-	size_t zonelen, int tcp_upstream, int ssl_upstream, char* tls_auth_name,
-	struct module_qstate* q, int* was_ratelimited)
+	int want_dnssec, int nocaps, struct sockaddr_storage* addr,
+	socklen_t addrlen, uint8_t* zone, size_t zonelen, int tcp_upstream,
+	int ssl_upstream, char* tls_auth_name, struct module_qstate* q)
 {
 	struct worker* worker = q->env->worker;
 	struct outbound_entry* e = (struct outbound_entry*)regional_alloc(
@@ -2193,10 +2115,9 @@ worker_send_query(struct query_info* qinfo, uint16_t flags, int dnssec,
 		return NULL;
 	e->qstate = q;
 	e->qsent = outnet_serviced_query(worker->back, qinfo, flags, dnssec,
-		want_dnssec, nocaps, check_ratelimit, tcp_upstream,
+		want_dnssec, nocaps, tcp_upstream,
 		ssl_upstream, tls_auth_name, addr, addrlen, zone, zonelen, q,
-		worker_handle_service_reply, e, worker->back->udp_buff, q->env,
-		was_ratelimited);
+		worker_handle_service_reply, e, worker->back->udp_buff, q->env);
 	if(!e->qsent) {
 		return NULL;
 	}
@@ -2217,7 +2138,6 @@ void worker_stats_clear(struct worker* worker)
 	mesh_stats_clear(worker->env.mesh);
 	worker->back->unwanted_replies = 0;
 	worker->back->num_tcp_outgoing = 0;
-	worker->back->num_udp_outgoing = 0;
 }

 void worker_start_accept(void* arg)
@@ -2241,11 +2161,10 @@ struct outbound_entry* libworker_send_query(
 	struct query_info* ATTR_UNUSED(qinfo),
 	uint16_t ATTR_UNUSED(flags), int ATTR_UNUSED(dnssec),
 	int ATTR_UNUSED(want_dnssec), int ATTR_UNUSED(nocaps),
-	int ATTR_UNUSED(check_ratelimit),
 	struct sockaddr_storage* ATTR_UNUSED(addr), socklen_t ATTR_UNUSED(addrlen),
 	uint8_t* ATTR_UNUSED(zone), size_t ATTR_UNUSED(zonelen), int ATTR_UNUSED(tcp_upstream),
 	int ATTR_UNUSED(ssl_upstream), char* ATTR_UNUSED(tls_auth_name),
-	struct module_qstate* ATTR_UNUSED(q), int* ATTR_UNUSED(was_ratelimited))
+	struct module_qstate* ATTR_UNUSED(q))
 {
 	log_assert(0);
 	return 0;
@@ -652,7 +652,7 @@ handle_event_moddone(struct module_qstate* qstate, int id)
 	if ( (!iq || !iq->started_no_cache_store) &&
 		qstate->return_msg && qstate->return_msg->rep &&
 		!dns_cache_store(qstate->env, &qstate->qinfo, qstate->return_msg->rep,
-		0, 0, 0, NULL, qstate->query_flags, qstate->qstarttime))
+		0, 0, 0, NULL, qstate->query_flags))
 		log_err("out of memory");

 	/* do nothing */
@@ -991,7 +991,7 @@ dns64_inform_super(struct module_qstate* qstate, int id,
 	/* Store the generated response in cache. */
 	if ( (!super_dq || !super_dq->started_no_cache_store) &&
 		!dns_cache_store(super->env, &super->qinfo, super->return_msg->rep,
-		0, 0, 0, NULL, super->query_flags, qstate->qstarttime))
+		0, 0, 0, NULL, super->query_flags))
 		log_err("out of memory");
 }

@@ -188,9 +188,9 @@ mq_wakeup_cb(void* arg)

 /** start timer to wakeup dtio because there is content in the queue */
 static void
-dt_msg_queue_start_timer(struct dt_msg_queue* mq, int wakeupnow)
+dt_msg_queue_start_timer(struct dt_msg_queue* mq)
 {
-	struct timeval tv = {0};
+	struct timeval tv;
 	/* Start a timer to process messages to be logged.
 	 * If we woke up the dtio thread for every message, the wakeup
 	 * messages take up too much processing power.  If the queue
@@ -204,26 +204,19 @@ dt_msg_queue_start_timer(struct dt_msg_queue* mq, int wakeupnow)

 	/* do not start the timer if a timer already exists, perhaps
 	 * in another worker.  So this variable is protected by a lock in
-	 * dtio. */
-
-	/* If we need to wakeupnow, 0 the timer to force the callback. */
+	 * dtio */
 	lock_basic_lock(&mq->dtio->wakeup_timer_lock);
 	if(mq->dtio->wakeup_timer_enabled) {
-		if(wakeupnow) {
-			comm_timer_set(mq->wakeup_timer, &tv);
-		}
 		lock_basic_unlock(&mq->dtio->wakeup_timer_lock);
 		return;
 	}
 	mq->dtio->wakeup_timer_enabled = 1; /* we are going to start one */
+	lock_basic_unlock(&mq->dtio->wakeup_timer_lock);

 	/* start the timer, in mq, in the event base of our worker */
-	if(!wakeupnow) {
-		tv.tv_sec = 1;
-		tv.tv_usec = 0;
-	}
+	tv.tv_sec = 1;
+	tv.tv_usec = 0;
 	comm_timer_set(mq->wakeup_timer, &tv);
-	lock_basic_unlock(&mq->dtio->wakeup_timer_lock);
 }

 void
@@ -290,8 +283,10 @@ dt_msg_queue_submit(struct dt_msg_queue* mq, void* buf, size_t len)
 	/* release lock */
 	lock_basic_unlock(&mq->lock);

-	if(wakeupnow || wakeupstarttimer) {
-		dt_msg_queue_start_timer(mq, wakeupnow);
+	if(wakeupnow) {
+		dtio_wakeup(mq->dtio);
+	} else if(wakeupstarttimer) {
+		dt_msg_queue_start_timer(mq);
 	}
 }

@@ -1413,12 +1413,11 @@ void worker_sighandler(int ATTR_UNUSED(sig), void* ATTR_UNUSED(arg))
 struct outbound_entry* worker_send_query(
 	struct query_info* ATTR_UNUSED(qinfo), uint16_t ATTR_UNUSED(flags),
 	int ATTR_UNUSED(dnssec), int ATTR_UNUSED(want_dnssec),
-	int ATTR_UNUSED(nocaps), int ATTR_UNUSED(check_ratelimit),
-	struct sockaddr_storage* ATTR_UNUSED(addr),
+	int ATTR_UNUSED(nocaps), struct sockaddr_storage* ATTR_UNUSED(addr),
 	socklen_t ATTR_UNUSED(addrlen), uint8_t* ATTR_UNUSED(zone),
 	size_t ATTR_UNUSED(zonelen), int ATTR_UNUSED(tcp_upstream),
 	int ATTR_UNUSED(ssl_upstream), char* ATTR_UNUSED(tls_auth_name),
-	struct module_qstate* ATTR_UNUSED(q), int* ATTR_UNUSED(was_ratelimited))
+	struct module_qstate* ATTR_UNUSED(q))
 {
 	log_assert(0);
 	return 0;
@@ -1447,12 +1446,11 @@ worker_alloc_cleanup(void* ATTR_UNUSED(arg))
 struct outbound_entry* libworker_send_query(
 	struct query_info* ATTR_UNUSED(qinfo), uint16_t ATTR_UNUSED(flags),
 	int ATTR_UNUSED(dnssec), int ATTR_UNUSED(want_dnssec),
-	int ATTR_UNUSED(nocaps), int ATTR_UNUSED(check_ratelimit),
-	struct sockaddr_storage* ATTR_UNUSED(addr),
+	int ATTR_UNUSED(nocaps), struct sockaddr_storage* ATTR_UNUSED(addr),
 	socklen_t ATTR_UNUSED(addrlen), uint8_t* ATTR_UNUSED(zone),
 	size_t ATTR_UNUSED(zonelen), int ATTR_UNUSED(tcp_upstream),
 	int ATTR_UNUSED(ssl_upstream), char* ATTR_UNUSED(tls_auth_name),
-	struct module_qstate* ATTR_UNUSED(q), int* ATTR_UNUSED(was_ratelimited))
+	struct module_qstate* ATTR_UNUSED(q))
 {
 	log_assert(0);
 	return 0;
@@ -1,322 +1,3 @@
-1 August 2022: Wouter
-	- Fix the novel ghost domain issues CVE-2022-30698 and CVE-2022-30699.
-	- Tests for ghost domain fixes.
-
-19 July 2022: George
-	- Update documentation for 'outbound-msg-retry:'.
-
-19 July 2022: Wouter
-	- Merge #718: Introduce infra-cache-max-rtt option to config max
-	  retransmit timeout.
-
-15 July 2022: Wouter
-	- Merge PR 714: Avoid treat normal hosts as unresponsive servers.
-	  And fixup the lock code.
-	- iana portlist update.
-
-12 July 2022: George
-	- For windows crosscompile, fix setting the IPV6_MTU socket option
-	  equivalent (IPV6_USER_MTU); allows cross compiling with latest
-	  cross-compiler versions.
-
-12 July 2022: Wouter
-	- Fix dname count in sldns parse type descriptor for SVCB and HTTPS.
-
-11 July 2022: Wouter
-	- Fix verbose EDE error printout.
-
-4 July 2022: George
-	- Fix bug introduced in 'improve val_sigcrypt.c::algo_needs_missing for
-	  one loop pass'.
-	- Merge PR #668 from Cristian Rodríguez: Set IP_BIND_ADDRESS_NO_PORT on
-	  outbound tcp sockets.
-
-4 July 2022: Wouter
-	- Tag for 1.16.1rc1 release. This became 1.16.1 on 11 July 2022.
-	  The code repo continues with version 1.16.2 under development.
-
-3 July 2022: George
-	- Merge PR #671 from Petr Menšík: Disable ED25519 and ED448 in FIPS
-	  mode on openssl3.
-	- Merge PR #660 from Petr Menšík: Sha1 runtime insecure.
-	- For #660: formatting, less verbose logging, add EDE information.
-	- Fix for correct openssl error when adding windows CA certificates to
-	  the openssl trust store.
-	- Improve val_sigcrypt.c::algo_needs_missing for one loop pass.
-	- Reintroduce documentation and more EDE support for
-	  val_sigcrypt.c::dnskeyset_verify_rrset_sig.
-
-1 July 2022: George
-	- Merge PR #706: NXNS fallback.
-	- From #706: Cached NXDOMAIN does not increase the target nx
-	  responses.
-	- From #706: Don't generate parent side queries if we already
-	  have the lame records in cache.
-	- From #706: When a lame address is the best choice, don't try to
-	  generate target queries when the missing targets are all lame.
-
-29 June 2022: Wouter
-	- iana portlist update.
-	- Fix detection of libz on windows compile with static option.
-	- Fix compile warning for windows compile.
-
-29 June 2022: George
-	- Add debug option to the mini_tdir.sh test code.
-	- Fix #704: [FR] Statistics counter for number of outgoing UDP queries
-	  sent; introduces 'num.query.udpout' to the 'unbound-control stats'
-	  command.
-	- Fix to not count cached NXDOMAIN for MAX_TARGET_NX.
-	- Allow fallback to the parent side when MAX_TARGET_NX is reached.
-	  This will also allow MAX_TARGET_NX more NXDOMAINs.
-
-28 June 2022: George
-	- Show the output of the exact .rpl run that failed with 'make test'.
-	- Fix for cached 0 TTL records to not trigger prefetching when
-	  serve-expired-client-timeout is set.
-
-28 June 2022: Wouter
-	- Fix test program dohclient close to use portability routine.
-
-23 June 2022: Tom
-	- Clarify -v flag manpage entry (#705)
-
-22 June 2022: Philip
-	- Fix #663: use after free issue with edns options.
-
-21 June 2022: Philip
-	- Fix for loading locally stored zones that have lines with blanks or
-	  blanks and comments.
-
-20 June 2022: George
-	- Remove unused LDNS function check for GOST Engine unloading.
-
-14 June 2022: George
-	- Merge PR #688: Rpz url notify issue.
-	- Note in the unbound.conf text that NOTIFY is allowed from the url:
-	  addresses for auth and rpz zones.
-
-3 June 2022: George
-	- Fix for edns client subnet to respect not looking in its cache when
-	  instructed to do so (e.g., prefetch).
-
-3 June 2022: Wouter
-	- makedist.sh picks up 32bit libssp-0.dll when 32bit compile.
-
-27 May 2022: Wouter
-	- Fix #684: [FTBS] configure script error with libmnl on openSUSE 15.3 (and possibly other distributions)
-	- Version is set to 1.16.0 for release. Release tag 1.16.0rc1. This
-	  became release 1.16.0 on 2 June 2022. The source code branch
-	  continues with version 1.16.1 under development.
-
-20 May 2022: Wouter
-	- Fix to silence test for ede error output to the console from the
-	  test setup script.
-	- Fix ede test to not use default pidfile, and use local interface.
-	- Fix some lint type warnings.
-
-18 May 2022: George
-	- Fix typos in config_set_option for the 'num-threads' and
-	  'ede-serve-expired' options.
-
-15 May 2022: George
-	- Fix #678: [FR] modify behaviour of unbound-control rpz_enable zone,
-	  by updating unbound-control's documentation.
-
-12 May 2022: George
-	- Fix #417: prefetch and ECS causing cache corruption when used
-	  together.
-
-12 May 2022: Wouter
-	- Merge #677: Allow using system certificates not only on Windows,
-	  from pemensik.
-	- For #677: Added tls-system-cert to config parser and documentation.
-
-11 May 2022: Wouter
-	- Fix #673: DNS over TLS: error: SSL_handshake syscall: No route to
-	  host.
-
-10 May 2022: George
-	- Fix Python build in non-source directory; based on patch by
-	  Michael Tokarev.
-
-6 May 2022: Tom
-	- Merge PR #604: Add basic support for EDE (RFC8914).
-
-28 April 2022: Wouter
-	- Fix #670: SERVFAIL problems with unbound 1.15.0 running on
-	  OpenBSD 7.1.
-
-8 April 2022: Wouter
-	- Fix zonemd check to allow unsupported algorithms to load.
-	  If there are only unsupported algorithms, or unsupported schemes,
-	  and no failed or successful other ZONEMD records, or malformed
-	  or bad ZONEMD records, the unsupported records allow the zone load.
-	- Fix zonemd unsupported algo check.
-	- Fix zonemd unsupported algo check reason to not copy to next record,
-	  and check for success for debug printout.
-	- Fix zonemd unsupported algo check to print unsupported reason before
-	  zeroing it.
-	- Fix zonemd unsupported algo check to set reason to NULL before the
-	  check routine, but after malformed checks, to get the correct NULL
-	  output when the digest matches.
-
-25 March 2022: Wouter
-	- Fix spelling error in comment in sldns_str2wire_svcparam_key_lookup.
-
-23 March 2022: Wouter
-	- Fix #651: [FR] Better logging for refused queries.
-
-18 March 2022: George
-	- Merge PR #648 from eaglegai: fix -q doesn't work when use with
-	  'unbound-control stats_shm'.
-
-17 March 2022: Wouter
-	- Fix to describe auth-zone and other configuration at the local-zone
-	  configuration option, to allow for more broadly view of the options.
-
-16 March 2022: Wouter
-	- Fix to ensure uniform handling of spaces and tabs when parsing RRs.
-
-9 March 2022: Wouter
-	- Merge #644: Make `install-lib` make target install the pkg-config
-	  file.
-
-7 March 2022: Wouter
-	- Fix configure for python to use sysutils, because distutils is
-	  deprecated. It uses sysutils when available, distutils otherwise.
-
-3 March 2022: Wouter
-	- Fix #637: Integer Overflow in sldns_str2period function.
-	- Fix for #637: fix integer overflow checks in sldns_str2period.
-
-2 March 2022: George
-	- Merge PR #632 from scottrw93: Match cnames in ipset.
-	- Various fixes for #632: variable initialisation, convert the qinfo
-	  to str once, accept trailing dot in the local-zone ipset option.
-
-2 March 2022: Wouter
-	- Fix compile warnings for printf ll format on mingw compile.
-
-1 March 2022: Wouter
-	- Fix pythonmod for change in iter_dp_is_useless function prototype.
-
-28 February 2022: George
-	- Fix #630: Unify the RPZ log messages.
-	- Merge #623 from rex4539: Fix typos.
-
-28 February 2022: Wouter
-	- Fix #633: Document unix domain socket support for unbound-control.
-	- Fix for #633: updated fix with new text.
-	- Fix edns client subnet to add the option based on the option list,
-	  so that it is not state dependent, after the state fix of #605 for
-	  double EDNS options.
-	- Fix for edns client subnet option add fix in removal code, from review.
-
-25 February 2022: Wouter
-	- Fix to detect that no IPv6 support means that IPv6 addresses are
-	  useless for delegation point lookups.
-	- update Makefile dependencies.
-	- Fix check interface existence for support detection in remote lookup.
-
-18 February 2022: Wouter
-	- Fix that address not available is squelched from the logs for
-	  udp connect failures. It is visible on verbosity 4 and more.
-	- Merge #631 from mollyim: Replace OpenSSL's ERR_PACK with
-	  ERR_GET_REASON.
-
-16 February 2022: Wouter
-	- Fix for #628: fix rpz-passthru for qname trigger by localzone type.
-
-15 February 2022: Wouter
-	- Fix #628: A rpz-passthru action is not ending RPZ zone processing.
-
-11 February 2022: Wouter
-	- Fix #624: Unable to stop Unbound in Windows console (does not
-	  respond to CTRL+C command).
-	- Fix #618: enabling interface-automatic disables DNS-over-TLS.
-	  Adds the option to list interface-automatic-ports.
-	- Remove debug info from #618 fix.
-
-7 February 2022: Wouter
-	- Fix that TCP interface does not use TLS when TLS is also configured.
-
-4 February 2022: Wouter
-	- Fix #412: cache invalidation issue with CNAME+A.
-
-3 February 2022: Wouter
-	- Fix for #611: Integer overflow in sldns_wire2str_pkt_scan.
-	- Tag for 1.15.0rc1 created. That became 1.15.0 on 10 feb 2022.
-	  The repository continues with version 1.15.1.
-
-2 February 2022: George
-	- Merge PR #532 from Shchelk: Fix: buffer overflow bug.
-	- Merge PR #616: Update ratelimit logic. It also introduces
-	  ratelimit-backoff and ip-ratelimit-backoff configuration options.
-	- Change aggressive-nsec default to yes.
-	- Merge PR #617: Update stub/forward-host notation to accept port and
-	  tls-auth-name.
-	- Update stream_ssl.tdir test to also use the new forward-host
-	  notation.
-
-2 February 2022: Wouter
-	- Update version number in repo to 1.15.0 for upcoming release,
-	  since it changes the aggressive-nsec default and the ratelimit change.
-	- Fix header comment for doxygen for authextstrtoaddr.
-	- please clang analyzer for loop in test code.
-	- Fix docker splint test to use more portable uname.
-	- Update contrib/aaaa-filter-iterator.patch with diff for current
-	  software version.
-
-1 February 2022: George
-	- Merge PR #603 from fobser: Use OpenSSL 1.1 API to access DSA and RSA
-	  internals.
-
-31 January 2022: George
-	- Fix review comment for use-after-free when failing to send UDP out.
-
-31 January 2022: Wouter
-	- iana portlist update.
-
-29 January 2022: George
-	- Fix tls-* and ssl-* documented alternate syntax to also be available
-	  through remote-control and unbound-checkconf.
-	- Better cleanup on failed DoT/DoH listening socket creation.
-
-26 January 2022: George
-	- Fix #599: [FR] RFC 9156 (obsoletes RFC 7816), by noting the new RFC
-	  document.
-
-26 January 2022: Wouter
-	- Test for NSID in SERVFAIL response due to DNSSEC bogus.
-
-25 January 2022: George
-	- Fix #588: Unbound 1.13.2 crashes due to p->pc is NULL in
-	  serviced_udp_callback.
-	- Merge PR #612: TCP race condition.
-
-25 January 2022: Wouter
-	- Fix #610: Undefine-shift in sldns_str2wire_hip_buf.
-
-19 January 2022: George
-	- For dnstap, do not wakeupnow right there. Instead zero the timer to
-	  force the wakeup callback asap.
-
-14 January 2022: George
-	- Merge PR #605:
-	  - Fix EDNS to upstream where the same option could be attached
-	     more than once.
-	  - Add a region to serviced_query for allocations.
-
-14 January 2022: Wouter
-	- Add rpz: for-downstream: yesno option, where the RPZ zone is
-	  authoritatively answered for, so the RPZ zone contents can be
-	  checked with DNS queries directed at the RPZ zone.
-	- For #602: Allow the module-config "subnetcache validator cachedb
-	  iterator".
-
-11 January 2022: George
-	- Fix prematurely terminated TCP queries when a reply has the same ID.
-
 7 January 2022: Wouter
 	- Merge #600 from pemensik: Change file mode before changing file
 	  owner.
@@ -55,10 +55,6 @@ server:
 	# Socket options are not supported on all platforms. experimental.
 	# interface-automatic: no

-	# instead of the default port, open additional ports separated by
-	# spaces when interface-automatic is enabled, by listing them here.
-	# interface-automatic-ports: ""
-
 	# port to answer queries from
 	# port: 53

@@ -168,8 +164,7 @@ server:
 	# perform connect for UDP sockets to mitigate ICMP side channel.
 	# udp-connect: yes

-	# The number of retries, per upstream nameserver in a delegation, when
-	# a throwaway response (also timeouts) is received.
+	# The number of retries when a non-positive response is received.
 	# outbound-msg-retry: 5

 	# msec for waiting for an unknown server to reply.  Increase if you
@@ -203,9 +198,6 @@ server:
 	# minimum wait time for responses, increase if uplink is long. In msec.
 	# infra-cache-min-rtt: 50

-	# maximum wait time for responses. In msec.
-	# infra-cache-max-rtt: 120000
-
 	# enable to make server probe down hosts more frequently.
 	# infra-keep-probing: no

@@ -450,7 +442,7 @@ server:

 	# Aggressive NSEC uses the DNSSEC NSEC chain to synthesize NXDOMAIN
 	# and other denials, using information from previous NXDOMAINs answers.
-	# aggressive-nsec: yes
+	# aggressive-nsec: no

 	# Use 0x20-encoded random bits in the query to foil spoof attempts.
 	# This feature is an experimental implementation of draft dns-0x20.
@@ -819,8 +811,6 @@ server:

 	# Add system certs to the cert bundle, from the Windows Cert Store
 	# tls-win-cert: no
-	# and on other systems, the default openssl certificates
-	# tls-system-cert: no

 	# Pad queries over TLS upstreams
 	# pad-queries: yes
@@ -870,10 +860,6 @@ server:
 	# 0 blocks when ratelimited, otherwise let 1/xth traffic through
 	# ratelimit-factor: 10

-	# Aggressive rate limit when the limit is reached and until demand has
-	# decreased in a 2 second rate window.
-	# ratelimit-backoff: no
-
 	# override the ratelimit for a specific domain name.
 	# give this setting multiple times to have multiple overrides.
 	# ratelimit-for-domain: example.com 1000
@@ -894,10 +880,6 @@ server:
 	# 0 blocks when ip is ratelimited, otherwise let 1/xth traffic through
 	# ip-ratelimit-factor: 10

-	# Aggressive rate limit when the limit is reached and until demand has
-	# decreased in a 2 second rate window.
-	# ip-ratelimit-backoff: no
-
 	# Limit the number of connections simultaneous from a netblock
 	# tcp-connection-limit: 192.0.2.0/24 12

@@ -907,14 +889,6 @@ server:
 	# the number of servers that will be used in the fast server selection.
 	# fast-server-num: 3

-	# Enable to attach Extended DNS Error codes (RFC8914) to responses.
-	# ede: no
-
-	# Enable to attach an Extended DNS Error (RFC8914) Code 3 - Stale
-	# Answer as EDNS0 option to expired responses.
-	# Note that the ede option above needs to be enabled for this to work.
-	# ede-serve-expired: no
-
 	# Specific options for ipsecmod. Unbound needs to be configured with
 	# --enable-ipsecmod for these to take effect.
 	#
@@ -1049,8 +1023,8 @@ remote-control:
 # has a copy of the root for local usage.  The second serves example.org
 # authoritatively.  zonefile: reads from file (and writes to it if you also
 # download it), primary: fetches with AXFR and IXFR, or url to zonefile.
-# With allow-notify: you can give additional (apart from primaries and urls)
-# sources of notifies.
+# With allow-notify: you can give additional (apart from primaries) sources of
+# notifies.
 # auth-zone:
 #	name: "."
 #	primary: 199.9.14.201         # b.root-servers.net
@@ -1206,5 +1180,4 @@ remote-control:
 #     rpz-log: yes
 #     rpz-log-name: "example policy"
 #     rpz-signal-nxdomain-ra: no
-#     for-downstream: no
 #     tags: "example"
@@ -289,22 +289,20 @@ just the ratelimited ips, with their estimated qps.  The ratelimited
 ips are dropped before checking the cache.
 .TP
 .B list_auth_zones
-List the auth zones that are configured.  Printed one per line with a status,
-indicating if the zone is expired and current serial number.  Configured RPZ
-zones are included.
+List the auth zones that are configured.  Printed one per line with a
+status, indicating if the zone is expired and current serial number.
 .TP
 .B auth_zone_reload \fIzone\fR
-Reload the auth zone (or RPZ zone) from zonefile.  The zonefile is read in
-overwriting the current contents of the zone in memory.  This changes the auth
-zone contents itself, not the cache contents.  Such cache contents exists if
-you set Unbound to validate with for-upstream yes and that can be cleared with
-\fBflush_zone\fR \fIzone\fR.
+Reload the auth zone from zonefile.  The zonefile is read in overwriting
+the current contents of the zone in memory.  This changes the auth zone
+contents itself, not the cache contents.  Such cache contents exists if
+you set Unbound to validate with for-upstream yes and that can be cleared
+with \fBflush_zone\fR \fIzone\fR.
 .TP
 .B auth_zone_transfer \fIzone\fR
-Transfer the auth zone (or RPZ zone) from master.  The auth zone probe sequence
-is started, where the masters are probed to see if they have an updated zone
-(with the SOA serial check).  And then the zone is transferred for a newer zone
-version.
+Transfer the auth zone from master.  The auth zone probe sequence is started,
+where the masters are probed to see if they have an updated zone (with the SOA
+serial check).  And then the zone is transferred for a newer zone version.
 .TP
 .B rpz_enable \fIzone\fR
 Enable the RPZ zone if it had previously been disabled.
@@ -552,10 +550,6 @@ Number of queries that were made using TCP towards the Unbound server.
 Number of queries that the Unbound server made using TCP outgoing towards
 other servers.
 .TP
-.I num.query.udpout
-Number of queries that the Unbound server made using UDP outgoing towards
-other servers.
-.TP
 .I num.query.tls
 Number of queries that were made using TLS towards the Unbound server.
 These are also counted in num.query.tcp, because TLS uses TCP.
@@ -75,7 +75,7 @@ concurrently.
 .TP
 .B \-v
 Increase verbosity. If given multiple times, more information is logged.
-This is added to the verbosity (if any) from the config file.
+This is in addition to the verbosity (if any) from the config file.
 .TP
 .B \-V
 Show the version number and build options, and exit.
@@ -30,7 +30,7 @@ can be used to check unbound.conf prior to usage.
 An example config file is shown below. Copy this to /etc/unbound/unbound.conf
 and start the server with:
 .P
-.nf
+.nfvalidator:val_inform_super
 	$ unbound \-c /etc/unbound/unbound.conf
 .fi
 .P
@@ -140,15 +140,6 @@ ip\-transparent you can select which (future) interfaces Unbound provides
 service on.  This feature is experimental, and needs support in your OS for
 particular socket options.  Default value is no.
 .TP
-.B interface\-automatic\-ports: \fI<string>
-List the port numbers that interface-automatic listens on. If empty, the
-default port is listened on. The port numbers are separated by spaces in the
-string. Default is "".
-.IP
-This can be used to have interface automatic to deal with the interface,
-and listen on the normal port number, by including it in the list, and
-also https or dns over tls port numbers by putting them in the list as well.
-.TP
 .B outgoing\-interface: \fI<ip address or ip6 netblock>
 Interface to use to connect to the network. This interface is used to send
 queries to authoritative servers and receive their replies. Can be given
@@ -395,10 +386,6 @@ Lower limit for dynamic retransmit timeout calculation in infrastructure
 cache. Default is 50 milliseconds. Increase this value if using forwarders
 needing more time to do recursive name resolution.
 .TP
-.B infra\-cache\-max\-rtt: \fI<msec>
-Upper limit for dynamic retransmit timeout calculation in infrastructure
-cache. Default is 2 minutes.
-.TP
 .B infra\-keep\-probing: \fI<yes or no>
 If enabled the server keeps probing hosts that are down, in the one probe
 at a time regime.  Default is no.  Hosts that are down, eg. they did
@@ -512,11 +499,10 @@ Enabled or disable whether the upstream queries use TLS only for transport.
 Default is no.  Useful in tunneling scenarios.  The TLS contains plain DNS in
 TCP wireformat.  The other server must support this (see
 \fBtls\-service\-key\fR).
-If you enable this, also configure a tls\-cert\-bundle or use tls\-win\-cert or
-tls\-system\-cert to load CA certs, otherwise the connections cannot be
-authenticated. This option enables TLS for all of them, but if you do not set
-this you can configure TLS specifically for some forward zones with
-forward\-tls\-upstream.  And also with stub\-tls\-upstream.
+If you enable this, also configure a tls\-cert\-bundle or use tls\-win\-cert to
+load CA certs, otherwise the connections cannot be authenticated.
+This option enables TLS for all of them, but if you do not set this you can
+configure TLS specifically for some forward zones with forward\-tls\-upstream.  And also with stub\-tls\-upstream.
 .TP
 .B ssl\-upstream: \fI<yes or no>
 Alternate syntax for \fBtls\-upstream\fR.  If both are present in the config
@@ -565,12 +551,7 @@ Alternate syntax for \fBtls\-cert\-bundle\fR.
 Add the system certificates to the cert bundle certificates for authentication.
 If no cert bundle, it uses only these certificates.  Default is no.
 On windows this option uses the certificates from the cert store.  Use
-the tls\-cert\-bundle option on other systems. On other systems, this option
-enables the system certificates.
-.TP
-.B tls\-system\-cert: \fI<yes or no>
-This the same setting as the tls\-win\-cert setting, under a different name.
-Because it is not windows specific.
+the tls\-cert\-bundle option on other systems.
 .TP
 .B tls\-additional\-port: \fI<portnr>
 List portnumbers as tls\-additional\-port, and when interfaces are defined,
@@ -992,7 +973,7 @@ This option only has effect when qname-minimisation is enabled. Default is no.
 .B aggressive\-nsec: \fI<yes or no>
 Aggressive NSEC uses the DNSSEC NSEC chain to synthesize NXDOMAIN
 and other denials, using information from previous NXDOMAINs answers.
-Default is yes.  It helps to reduce the query rate towards targets that get
+Default is no.  It helps to reduce the query rate towards targets that get
 a very high nonexistent name lookup rate.
 .TP
 .B private\-address: \fI<IP address or subnet>
@@ -1197,6 +1178,8 @@ happens with validation.  Use a diagnosis tool, such as dig or drill,
 to find out why validation is failing for these queries.  At 2, not only
 the query that failed is printed but also the reason why Unbound thought
 it was wrong and which server sent the faulty data.
+Enabling this influences the Extended DNS Errors (RFC 8914) messages, as
+the reason is added in the EDE message.
 .TP
 .B val\-permissive\-mode: \fI<yes or no>
 Instruct the validator to mark bogus messages as indeterminate. The security
@@ -1339,17 +1322,7 @@ are authoritative DNS answers. By default the zones are class IN.
 .IP
 If you need more complicated authoritative data, with referrals, wildcards,
 CNAME/DNAME support, or DNSSEC authoritative service, setup a stub\-zone for
-it as detailed in the stub zone section below. A stub\-zone can be used to
-have unbound send queries to another server, an authoritative server, to
-fetch the information. With a forward\-zone, unbound sends queries to a server
-that is a recursive server to fetch the information. With an auth\-zone a
-zone can be loaded from file and used, it can be used like a local\-zone
-for users downstream, or the auth\-zone information can be used to fetch
-information from when resolving like it is an upstream server. The
-forward\-zone and auth\-zone options are described in their sections below.
-If you want to perform filtering of the information that the users can fetch,
-the local\-zone and local\-data statements allow for this, but also the
-rpz functionality can be used, described in the RPZ section.
+it as detailed in the stub zone section below.
 .TP 10
 \h'5'\fIdeny\fR
 Do not send an answer, drop the query.
@@ -1591,6 +1564,60 @@ Use this localzone type, regardless the type configured for the local-zone
 (both tagged and untagged) and regardless the type configured using
 access\-control\-tag\-action.
 .TP 5
+.B ede\-local\-zones: \fI<yes or no>
+If enabled, all local zones will respond with Extended DNS Errors (RFC8914).
+This is the global setting for the configuration, but it can be overwritten by
+specifing setting 'local\-zone\-do\-ede' to "yes". By default this option
+is disabled.
+Note that the val\-log\-level influences the the reason for the error included
+in the EDE message.
+.TP 5
+.B local\-zone\-do\-ede: \fI<zone> <yes or no>
+If enabled, the responses from this local zone will include an Extended DNS
+Error (RFC8914). The type of error is dependent on the query. For example a
+query for a local-zone type "refuse" will result in EDE code 15 \- Blocked.
+By default this option is disabled.
+Note that the val\-log\-level influences the the reason for the error included
+in the EDE message.
+.TP 5
+.B local\-zone\-default\-ede: \fI<zone> <EDE code string or integer>
+If enabled, this zone will respond to requests resulting in an Extended DNS
+Error with the EDE code specified as input. This input can either be an integer
+corresponding to the EDE code number (e.g. 15 would be EDE Blocked), or a
+keyword from the following list corresponding to an EDE specified in RFC 8914.
+.TP 5
+EDE keywords:
+.nf
+\h'5'\fIother\fR
+\h'5'\fIunsupported-dnskey-algorithm\fR
+\h'5'\fIunsupported-ds-digest-type\fR
+\h'5'\fIstale-answer\fR
+\h'5'\fIforged\fR
+\h'5'\fIdnssec-indeterminate\fR
+\h'5'\fIdnssec-bogus\fR
+\h'5'\fIsignature-expired\fR
+\h'5'\fIsignature-not-yet-valid\fR
+\h'5'\fIdnskey-missing\fR
+\h'5'\fIrrsigs-missing\fR
+\h'5'\fIno-zone-key-bit-set\fR
+\h'5'\fInsec-missing\fR
+\h'5'\fIcached-error\fR
+\h'5'\fInot-ready\fR
+\h'5'\fIblocked\fR
+\h'5'\fIcensored\fR
+\h'5'\fIfiltered\fR
+\h'5'\fIprohibited\fR
+\h'5'\fIstale-nxdomain-answer\fR
+\h'5'\fInot-authoritative\fR
+\h'5'\fInot-supported\fR
+\h'5'\fIno-reachable-authority\fR
+\h'5'\fInetwork-error\fR
+\h'5'\fIinvalid-data\fR
+.fi
+.TP 5
+Note that the val\-log\-level influences the the reason for the error included
+in the EDE message.
+.TP 5
 .B response\-ip: \fI<IP-netblock> <action>
 This requires use of the "respip" module.
 .IP
@@ -1677,8 +1704,7 @@ ratelimited by this setting.  The zone of the query is determined by examining
 the nameservers for it, the zone name is used to keep track of the rate.
 For example, 1000 may be a suitable value to stop the server from being
 overloaded with random names, and keeps Unbound from sending traffic to the
-nameservers for those zones.  Configured forwarders are excluded from
-ratelimiting.
+nameservers for those zones.
 .TP 5
 .B ratelimit\-size: \fI<memory size>
 Give the size of the data structure in which the current ongoing rates are
@@ -1700,15 +1726,6 @@ This can make ordinary queries complete (if repeatedly queried for),
 and enter the cache, whilst also mitigating the traffic flow by the
 factor given.
 .TP 5
-.B ratelimit\-backoff: \fI<yes or no>
-If enabled, the ratelimit is treated as a hard failure instead of the default
-maximum allowed constant rate.  When the limit is reached, traffic is
-ratelimited and demand continues to be kept track of for a 2 second rate
-window.  No traffic is allowed, except for ratelimit\-factor, until demand
-decreases below the configured ratelimit for a 2 second rate window.  Useful to
-set ratelimit to a suspicious rate to aggressively limit unusually high
-traffic.  Default is off.
-.TP 5
 .B ratelimit\-for\-domain: \fI<domain> <number qps or 0>
 Override the global ratelimit for an exact match domain name with the listed
 number.  You can give this for any number of names.  For example, for
@@ -1725,7 +1742,7 @@ to use different settings for a top\-level\-domain and subdomains.
 A value of 0 will disable ratelimiting for domain names that end in this name.
 .TP 5
 .B ip\-ratelimit: \fI<number or 0>
-Enable global ratelimiting of queries accepted per IP address.
+Enable global ratelimiting of queries accepted per ip address.
 If 0, the default, it is disabled.  This option is experimental at this time.
 The ratelimit is in queries per second that are allowed.  More queries are
 completely dropped and will not receive a reply, SERVFAIL or otherwise.
@@ -1752,22 +1769,10 @@ This can make ordinary queries complete (if repeatedly queried for),
 and enter the cache, whilst also mitigating the traffic flow by the
 factor given.
 .TP 5
-.B ip\-ratelimit\-backoff: \fI<yes or no>
-If enabled, the ratelimit is treated as a hard failure instead of the default
-maximum allowed constant rate.  When the limit is reached, traffic is
-ratelimited and demand continues to be kept track of for a 2 second rate
-window.  No traffic is allowed, except for ip\-ratelimit\-factor, until demand
-decreases below the configured ratelimit for a 2 second rate window.  Useful to
-set ip\-ratelimit to a suspicious rate to aggressively limit unusually high
-traffic.  Default is off.
-.TP 5
 .B outbound\-msg\-retry: \fI<number>
-The number of retries, per upstream nameserver in a delegation, that Unbound
-will attempt in case a throwaway response is received.
-No response (timeout) contributes to the retry counter.
-If a forward/stub zone is used, this is the number of retries per nameserver in
-the zone.
-Default is 5.
+The number of retries Unbound will do in case of a non positive response is
+received. If a forward nameserver is used, this is the number of retries per
+forward nameserver in case of throwaway response.
 .TP 5
 .B fast\-server\-permil: \fI<number>
 Specify how many times out of 1000 to pick from the set of fastest servers.
@@ -1793,21 +1798,6 @@ option can be used multiple times. The most specific match will be used.
 EDNS0 option code for the \fIedns\-client\-string\fR option, from 0 to 65535.
 A value from the `Reserved for Local/Experimental` range (65001-65534) should
 be used.  Default is 65001.
-.TP 5
-.B ede: \fI<yes or no>
-If enabled, Unbound will respond with Extended DNS Error codes (RFC8914).
-These EDEs attach informative error messages to a response for various
-errors. Default is "no".
-
-When the \fBval-log-level\fR option is also set to \fB2\fR, responses with
-Extended DNS Errors concerning DNSSEC failures that are not served from cache,
-will also contain a descriptive text message about the reason for the failure.
-.TP
-.B ede\-serve\-expired: \fI<yes or no>
-If enabled, Unbound will attach an Extended DNS Error (RFC8914) Code 3 - Stale
-Answer as EDNS0 option to the expired response. Note that this will not attach
-the EDE code without setting the global \fBede\fR option to "yes" as well.
-Default is "no".
 .SS "Remote Control Options"
 In the
 .B remote\-control:
@@ -1831,7 +1821,7 @@ Use 0.0.0.0 and ::0 to listen to all interfaces.
 If you change this and permissions have been dropped, you must restart
 the server for the change to take effect.
 .IP
-If you set it to an absolute path, a unix domain socket is used. This socket
+If you set it to an absolute path, a local socket is used.  The local socket
 does not use the certificates and keys, so those files need not be present.
 To restrict access, Unbound sets permissions on the file to the user and
 group that is configured, the access bits are set to allow the group members
@@ -1908,19 +1898,13 @@ Name of the stub zone. This is the full domain name of the zone.
 .TP
 .B stub\-host: \fI<domain name>
 Name of stub zone nameserver. Is itself resolved before it is used.
-To use a nondefault port for DNS communication append '@' with the port number.
-If tls is enabled, then you can append a '#' and a name, then it'll check the
-tls authentication certificates with that name.  If you combine the '@'
-and '#', the '@' comes first.  If only '#' is used the default port is the
-configured tls\-port.
 .TP
 .B stub\-addr: \fI<IP address>
 IP address of stub zone nameserver. Can be IP 4 or IP 6.
 To use a nondefault port for DNS communication append '@' with the port number.
-If tls is enabled, then you can append a '#' and a name, then it'll check the
-tls authentication certificates with that name.  If you combine the '@'
-and '#', the '@' comes first.  If only '#' is used the default port is the
-configured tls\-port.
+If tls is enabled, then you can append a '#' and a name, then it'll check
+the tls authentication certificates with that name.  If you combine
+the '@' and '#', the '@' comes first.
 .TP
 .B stub\-prime: \fI<yes or no>
 This option is by default no.  If enabled it performs NS set priming,
@@ -1971,19 +1955,13 @@ Name of the forward zone. This is the full domain name of the zone.
 .TP
 .B forward\-host: \fI<domain name>
 Name of server to forward to. Is itself resolved before it is used.
-To use a nondefault port for DNS communication append '@' with the port number.
-If tls is enabled, then you can append a '#' and a name, then it'll check the
-tls authentication certificates with that name.  If you combine the '@'
-and '#', the '@' comes first.  If only '#' is used the default port is the
-configured tls\-port.
 .TP
 .B forward\-addr: \fI<IP address>
 IP address of server to forward to. Can be IP 4 or IP 6.
 To use a nondefault port for DNS communication append '@' with the port number.
-If tls is enabled, then you can append a '#' and a name, then it'll check the
-tls authentication certificates with that name.  If you combine the '@'
-and '#', the '@' comes first.  If only '#' is used the default port is the
-configured tls\-port.
+If tls is enabled, then you can append a '#' and a name, then it'll check
+the tls authentication certificates with that name.  If you combine
+the '@' and '#', the '@' comes first.
 .IP
 At high verbosity it logs the TLS certificate, with TLS enabled.
 If you leave out the '#' and auth name from the forward\-addr, any
@@ -2074,8 +2052,8 @@ With allow\-notify you can specify additional sources of notifies.
 When notified, the server attempts to first probe and then zone transfer.
 If the notify is from a primary, it first attempts that primary.  Otherwise
 other primaries are attempted.  If there are no primaries, but only urls, the
-file is downloaded when notified.  The primaries from primary: and url:
-statements are allowed notify by default.
+file is downloaded when notified.  The primaries from primary: statements are
+allowed notify by default.
 .TP
 .B fallback\-enabled: \fI<yes or no>
 Default no.  If enabled, Unbound falls back to querying the internet as
@@ -2689,8 +2667,8 @@ With allow\-notify you can specify additional sources of notifies.
 When notified, the server attempts to first probe and then zone transfer.
 If the notify is from a primary, it first attempts that primary.  Otherwise
 other primaries are attempted.  If there are no primaries, but only urls, the
-file is downloaded when notified.  The primaries from primary: and url:
-statements are allowed notify by default.
+file is downloaded when notified.  The primaries from primary: statements are
+allowed notify by default.
 .TP
 .B zonefile: \fI<filename>
 The filename where the zone is stored.  If not given then no zonefile is used.
@@ -2711,17 +2689,14 @@ Log all applied RPZ actions for this RPZ zone. Default is no.
 .B rpz\-log\-name: \fI<name>
 Specify a string to be part of the log line, for easy referencing.
 .TP
+.B rpz\-do\-ede: \fI<yes or no>
+Specify if this zone RPZ responds with Extended DNS Errors (RFC 8914). The
+default is no.
 .B rpz\-signal\-nxdomain\-ra: \fI<yes or no>
 Signal when a query is blocked by the RPZ with NXDOMAIN with an unset RA flag.
 This allows certain clients, like dnsmasq, to infer that the domain is
 externally blocked. Default is no.
 .TP
-.B for\-downstream: \fI<yes or no>
-If enabled the zone is authoritatively answered for and queries for the RPZ
-zone information are answered to downstream clients. This is useful for
-monitoring scripts, that can then access the SOA information to check if
-the rpz information is up to date. Default is no.
-.TP
 .B tags: \fI<list of tags>
 Limit the policies from this RPZ clause to clients with a matching tag. Tags
 need to be defined in \fBdefine\-tag\fR and can be assigned to client addresses
@@ -93,14 +93,13 @@ subnet_new_qstate(struct module_qstate *qstate, int id)
 	qstate->minfo[id] = sq;
 	memset(sq, 0, sizeof(*sq));
 	sq->started_no_cache_store = qstate->no_cache_store;
-	sq->started_no_cache_lookup = qstate->no_cache_lookup;
 	return 1;
 }

 /** Add ecs struct to edns list, after parsing it to wire format. */
-void
-subnet_ecs_opt_list_append(struct ecs_data* ecs, struct edns_option** list,
-	struct module_qstate *qstate, struct regional *region)
+static void
+ecs_opt_list_append(struct ecs_data* ecs, struct edns_option** list,
+	struct module_qstate *qstate)
 {
 	size_t sn_octs, sn_octs_remainder;
 	sldns_buffer* buf = qstate->env->scratch_buffer;
@@ -132,7 +131,7 @@ subnet_ecs_opt_list_append(struct ecs_data* ecs, struct edns_option** list,
 		edns_opt_list_append(list,
 				qstate->env->cfg->client_subnet_opcode,
 				sn_octs + sn_octs_remainder + 4,
-				sldns_buffer_begin(buf), region);
+				sldns_buffer_begin(buf), qstate->region);
 	}
 }

@@ -140,7 +139,7 @@ int ecs_whitelist_check(struct query_info* qinfo,
 	uint16_t ATTR_UNUSED(flags), struct module_qstate* qstate,
 	struct sockaddr_storage* addr, socklen_t addrlen,
 	uint8_t* ATTR_UNUSED(zone), size_t ATTR_UNUSED(zonelen),
-	struct regional *region, int id, void* ATTR_UNUSED(cbargs))
+	struct regional* ATTR_UNUSED(region), int id, void* ATTR_UNUSED(cbargs))
 {
 	struct subnet_qstate *sq;
 	struct subnet_env *sn_env;
@@ -163,21 +162,17 @@ int ecs_whitelist_check(struct query_info* qinfo,
 		/* Address on whitelist or client query contains ECS option, we
 		 * want to sent out ECS. Only add option if it is not already
 		 * set. */
-		if(!edns_opt_list_find(qstate->edns_opts_back_out,
-			qstate->env->cfg->client_subnet_opcode)) {
-			subnet_ecs_opt_list_append(&sq->ecs_server_out,
-				&qstate->edns_opts_back_out, qstate, region);
+		if(!(sq->subnet_sent)) {
+			ecs_opt_list_append(&sq->ecs_server_out,
+				&qstate->edns_opts_back_out, qstate);
+			sq->subnet_sent = 1;
 		}
-		sq->subnet_sent = 1;
 	}
-	else {
+	else if(sq->subnet_sent) {
 		/* Outgoing ECS option is set, but we don't want to sent it to
 		 * this address, remove option. */
-		if(edns_opt_list_find(qstate->edns_opts_back_out,
-			qstate->env->cfg->client_subnet_opcode)) {
-			edns_opt_list_remove(&qstate->edns_opts_back_out,
-				qstate->env->cfg->client_subnet_opcode);
-		}
+		edns_opt_list_remove(&qstate->edns_opts_back_out,
+			qstate->env->cfg->client_subnet_opcode);
 		sq->subnet_sent = 0;
 	}
 	return 1;
@@ -232,7 +227,7 @@ subnetmod_init(struct module_env *env, int id)
 	env->unique_mesh = 1;
 	if(!edns_register_option(env->cfg->client_subnet_opcode,
 		env->cfg->client_subnet_always_forward /* bypass cache */,
-		1 /* no aggregation */, env)) {
+		0 /* no aggregation */, env)) {
 		log_err("subnetcache: could not register opcode");
 		ecs_whitelist_delete(sn_env->whitelist);
 		slabhash_delete(sn_env->subnet_msg_cache);
@@ -332,11 +327,9 @@ update_cache(struct module_qstate *qstate, int id)
 	struct ecs_data *edns = &sq->ecs_client_in;
 	size_t i;

-	/* We already calculated hash upon lookup (lookup_and_reply) if we were
-	 * allowed to look in the ECS cache */
-	hashvalue_type h = qstate->minfo[id] &&
-		((struct subnet_qstate*)qstate->minfo[id])->qinfo_hash_calculated?
-		((struct subnet_qstate*)qstate->minfo[id])->qinfo_hash :
+	/* We already calculated hash upon lookup */
+	hashvalue_type h = qstate->minfo[id] ? 
+		((struct subnet_qstate*)qstate->minfo[id])->qinfo_hash : 
 		query_info_hash(&qstate->qinfo, qstate->query_flags);
 	/* Step 1, general qinfo lookup */
 	struct lruhash_entry *lru_entry = slabhash_lookup(subnet_msg_cache, h,
@@ -419,10 +412,7 @@ lookup_and_reply(struct module_qstate *qstate, int id, struct subnet_qstate *sq)

 	memset(&sq->ecs_client_out, 0, sizeof(sq->ecs_client_out));

-	if (sq) {
-		sq->qinfo_hash = h; /* Might be useful on cache miss */
-		sq->qinfo_hash_calculated = 1;
-	}
+	if (sq) sq->qinfo_hash = h; /* Might be useful on cache miss */
 	e = slabhash_lookup(sne->subnet_msg_cache, h, &qstate->qinfo, 1);
 	if (!e) return 0; /* qinfo not in cache */
 	data = e->data;
@@ -608,7 +598,7 @@ parse_subnet_option(struct edns_option* ecs_option, struct ecs_data* ecs)
 	return 1;
 }

-void
+static void
 subnet_option_from_ss(struct sockaddr_storage *ss, struct ecs_data* ecs,
 	struct config_file* cfg)
 {
@@ -764,21 +754,18 @@ subnetmod_operate(struct module_qstate *qstate, enum module_ev event,
 				return;
 		}

-		if(!sq->started_no_cache_lookup && !qstate->blacklist) {
-			lock_rw_wrlock(&sne->biglock);
-			if(lookup_and_reply(qstate, id, sq)) {
-				sne->num_msg_cache++;
-				lock_rw_unlock(&sne->biglock);
-				verbose(VERB_QUERY, "subnetcache: answered from cache");
-				qstate->ext_state[id] = module_finished;
-
-				subnet_ecs_opt_list_append(&sq->ecs_client_out,
-					&qstate->edns_opts_front_out, qstate,
-					qstate->region);
-				return;
-			}
+		lock_rw_wrlock(&sne->biglock);
+		if (lookup_and_reply(qstate, id, sq)) {
+			sne->num_msg_cache++;
 			lock_rw_unlock(&sne->biglock);
+			verbose(VERB_QUERY, "subnetcache: answered from cache");
+			qstate->ext_state[id] = module_finished;
+
+			ecs_opt_list_append(&sq->ecs_client_out,
+				&qstate->edns_opts_front_out, qstate);
+			return;
 		}
+		lock_rw_unlock(&sne->biglock);
 		
 		sq->ecs_server_out.subnet_addr_fam =
 			sq->ecs_client_in.subnet_addr_fam;
@@ -796,7 +783,7 @@ subnetmod_operate(struct module_qstate *qstate, enum module_ev event,
 			sq->ecs_server_out.subnet_source_mask =
 				qstate->env->cfg->max_client_subnet_ipv6;
 		/* Safe to copy completely, even if the source is limited by the
-		 * configuration. subnet_ecs_opt_list_append() will limit the address.
+		 * configuration. ecs_opt_list_append() will limit the address.
 		 * */
 		memcpy(&sq->ecs_server_out.subnet_addr,
 			sq->ecs_client_in.subnet_addr, INET6_SIZE);
@@ -820,12 +807,10 @@ subnetmod_operate(struct module_qstate *qstate, enum module_ev event,
 		qstate->ext_state[id] = eval_response(qstate, id, sq);
 		if(qstate->ext_state[id] == module_finished &&
 			qstate->return_msg) {
-			subnet_ecs_opt_list_append(&sq->ecs_client_out,
-				&qstate->edns_opts_front_out, qstate,
-				qstate->region);
+			ecs_opt_list_append(&sq->ecs_client_out,
+				&qstate->edns_opts_front_out, qstate);
 		}
 		qstate->no_cache_store = sq->started_no_cache_store;
-		qstate->no_cache_lookup = sq->started_no_cache_lookup;
 		return;
 	}
 	if(sq && outbound) {
@@ -76,7 +76,6 @@ struct subnet_msg_cache_data {
 struct subnet_qstate {
 	/** We need the hash for both cache lookup and insert */
 	hashvalue_type qinfo_hash;
-	int qinfo_hash_calculated;
 	/** ecs_data for client communication */
 	struct ecs_data	ecs_client_in;
 	struct ecs_data	ecs_client_out;
@@ -93,8 +92,6 @@ struct subnet_qstate {
 	uint8_t max_scope;
 	/** has the subnet module been started with no_cache_store? */
 	int started_no_cache_store;
-	/** has the subnet module been started with no_cache_lookup? */
-	int started_no_cache_lookup;
 };

 void subnet_data_delete(void* d, void* ATTR_UNUSED(arg));
@@ -146,11 +143,4 @@ int ecs_query_response(struct module_qstate* qstate, struct dns_msg* response,
 /** mark subnet msg to be deleted */
 void subnet_markdel(void* key);

-/** Add ecs struct to edns list, after parsing it to wire format. */
-void subnet_ecs_opt_list_append(struct ecs_data* ecs, struct edns_option** list,
-	struct module_qstate *qstate, struct regional *region);
-
-/** Create ecs_data from the sockaddr_storage information. */
-void subnet_option_from_ss(struct sockaddr_storage *ss, struct ecs_data* ecs,
-	struct config_file* cfg);
 #endif /* SUBNETMOD_H */
@@ -456,7 +456,7 @@ ipsecmod_handle_query(struct module_qstate* qstate,
 	/* Store A/AAAA in cache. */
 	if(!dns_cache_store(qstate->env, &qstate->qinfo,
 		qstate->return_msg->rep, 0, qstate->prefetch_leeway,
-		0, qstate->region, qstate->query_flags, qstate->qstarttime)) {
+		0, qstate->region, qstate->query_flags)) {
 		log_err("ipsecmod: out of memory caching record");
 	}
 	qstate->ext_state[id] = module_finished;
@@ -138,10 +138,10 @@ ipset_add_rrset_data(struct ipset_env *ie, struct mnl_socket *mnl,
 static int
 ipset_check_zones_for_rrset(struct module_env *env, struct ipset_env *ie,
 	struct mnl_socket *mnl, struct ub_packed_rrset_key *rrset,
-	const char *qname, const int qlen, const char *setname, int af)
+	const char *setname, int af)
 {
 	static char dname[BUFF_LEN];
-	const char *ds, *qs;
+	const char *s;
 	int dlen, plen;

 	struct config_strlist *p;
@@ -152,73 +152,70 @@ ipset_check_zones_for_rrset(struct module_env *env, struct ipset_env *ie,
 		log_err("bad domain name");
 		return -1;
 	}
+	if (dname[dlen - 1] == '.') {
+		dlen--;
+	}

 	for (p = env->cfg->local_zones_ipset; p; p = p->next) {
-		ds = NULL;
-		qs = NULL;
 		plen = strlen(p->str);

 		if (dlen >= plen) {
-			ds = dname + (dlen - plen);
-		}
-		if (qlen >= plen) {
-			qs = qname + (qlen - plen);
-		}
-		if ((ds && strncasecmp(p->str, ds, plen) == 0)
-			|| (qs && strncasecmp(p->str, qs, plen) == 0)) {
-			d = (struct packed_rrset_data*)rrset->entry.data;
-			ipset_add_rrset_data(ie, mnl, d, setname,
-				af, dname);
-			break;
+			s = dname + (dlen - plen);
+
+			if (strncasecmp(p->str, s, plen) == 0) {
+				d = (struct packed_rrset_data*)rrset->entry.data;
+				ipset_add_rrset_data(ie, mnl, d, setname,
+					af, dname);
+				break;
+			}
 		}
 	}
 	return 0;
 }

-static int ipset_update(struct module_env *env, struct dns_msg *return_msg,
-	struct query_info qinfo, struct ipset_env *ie)
-{
+static int ipset_update(struct module_env *env, struct dns_msg *return_msg, struct ipset_env *ie) {
 	struct mnl_socket *mnl;
+
 	size_t i;
+
 	const char *setname;
+
 	struct ub_packed_rrset_key *rrset;
+
 	int af;
-	static char qname[BUFF_LEN];
-	int qlen;
+

 	mnl = (struct mnl_socket *)ie->mnl;
 	if (!mnl) {
-		/* retry to create mnl socket */
+		// retry to create mnl socket
 		mnl = open_mnl_socket();
 		if (!mnl) {
 			return -1;
 		}
+
 		ie->mnl = mnl;
 	}

-	qlen = sldns_wire2str_dname_buf(qinfo.qname, qinfo.qname_len,
-		qname, BUFF_LEN);
-	if(qlen == 0) {
-		log_err("bad domain name");
-		return -1;
-	}
-
-	for(i = 0; i < return_msg->rep->rrset_count; i++) {
+	for (i = 0; i < return_msg->rep->rrset_count; ++i) {
 		setname = NULL;
+
 		rrset = return_msg->rep->rrsets[i];
-		if(ntohs(rrset->rk.type) == LDNS_RR_TYPE_A &&
-			ie->v4_enabled == 1) {
+
+		if (rrset->rk.type == htons(LDNS_RR_TYPE_A)) {
 			af = AF_INET;
-			setname = ie->name_v4;
-		} else if(ntohs(rrset->rk.type) == LDNS_RR_TYPE_AAAA &&
-			ie->v6_enabled == 1) {
+			if ((ie->v4_enabled == 1)) {
+				setname = ie->name_v4;
+			}
+		} else {
 			af = AF_INET6;
-			setname = ie->name_v6;
+			if ((ie->v6_enabled == 1)) {
+				setname = ie->name_v6;
+			}
 		}

 		if (setname) {
 			if(ipset_check_zones_for_rrset(env, ie, mnl, rrset,
-				qname, qlen, setname, af) == -1)
+				setname, af) == -1)
 				return -1;
 		}
 	}
@@ -314,7 +311,7 @@ void ipset_operate(struct module_qstate *qstate, enum module_ev event, int id,

 	if (iq && (event == module_event_moddone)) {
 		if (qstate->return_msg && qstate->return_msg->rep) {
-			ipset_update(qstate->env, qstate->return_msg, qstate->qinfo, ie);
+			ipset_update(qstate->env, qstate->return_msg, ie);
 		}
 		qstate->ext_state[id] = module_finished;
 		return;
@@ -75,8 +75,7 @@ struct delegpt* delegpt_copy(struct delegpt* dp, struct regional* region)
 	copy->ssl_upstream = dp->ssl_upstream;
 	copy->tcp_upstream = dp->tcp_upstream;
 	for(ns = dp->nslist; ns; ns = ns->next) {
-		if(!delegpt_add_ns(copy, region, ns->name, ns->lame,
-			ns->tls_auth_name, ns->port))
+		if(!delegpt_add_ns(copy, region, ns->name, ns->lame))
 			return NULL;
 		copy->nslist->resolved = ns->resolved;
 		copy->nslist->got4 = ns->got4;
@@ -85,8 +84,8 @@ struct delegpt* delegpt_copy(struct delegpt* dp, struct regional* region)
 		copy->nslist->done_pside6 = ns->done_pside6;
 	}
 	for(a = dp->target_list; a; a = a->next_target) {
-		if(!delegpt_add_addr(copy, region, &a->addr, a->addrlen,
-			a->bogus, a->lame, a->tls_auth_name, -1, NULL))
+		if(!delegpt_add_addr(copy, region, &a->addr, a->addrlen, 
+			a->bogus, a->lame, a->tls_auth_name, NULL))
 			return NULL;
 	}
 	return copy;
@@ -103,7 +102,7 @@ delegpt_set_name(struct delegpt* dp, struct regional* region, uint8_t* name)

 int 
 delegpt_add_ns(struct delegpt* dp, struct regional* region, uint8_t* name,
-	uint8_t lame, char* tls_auth_name, int port)
+	uint8_t lame)
 {
 	struct delegpt_ns* ns;
 	size_t len;
@@ -127,14 +126,6 @@ delegpt_add_ns(struct delegpt* dp, struct regional* region, uint8_t* name,
 	ns->lame = lame;
 	ns->done_pside4 = 0;
 	ns->done_pside6 = 0;
-	ns->port = port;
-	if(tls_auth_name) {
-		ns->tls_auth_name = regional_strdup(region, tls_auth_name);
-		if(!ns->tls_auth_name)
-			return 0;
-	} else {
-		ns->tls_auth_name = NULL;
-	}
 	return ns->name != 0;
 }

@@ -168,9 +159,9 @@ delegpt_find_addr(struct delegpt* dp, struct sockaddr_storage* addr,
 	return NULL;
 }

-int
-delegpt_add_target(struct delegpt* dp, struct regional* region,
-	uint8_t* name, size_t namelen, struct sockaddr_storage* addr,
+int 
+delegpt_add_target(struct delegpt* dp, struct regional* region, 
+	uint8_t* name, size_t namelen, struct sockaddr_storage* addr, 
 	socklen_t addrlen, uint8_t bogus, uint8_t lame, int* additions)
 {
 	struct delegpt_ns* ns = delegpt_find_ns(dp, name, namelen);
@@ -185,27 +176,18 @@ delegpt_add_target(struct delegpt* dp, struct regional* region,
 		else	ns->got4 = 1;
 		if(ns->got4 && ns->got6)
 			ns->resolved = 1;
-	} else {
-		if(addr_is_ip6(addr, addrlen))
-			ns->done_pside6 = 1;
-		else	ns->done_pside4 = 1;
 	}
-	log_assert(ns->port>0);
-	return delegpt_add_addr(dp, region, addr, addrlen, bogus, lame,
-		ns->tls_auth_name, ns->port, additions);
+	return delegpt_add_addr(dp, region, addr, addrlen, bogus, lame, NULL,
+		additions);
 }

-int
-delegpt_add_addr(struct delegpt* dp, struct regional* region,
-	struct sockaddr_storage* addr, socklen_t addrlen, uint8_t bogus,
-	uint8_t lame, char* tls_auth_name, int port, int* additions)
+int 
+delegpt_add_addr(struct delegpt* dp, struct regional* region, 
+	struct sockaddr_storage* addr, socklen_t addrlen, uint8_t bogus, 
+	uint8_t lame, char* tls_auth_name, int* additions)
 {
 	struct delegpt_addr* a;
 	log_assert(!dp->dp_type_mlc);
-	if(port != -1) {
-		log_assert(port>0);
-		sockaddr_store_port(addr, addrlen, port);
-	}
 	/* check for duplicates */
 	if((a = delegpt_find_addr(dp, addr, addrlen))) {
 		if(bogus)
@@ -342,16 +324,13 @@ delegpt_count_targets(struct delegpt* dp)
 }

 size_t 
-delegpt_count_missing_targets(struct delegpt* dp, int* alllame)
+delegpt_count_missing_targets(struct delegpt* dp)
 {
 	struct delegpt_ns* ns;
-	size_t n = 0, nlame = 0;
-	for(ns = dp->nslist; ns; ns = ns->next) {
-		if(ns->resolved) continue;
-		n++;
-		if(ns->lame) nlame++;
-	}
-	if(alllame && n == nlame) *alllame = 1;
+	size_t n = 0;
+	for(ns = dp->nslist; ns; ns = ns->next)
+		if(!ns->resolved)
+			n++;
 	return n;
 }

@@ -433,8 +412,7 @@ delegpt_rrset_add_ns(struct delegpt* dp, struct regional* region,
 			(size_t)sldns_read_uint16(nsdata->rr_data[i]))
 			continue; /* bad format */
 		/* add rdata of NS (= wirefmt dname), skip rdatalen bytes */
-		if(!delegpt_add_ns(dp, region, nsdata->rr_data[i]+2, lame,
-			NULL, UNBOUND_DNS_PORT))
+		if(!delegpt_add_ns(dp, region, nsdata->rr_data[i]+2, lame))
 			return 0;
 	}
 	return 1;
@@ -451,6 +429,7 @@ delegpt_add_rrset_A(struct delegpt* dp, struct regional* region,
 	log_assert(!dp->dp_type_mlc);
        memset(&sa, 0, len);
        sa.sin_family = AF_INET;
+        sa.sin_port = (in_port_t)htons(UNBOUND_DNS_PORT);
        for(i=0; i<d->count; i++) {
                if(d->rr_len[i] != 2 + INET_SIZE)
                        continue;
@@ -474,6 +453,7 @@ delegpt_add_rrset_AAAA(struct delegpt* dp, struct regional* region,
 	log_assert(!dp->dp_type_mlc);
        memset(&sa, 0, len);
        sa.sin6_family = AF_INET6;
+        sa.sin6_port = (in_port_t)htons(UNBOUND_DNS_PORT);
        for(i=0; i<d->count; i++) {
                if(d->rr_len[i] != 2 + INET6_SIZE) /* rdatalen + len of IP6 */
                        continue;
@@ -575,7 +555,6 @@ void delegpt_free_mlc(struct delegpt* dp)
 	while(n) {
 		nn = n->next;
 		free(n->name);
-		free(n->tls_auth_name);
 		free(n);
 		n = nn;
 	}
@@ -598,8 +577,7 @@ int delegpt_set_name_mlc(struct delegpt* dp, uint8_t* name)
 	return (dp->name != NULL);
 }

-int delegpt_add_ns_mlc(struct delegpt* dp, uint8_t* name, uint8_t lame,
-	char* tls_auth_name, int port)
+int delegpt_add_ns_mlc(struct delegpt* dp, uint8_t* name, uint8_t lame)
 {
 	struct delegpt_ns* ns;
 	size_t len;
@@ -626,30 +604,14 @@ int delegpt_add_ns_mlc(struct delegpt* dp, uint8_t* name, uint8_t lame,
 	ns->lame = (uint8_t)lame;
 	ns->done_pside4 = 0;
 	ns->done_pside6 = 0;
-	ns->port = port;
-	if(tls_auth_name) {
-		ns->tls_auth_name = strdup(tls_auth_name);
-		if(!ns->tls_auth_name) {
-			free(ns->name);
-			free(ns);
-			return 0;
-		}
-	} else {
-		ns->tls_auth_name = NULL;
-	}
 	return 1;
 }

 int delegpt_add_addr_mlc(struct delegpt* dp, struct sockaddr_storage* addr,
-	socklen_t addrlen, uint8_t bogus, uint8_t lame, char* tls_auth_name,
-	int port)
+	socklen_t addrlen, uint8_t bogus, uint8_t lame, char* tls_auth_name)
 {
 	struct delegpt_addr* a;
 	log_assert(dp->dp_type_mlc);
-	if(port != -1) {
-		log_assert(port>0);
-		sockaddr_store_port(addr, addrlen, port);
-	}
 	/* check for duplicates */
 	if((a = delegpt_find_addr(dp, addr, addrlen))) {
 		if(bogus)
@@ -701,14 +663,8 @@ int delegpt_add_target_mlc(struct delegpt* dp, uint8_t* name, size_t namelen,
 		else	ns->got4 = 1;
 		if(ns->got4 && ns->got6)
 			ns->resolved = 1;
-	} else {
-		if(addr_is_ip6(addr, addrlen))
-			ns->done_pside6 = 1;
-		else	ns->done_pside4 = 1;
 	}
-	log_assert(ns->port>0);
-	return delegpt_add_addr_mlc(dp, addr, addrlen, bogus, lame,
-		ns->tls_auth_name, ns->port);
+	return delegpt_add_addr_mlc(dp, addr, addrlen, bogus, lame, NULL);
 }

 size_t delegpt_get_mem(struct delegpt* dp)
@@ -126,11 +126,6 @@ struct delegpt_ns {
 	 * Also enabled if a parent-side cache entry exists, or a parent-side
 	 * negative-cache entry exists. */
 	uint8_t done_pside6;
-	/** the TLS authentication name, (if not NULL) to use. */
-	char* tls_auth_name;
-	/** the port to use; it should mostly be the default 53 but configured
-	 *  upstreams can provide nondefault ports. */
-	int port;
 };

 /**
@@ -196,12 +191,10 @@ int delegpt_set_name(struct delegpt* dp, struct regional* regional,
 * @param regional: where to allocate the info.
 * @param name: domain name in wire format.
 * @param lame: name is lame, disprefer it.
- * @param tls_auth_name: TLS authentication name (or NULL).
- * @param port: port to use for resolved addresses.
 * @return false on error.
 */
-int delegpt_add_ns(struct delegpt* dp, struct regional* regional,
-	uint8_t* name, uint8_t lame, char* tls_auth_name, int port);
+int delegpt_add_ns(struct delegpt* dp, struct regional* regional, 
+	uint8_t* name, uint8_t lame);

 /**
 * Add NS rrset; calls add_ns repeatedly.
@@ -278,14 +271,12 @@ int delegpt_add_rrset(struct delegpt* dp, struct regional* regional,
 * @param bogus: if address is bogus.
 * @param lame: if address is lame.
 * @param tls_auth_name: TLS authentication name (or NULL).
- * @param port: the port to use; if -1 the port is taken from addr.
 * @param additions: will be set to 1 if a new address is added
 * @return false on error.
 */
-int delegpt_add_addr(struct delegpt* dp, struct regional* regional,
+int delegpt_add_addr(struct delegpt* dp, struct regional* regional, 
 	struct sockaddr_storage* addr, socklen_t addrlen,
-	uint8_t bogus, uint8_t lame, char* tls_auth_name, int port,
-	int* additions);
+	uint8_t bogus, uint8_t lame, char* tls_auth_name, int* additions);

 /** 
 * Find NS record in name list of delegation point.
@@ -330,10 +321,9 @@ void delegpt_add_unused_targets(struct delegpt* dp);
 /**
 * Count number of missing targets. These are ns names with no resolved flag.
 * @param dp: delegation point.
- * @param alllame: if set, check if all the missing targets are lame.
 * @return number of missing targets (or 0).
 */
-size_t delegpt_count_missing_targets(struct delegpt* dp, int* alllame);
+size_t delegpt_count_missing_targets(struct delegpt* dp);

 /** count total number of targets in dp */
 size_t delegpt_count_targets(struct delegpt* dp);
@@ -414,27 +404,22 @@ int delegpt_set_name_mlc(struct delegpt* dp, uint8_t* name);
 * @param dp: must have been created with delegpt_create_mlc. 
 * @param name: the name to add.
 * @param lame: the name is lame, disprefer.
- * @param tls_auth_name: TLS authentication name (or NULL).
- * @param port: port to use for resolved addresses.
 * @return false on error.
 */
-int delegpt_add_ns_mlc(struct delegpt* dp, uint8_t* name, uint8_t lame,
-	char* tls_auth_name, int port);
+int delegpt_add_ns_mlc(struct delegpt* dp, uint8_t* name, uint8_t lame);

 /**
 * add an address to a malloced delegation point.
- * @param dp: must have been created with delegpt_create_mlc.
+ * @param dp: must have been created with delegpt_create_mlc. 
 * @param addr: the address.
 * @param addrlen: the length of addr.
 * @param bogus: if address is bogus.
 * @param lame: if address is lame.
 * @param tls_auth_name: TLS authentication name (or NULL).
- * @param port: the port to use; if -1 the port is taken from addr.
 * @return false on error.
 */
 int delegpt_add_addr_mlc(struct delegpt* dp, struct sockaddr_storage* addr,
-	socklen_t addrlen, uint8_t bogus, uint8_t lame, char* tls_auth_name,
-	int port);
+	socklen_t addrlen, uint8_t bogus, uint8_t lame, char* tls_auth_name);

 /**
 * Add target address to the delegation point.
@@ -200,27 +200,21 @@ read_fwds_name(struct config_stub* s)
 }

 /** set fwd host names */
-static int
+static int 
 read_fwds_host(struct config_stub* s, struct delegpt* dp)
 {
 	struct config_strlist* p;
 	uint8_t* dname;
-	char* tls_auth_name;
-	int port;
+	size_t dname_len;
 	for(p = s->hosts; p; p = p->next) {
 		log_assert(p->str);
-		dname = authextstrtodname(p->str, &port, &tls_auth_name);
+		dname = sldns_str2wire_dname(p->str, &dname_len);
 		if(!dname) {
 			log_err("cannot parse forward %s server name: '%s'", 
 				s->name, p->str);
 			return 0;
 		}
-#if ! defined(HAVE_SSL_SET1_HOST) && ! defined(HAVE_X509_VERIFY_PARAM_SET1_HOST)
-		if(tls_auth_name)
-			log_err("no name verification functionality in "
-				"ssl library, ignored name for %s", p->str);
-#endif
-		if(!delegpt_add_ns_mlc(dp, dname, 0, tls_auth_name, port)) {
+		if(!delegpt_add_ns_mlc(dp, dname, 0)) {
 			free(dname);
 			log_err("out of memory");
 			return 0;
@@ -251,7 +245,7 @@ read_fwds_addr(struct config_stub* s, struct delegpt* dp)
 				"ssl library, ignored name for %s", p->str);
 #endif
 		if(!delegpt_add_addr_mlc(dp, &addr, addrlen, 0, 0,
-			tls_auth_name, -1)) {
+			tls_auth_name)) {
 			log_err("out of memory");
 			return 0;
 		}
@@ -99,7 +99,7 @@ ah(struct delegpt* dp, const char* sv, const char* ip)
 		log_err("could not parse %s", sv);
 		return 0;
 	}
-	if(!delegpt_add_ns_mlc(dp, dname, 0, NULL, UNBOUND_DNS_PORT) ||
+	if(!delegpt_add_ns_mlc(dp, dname, 0) ||
 	   !extstrtoaddr(ip, &addr, &addrlen) ||
 	   !delegpt_add_target_mlc(dp, dname, dname_len,
 		&addr, addrlen, 0, 0)) {
@@ -213,27 +213,21 @@ read_stubs_name(struct config_stub* s)
 }

 /** set stub host names */
-static int
+static int 
 read_stubs_host(struct config_stub* s, struct delegpt* dp)
 {
 	struct config_strlist* p;
+	size_t dname_len;
 	uint8_t* dname;
-	char* tls_auth_name;
-	int port;
 	for(p = s->hosts; p; p = p->next) {
 		log_assert(p->str);
-		dname = authextstrtodname(p->str, &port, &tls_auth_name);
+		dname = sldns_str2wire_dname(p->str, &dname_len);
 		if(!dname) {
 			log_err("cannot parse stub %s nameserver name: '%s'", 
 				s->name, p->str);
 			return 0;
 		}
-#if ! defined(HAVE_SSL_SET1_HOST) && ! defined(HAVE_X509_VERIFY_PARAM_SET1_HOST)
-		if(tls_auth_name)
-			log_err("no name verification functionality in "
-				"ssl library, ignored name for %s", p->str);
-#endif
-		if(!delegpt_add_ns_mlc(dp, dname, 0, tls_auth_name, port)) {
+		if(!delegpt_add_ns_mlc(dp, dname, 0)) {
 			free(dname);
 			log_err("out of memory");
 			return 0;
@@ -264,7 +258,7 @@ read_stubs_addr(struct config_stub* s, struct delegpt* dp)
 				"ssl library, ignored name for %s", p->str);
 #endif
 		if(!delegpt_add_addr_mlc(dp, &addr, addrlen, 0, 0,
-			auth_name, -1)) {
+			auth_name)) {
 			log_err("out of memory");
 			return 0;
 		}
@@ -344,7 +338,7 @@ read_root_hints(struct iter_hints* hints, char* fname)
 		if(sldns_wirerr_get_type(rr, rr_len, dname_len)
 			== LDNS_RR_TYPE_NS) {
 			if(!delegpt_add_ns_mlc(dp, sldns_wirerr_get_rdata(rr,
-				rr_len, dname_len), 0, NULL, UNBOUND_DNS_PORT)) {
+				rr_len, dname_len), 0)) {
 				log_err("out of memory reading root hints");
 				goto stop_read;
 			}
@@ -70,6 +70,8 @@

 /** time when nameserver glue is said to be 'recent' */
 #define SUSPICION_RECENT_EXPIRY 86400
+/** penalty to validation failed blacklisted IPs */
+#define BLACKLIST_PENALTY (USEFUL_SERVER_TOP_TIMEOUT*4)

 /** fillup fetch policy array */
 static void
@@ -365,7 +367,6 @@ iter_filter_order(struct iter_env* iter_env, struct module_env* env,
 	struct sock_list* blacklist, time_t prefetch)
 {
 	int got_num = 0, low_rtt = 0, swap_to_front, rtt_band = RTT_BAND, nth;
-	int alllame = 0;
 	size_t num_results;
 	struct delegpt_addr* a, *n, *prev=NULL;

@@ -375,10 +376,7 @@ iter_filter_order(struct iter_env* iter_env, struct module_env* env,
 	if(got_num == 0)
 		return 0;
 	if(low_rtt >= USEFUL_SERVER_TOP_TIMEOUT &&
-		/* If all missing (or not fully resolved) targets are lame,
-		 * then use the remaining lame address. */
-		((delegpt_count_missing_targets(dp, &alllame) > 0 && !alllame) ||
-		open_target > 0)) {
+		(delegpt_count_missing_targets(dp) > 0 || open_target > 0)) {
 		verbose(VERB_ALGO, "Bad choices, trying to get more choice");
 		return 0; /* we want more choice. The best choice is a bad one.
 			     return 0 to force the caller to fetch more */
@@ -659,10 +657,10 @@ dns_copy_msg(struct dns_msg* from, struct regional* region)
 void
 iter_dns_store(struct module_env* env, struct query_info* msgqinf,
 	struct reply_info* msgrep, int is_referral, time_t leeway, int pside,
-	struct regional* region, uint16_t flags, time_t qstarttime)
+	struct regional* region, uint16_t flags)
 {
 	if(!dns_cache_store(env, msgqinf, msgrep, is_referral, leeway,
-		pside, region, flags, qstarttime))
+		pside, region, flags))
 		log_err("out of memory: cannot store data in cache");
 }

@@ -745,10 +743,9 @@ iter_mark_pside_cycle_targets(struct module_qstate* qstate, struct delegpt* dp)

 int
 iter_dp_is_useless(struct query_info* qinfo, uint16_t qflags,
-	struct delegpt* dp, int supports_ipv4, int supports_ipv6)
+	struct delegpt* dp)
 {
 	struct delegpt_ns* ns;
-	struct delegpt_addr* a;
 	/* check:
 	 *      o RD qflag is on.
 	 *      o no addresses are provided.
@@ -761,24 +758,13 @@ iter_dp_is_useless(struct query_info* qinfo, uint16_t qflags,
 	 */
 	if(!(qflags&BIT_RD))
 		return 0;
-	/* either available or unused targets,
-	 * if they exist, the dp is not useless. */
-	for(a = dp->usable_list; a; a = a->next_usable) {
-		if(!addr_is_ip6(&a->addr, a->addrlen) && supports_ipv4)
-			return 0;
-		else if(addr_is_ip6(&a->addr, a->addrlen) && supports_ipv6)
-			return 0;
-	}
-	for(a = dp->result_list; a; a = a->next_result) {
-		if(!addr_is_ip6(&a->addr, a->addrlen) && supports_ipv4)
-			return 0;
-		else if(addr_is_ip6(&a->addr, a->addrlen) && supports_ipv6)
-			return 0;
-	}
+	/* either available or unused targets */
+	if(dp->usable_list || dp->result_list)
+		return 0;

 	/* see if query is for one of the nameservers, which is glue */
-	if( ((qinfo->qtype == LDNS_RR_TYPE_A && supports_ipv4) ||
-		(qinfo->qtype == LDNS_RR_TYPE_AAAA && supports_ipv6)) &&
+	if( (qinfo->qtype == LDNS_RR_TYPE_A ||
+		qinfo->qtype == LDNS_RR_TYPE_AAAA) &&
 		dname_subdomain_c(qinfo->qname, dp->name) &&
 		delegpt_find_ns(dp, qinfo->qname, qinfo->qname_len))
 		return 1;
@@ -132,7 +132,6 @@ struct dns_msg* dns_copy_msg(struct dns_msg* from, struct regional* regional);
 * 	can be prefetch-updates.
 * @param region: to copy modified (cache is better) rrs back to.
 * @param flags: with BIT_CD for dns64 AAAA translated queries.
- * @param qstarttime: time of query start.
 * return void, because we are not interested in alloc errors,
 * 	the iterator and validator can operate on the results in their
 * 	scratch space (the qstate.region) and are not dependent on the cache.
@@ -141,7 +140,7 @@ struct dns_msg* dns_copy_msg(struct dns_msg* from, struct regional* regional);
 */
 void iter_dns_store(struct module_env* env, struct query_info* qinf,
 	struct reply_info* rep, int is_referral, time_t leeway, int pside,
-	struct regional* region, uint16_t flags, time_t qstarttime);
+	struct regional* region, uint16_t flags);

 /**
 * Select randomly with n/m probability.
@@ -176,14 +175,10 @@ void iter_mark_pside_cycle_targets(struct module_qstate* qstate,
 * @param qinfo: query name and type
 * @param qflags: query flags with RD flag
 * @param dp: delegpt to check.
- * @param supports_ipv4: if we support ipv4 for lookups to the target.
- * 	if not, then the IPv4 addresses are useless.
- * @param supports_ipv6: if we support ipv6 for lookups to the target.
- * 	if not, then the IPv6 addresses are useless.
 * @return true if dp is useless.
 */
 int iter_dp_is_useless(struct query_info* qinfo, uint16_t qflags, 
-	struct delegpt* dp, int supports_ipv4, int supports_ipv6);
+	struct delegpt* dp);

 /**
 * See if qname has DNSSEC needs.  This is true if there is a trust anchor above
@@ -71,10 +71,6 @@

 /* in msec */
 int UNKNOWN_SERVER_NICENESS = 376;
-/* in msec */
-int USEFUL_SERVER_TOP_TIMEOUT = 120000;
-/* Equals USEFUL_SERVER_TOP_TIMEOUT*4 */
-int BLACKLIST_PENALTY = (120000*4);

 static void target_count_increase_nx(struct iter_qstate* iq, int num);

@@ -257,9 +253,8 @@ error_supers(struct module_qstate* qstate, int id, struct module_qstate* super)
 		delegpt_mark_neg(dpns, qstate->qinfo.qtype);
 		dpns->resolved = 1; /* mark as failed */
 		if((dpns->got4 == 2 || !ie->supports_ipv4) &&
-			(dpns->got6 == 2 || !ie->supports_ipv6)) {
+			(dpns->got6 == 2 || !ie->supports_ipv6))
 			target_count_increase_nx(super_iq, 1);
-		}
 	}
 	if(qstate->qinfo.qtype == LDNS_RR_TYPE_NS) {
 		/* prime failed to get delegation */
@@ -375,7 +370,7 @@ error_response_cache(struct module_qstate* qstate, int id, int rcode)
 		err.security = sec_status_indeterminate;
 		verbose(VERB_ALGO, "store error response in message cache");
 		iter_dns_store(qstate->env, &qstate->qinfo, &err, 0, 0, 0, NULL,
-			qstate->query_flags, qstate->qstarttime);
+			qstate->query_flags);
 	}
 	return error_response(qstate, id, rcode);
 }
@@ -683,20 +678,15 @@ is_caps_whitelisted(struct iter_env* ie, struct iter_qstate* iq)
 		iq->qchase.qclass) != NULL;
 }

-/**
- * Create target count structure for this query. This is always explicitly
- * created for the parent query.
- */
+/** create target count structure for this query */
 static void
 target_count_create(struct iter_qstate* iq)
 {
 	if(!iq->target_count) {
-		iq->target_count = (int*)calloc(TARGET_COUNT_MAX, sizeof(int));
+		iq->target_count = (int*)calloc(3, sizeof(int));
 		/* if calloc fails we simply do not track this number */
-		if(iq->target_count) {
-			iq->target_count[TARGET_COUNT_REF] = 1;
-			iq->nxns_dp = (uint8_t**)calloc(1, sizeof(uint8_t*));
-		}
+		if(iq->target_count)
+			iq->target_count[0] = 1;
 	}
 }

@@ -705,7 +695,7 @@ target_count_increase(struct iter_qstate* iq, int num)
 {
 	target_count_create(iq);
 	if(iq->target_count)
-		iq->target_count[TARGET_COUNT_QUERIES] += num;
+		iq->target_count[1] += num;
 	iq->dp_target_count++;
 }

@@ -714,7 +704,7 @@ target_count_increase_nx(struct iter_qstate* iq, int num)
 {
 	target_count_create(iq);
 	if(iq->target_count)
-		iq->target_count[TARGET_COUNT_NX] += num;
+		iq->target_count[2] += num;
 }

 /**
@@ -809,10 +799,8 @@ generate_sub_request(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 		subiq->num_target_queries = 0;
 		target_count_create(iq);
 		subiq->target_count = iq->target_count;
-		if(iq->target_count) {
-			iq->target_count[TARGET_COUNT_REF] ++; /* extra reference */
-			subiq->nxns_dp = iq->nxns_dp;
-		}
+		if(iq->target_count)
+			iq->target_count[0] ++; /* extra reference */
 		subiq->dp_target_count = 0;
 		subiq->num_current_queries = 0;
 		subiq->depth = iq->depth+1;
@@ -1489,8 +1477,7 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 		     iq->dp = dns_cache_find_delegation(qstate->env, delname, 
 			delnamelen, iq->qchase.qtype, iq->qchase.qclass, 
 			qstate->region, &iq->deleg_msg,
-			*qstate->env->now+qstate->prefetch_leeway, 1,
-			dpname, dpnamelen);
+			*qstate->env->now+qstate->prefetch_leeway);
 		else iq->dp = NULL;

 		/* If the cache has returned nothing, then we have a 
@@ -1546,6 +1533,36 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 		if(!iq->ratelimit_ok && qstate->prefetch_leeway)
 			iq->ratelimit_ok = 1; /* allow prefetches, this keeps
 			otherwise valid data in the cache */
+		if(!iq->ratelimit_ok && infra_ratelimit_exceeded(
+			qstate->env->infra_cache, iq->dp->name,
+			iq->dp->namelen, *qstate->env->now)) {
+			/* and increment the rate, so that the rate for time
+			 * now will also exceed the rate, keeping cache fresh */
+			(void)infra_ratelimit_inc(qstate->env->infra_cache,
+				iq->dp->name, iq->dp->namelen,
+				*qstate->env->now, &qstate->qinfo,
+				qstate->reply);
+			/* see if we are passed through with slip factor */
+			if(qstate->env->cfg->ratelimit_factor != 0 &&
+				ub_random_max(qstate->env->rnd,
+				    qstate->env->cfg->ratelimit_factor) == 1) {
+				iq->ratelimit_ok = 1;
+				log_nametypeclass(VERB_ALGO, "ratelimit allowed through for "
+					"delegation point", iq->dp->name,
+					LDNS_RR_TYPE_NS, LDNS_RR_CLASS_IN);
+			} else {
+				lock_basic_lock(&ie->queries_ratelimit_lock);
+				ie->num_queries_ratelimited++;
+				lock_basic_unlock(&ie->queries_ratelimit_lock);
+				log_nametypeclass(VERB_ALGO, "ratelimit exceeded with "
+					"delegation point", iq->dp->name,
+					LDNS_RR_TYPE_NS, LDNS_RR_CLASS_IN);
+				qstate->was_ratelimited = 1;
+				errinf(qstate, "query was ratelimited");
+				errinf_dname(qstate, "for zone", iq->dp->name);
+				return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
+			}
+		}

 		/* see if this dp not useless.
 		 * It is useless if:
@@ -1560,7 +1577,7 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 		 * same server reply) if useless-checked.
 		 */
 		if(iter_dp_is_useless(&qstate->qinfo, qstate->query_flags, 
-			iq->dp, ie->supports_ipv4, ie->supports_ipv6)) {
+			iq->dp)) {
 			struct delegpt* retdp = NULL;
 			if(!can_have_last_resort(qstate->env, iq->dp->name, iq->dp->namelen, iq->qchase.qclass, &retdp)) {
 				if(retdp) {
@@ -1782,8 +1799,7 @@ generate_parentside_target_query(struct module_qstate* qstate,
 			subiq->dp = dns_cache_find_delegation(qstate->env, 
 				name, namelen, qtype, qclass, subq->region,
 				&subiq->deleg_msg,
-				*qstate->env->now+subq->prefetch_leeway,
-				1, NULL, 0);
+				*qstate->env->now+subq->prefetch_leeway); 
 			/* if no dp, then it's from root, refetch unneeded */
 			if(subiq->dp) { 
 				subiq->dnssec_expected = iter_indicates_dnssec(
@@ -1845,32 +1861,14 @@ query_for_targets(struct module_qstate* qstate, struct iter_qstate* iq,
 	int missing;
 	int toget = 0;

-	iter_mark_cycle_targets(qstate, iq->dp);
-	missing = (int)delegpt_count_missing_targets(iq->dp, NULL);
-	log_assert(maxtargets != 0); /* that would not be useful */
-
-	/* Generate target requests. Basically, any missing targets
-	 * are queried for here, regardless if it is necessary to do
-	 * so to continue processing. */
-	if(maxtargets < 0 || maxtargets > missing)
-		toget = missing;
-	else	toget = maxtargets;
-	if(toget == 0) {
-		*num = 0;
-		return 1;
-	}
-
-	/* now that we are sure that a target query is going to be made,
-	 * check the limits. */
 	if(iq->depth == ie->max_dependency_depth)
 		return 0;
 	if(iq->depth > 0 && iq->target_count &&
-		iq->target_count[TARGET_COUNT_QUERIES] > MAX_TARGET_COUNT) {
+		iq->target_count[1] > MAX_TARGET_COUNT) {
 		char s[LDNS_MAX_DOMAINLEN+1];
 		dname_str(qstate->qinfo.qname, s);
 		verbose(VERB_QUERY, "request %s has exceeded the maximum "
-			"number of glue fetches %d", s,
-			iq->target_count[TARGET_COUNT_QUERIES]);
+			"number of glue fetches %d", s, iq->target_count[1]);
 		return 0;
 	}
 	if(iq->dp_target_count > MAX_DP_TARGET_COUNT) {
@@ -1882,6 +1880,20 @@ query_for_targets(struct module_qstate* qstate, struct iter_qstate* iq,
 		return 0;
 	}

+	iter_mark_cycle_targets(qstate, iq->dp);
+	missing = (int)delegpt_count_missing_targets(iq->dp);
+	log_assert(maxtargets != 0); /* that would not be useful */
+
+	/* Generate target requests. Basically, any missing targets 
+	 * are queried for here, regardless if it is necessary to do 
+	 * so to continue processing. */
+	if(maxtargets < 0 || maxtargets > missing)
+		toget = missing;
+	else	toget = maxtargets;
+	if(toget == 0) {
+		*num = 0;
+		return 1;
+	}
 	/* select 'toget' items from the total of 'missing' items */
 	log_assert(toget <= missing);

@@ -1898,9 +1910,7 @@ query_for_targets(struct module_qstate* qstate, struct iter_qstate* iq,
 			continue;
 		}

-		if(ie->supports_ipv6 &&
-			((ns->lame && !ns->done_pside6) ||
-			(!ns->lame && !ns->got6))) {
+		if(ie->supports_ipv6 && !ns->got6) {
 			/* Send the AAAA request. */
 			if(!generate_target_query(qstate, iq, id, 
 				ns->name, ns->namelen,
@@ -1913,9 +1923,7 @@ query_for_targets(struct module_qstate* qstate, struct iter_qstate* iq,
 			query_count++;
 		}
 		/* Send the A request. */
-		if(ie->supports_ipv4 &&
-			((ns->lame && !ns->done_pside4) ||
-			(!ns->lame && !ns->got4))) {
+		if(ie->supports_ipv4 && !ns->got4) {
 			if(!generate_target_query(qstate, iq, id, 
 				ns->name, ns->namelen, 
 				LDNS_RR_TYPE_A, iq->qchase.qclass)) {
@@ -1980,13 +1988,12 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
 			iq->chase_flags &= ~BIT_RD; /* go to authorities */
 			for(ns = p->nslist; ns; ns=ns->next) {
 				(void)delegpt_add_ns(iq->dp, qstate->region,
-					ns->name, ns->lame, ns->tls_auth_name,
-					ns->port);
+					ns->name, ns->lame);
 			}
 			for(a = p->target_list; a; a=a->next_target) {
 				(void)delegpt_add_addr(iq->dp, qstate->region,
 					&a->addr, a->addrlen, a->bogus,
-					a->lame, a->tls_auth_name, -1, NULL);
+					a->lame, a->tls_auth_name, NULL);
 			}
 		}
 		iq->dp->has_parent_side_NS = 1;
@@ -2025,7 +2032,7 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
 		return next_state(iq, QUERYTARGETS_STATE);
 	}
 	/* query for an extra name added by the parent-NS record */
-	if(delegpt_count_missing_targets(iq->dp, NULL) > 0) {
+	if(delegpt_count_missing_targets(iq->dp) > 0) {
 		int qs = 0;
 		verbose(VERB_ALGO, "try parent-side target name");
 		if(!query_for_targets(qstate, iq, ie, id, 1, &qs)) {
@@ -2046,12 +2053,11 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
 		return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL);
 	}
 	if(iq->depth > 0 && iq->target_count &&
-		iq->target_count[TARGET_COUNT_QUERIES] > MAX_TARGET_COUNT) {
+		iq->target_count[1] > MAX_TARGET_COUNT) {
 		char s[LDNS_MAX_DOMAINLEN+1];
 		dname_str(qstate->qinfo.qname, s);
 		verbose(VERB_QUERY, "request %s has exceeded the maximum "
-			"number of glue fetches %d", s,
-			iq->target_count[TARGET_COUNT_QUERIES]);
+			"number of glue fetches %d", s, iq->target_count[1]);
 		errinf(qstate, "exceeded the maximum number of glue fetches");
 		return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL);
 	}
@@ -2178,32 +2184,6 @@ processDSNSFind(struct module_qstate* qstate, struct iter_qstate* iq, int id)

 	return 0;
 }
-
-/**
- * Check if we wait responses for sent queries and update the iterator's
- * external state.
- */
-static void
-check_waiting_queries(struct iter_qstate* iq, struct module_qstate* qstate,
-	int id)
-{
-	if(iq->num_target_queries>0 && iq->num_current_queries>0) {
-		verbose(VERB_ALGO, "waiting for %d targets to "
-			"resolve or %d outstanding queries to "
-			"respond", iq->num_target_queries,
-			iq->num_current_queries);
-		qstate->ext_state[id] = module_wait_reply;
-	} else if(iq->num_target_queries>0) {
-		verbose(VERB_ALGO, "waiting for %d targets to "
-			"resolve", iq->num_target_queries);
-		qstate->ext_state[id] = module_wait_subquery;
-	} else {
-		verbose(VERB_ALGO, "waiting for %d "
-			"outstanding queries to respond",
-			iq->num_current_queries);
-		qstate->ext_state[id] = module_wait_reply;
-	}
-}
 	
 /** 
 * This is the request event state where the request will be sent to one of
@@ -2231,11 +2211,9 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 	int auth_fallback = 0;
 	uint8_t* qout_orig = NULL;
 	size_t qout_orig_len = 0;
-	int sq_check_ratelimit = 1;
-	int sq_was_ratelimited = 0;

-	/* NOTE: a request will encounter this state for each target it
-	 * needs to send a query to. That is, at least one per referral,
+	/* NOTE: a request will encounter this state for each target it 
+	 * needs to send a query to. That is, at least one per referral, 
 	 * more if some targets timeout or return throwaway answers. */

 	log_query_info(VERB_QUERY, "processQueryTargets:", &qstate->qinfo);
@@ -2257,91 +2235,12 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 		errinf(qstate, "exceeded the maximum number of sends");
 		return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
 	}
-
-	/* Check if we reached MAX_TARGET_NX limit without a fallback activation. */
-	if(iq->target_count && !*iq->nxns_dp &&
-		iq->target_count[TARGET_COUNT_NX] > MAX_TARGET_NX) {
-		struct delegpt_ns* ns;
-		/* If we can wait for resolution, do so. */
-		if(iq->num_target_queries>0 || iq->num_current_queries>0) {
-			check_waiting_queries(iq, qstate, id);
-			return 0;
-		}
-		verbose(VERB_ALGO, "request has exceeded the maximum "
-			"number of nxdomain nameserver lookups (%d) with %d",
-			MAX_TARGET_NX, iq->target_count[TARGET_COUNT_NX]);
-		/* Check for dp because we require one below */
-		if(!iq->dp) {
-			verbose(VERB_QUERY, "Failed to get a delegation, "
-				"giving up");
-			errinf(qstate, "failed to get a delegation (eg. prime "
-				"failure)");
-			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
-		}
-		/* We reached the limit but we already have parent side
-		 * information; stop resolution */
-		if(iq->dp->has_parent_side_NS) {
-			verbose(VERB_ALGO, "parent-side information is "
-				"already present for the delegation point, no "
-				"fallback possible");
-			errinf(qstate, "exceeded the maximum nameserver nxdomains");
-			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
-		}
-		verbose(VERB_ALGO, "initiating parent-side fallback for "
-			"nxdomain nameserver lookups");
-		/* Mark all the current NSes as resolved to allow for parent
-		 * fallback */
-		for(ns=iq->dp->nslist; ns; ns=ns->next) {
-			ns->resolved = 1;
-		}
-		/* Note the delegation point that triggered the NXNS fallback;
-		 * no reason for shared queries to keep trying there.
-		 * This also marks the fallback activation. */
-		*iq->nxns_dp = malloc(iq->dp->namelen);
-		if(!*iq->nxns_dp) {
-			verbose(VERB_ALGO, "out of memory while initiating "
-				"fallback");
-			errinf(qstate, "exceeded the maximum nameserver "
-				"nxdomains (malloc)");
-			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
-		}
-		memcpy(*iq->nxns_dp, iq->dp->name, iq->dp->namelen);
-	} else if(iq->target_count && *iq->nxns_dp) {
-		/* Handle the NXNS fallback case. */
-		/* If we can wait for resolution, do so. */
-		if(iq->num_target_queries>0 || iq->num_current_queries>0) {
-			check_waiting_queries(iq, qstate, id);
-			return 0;
-		}
-		/* Check for dp because we require one below */
-		if(!iq->dp) {
-			verbose(VERB_QUERY, "Failed to get a delegation, "
-				"giving up");
-			errinf(qstate, "failed to get a delegation (eg. prime "
-				"failure)");
-			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
-		}
-
-		if(iq->target_count[TARGET_COUNT_NX] > MAX_TARGET_NX_FALLBACK) {
-			verbose(VERB_ALGO, "request has exceeded the maximum "
-				"number of fallback nxdomain nameserver "
-				"lookups (%d) with %d", MAX_TARGET_NX_FALLBACK,
-				iq->target_count[TARGET_COUNT_NX]);
-			errinf(qstate, "exceeded the maximum nameserver nxdomains");
-			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
-		}
-
-		if(!iq->dp->has_parent_side_NS) {
-			struct delegpt_ns* ns;
-			if(!dname_canonical_compare(*iq->nxns_dp, iq->dp->name)) {
-				verbose(VERB_ALGO, "this delegation point "
-					"initiated the fallback, marking the "
-					"nslist as resolved");
-				for(ns=iq->dp->nslist; ns; ns=ns->next) {
-					ns->resolved = 1;
-				}
-			}
-		}
+	if(iq->target_count && iq->target_count[2] > MAX_TARGET_NX) {
+		verbose(VERB_QUERY, "request has exceeded the maximum "
+			" number of nxdomain nameserver lookups with %d",
+			iq->target_count[2]);
+		errinf(qstate, "exceeded the maximum nameserver nxdomains");
+		return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
 	}
 	
 	/* Make sure we have a delegation point, otherwise priming failed
@@ -2559,7 +2458,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 	 * that servfail is cached, which is not good as opportunism goes. */
 	if(iq->depth < ie->max_dependency_depth
 		&& iq->num_target_queries == 0
-		&& (!iq->target_count || iq->target_count[TARGET_COUNT_NX]==0)
+		&& (!iq->target_count || iq->target_count[2]==0)
 		&& iq->sent_count < TARGET_FETCH_STOP) {
 		tf_policy = ie->target_fetch_policy[iq->depth];
 	}
@@ -2640,7 +2539,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 			iq->response = forged_response;
 			next_state(iq, FINISHED_STATE);
 			if(!iter_prepend(iq, qstate->return_msg, qstate->region)) {
-				log_err("rpz: prepend rrsets: out of memory");
+				log_err("rpz, prepend rrsets: out of memory");
 				return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
 			}
 			return 0;
@@ -2648,9 +2547,9 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 	}

 	/* Select the next usable target, filtering out unsuitable targets. */
-	target = iter_server_selection(ie, qstate->env, iq->dp,
+	target = iter_server_selection(ie, qstate->env, iq->dp, 
 		iq->dp->name, iq->dp->namelen, iq->qchase.qtype,
-		&iq->dnssec_lame_query, &iq->chase_to_rd,
+		&iq->dnssec_lame_query, &iq->chase_to_rd, 
 		iq->num_target_queries, qstate->blacklist,
 		qstate->prefetch_leeway);

@@ -2669,7 +2568,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 			/* If there is nothing to wait for, then we need 
 			 * to distinguish between generating (a) new target 
 			 * query, or failing. */
-			if(delegpt_count_missing_targets(iq->dp, NULL) > 0) {
+			if(delegpt_count_missing_targets(iq->dp) > 0) {
 				int qs = 0;
 				verbose(VERB_ALGO, "querying for next "
 					"missing target");
@@ -2681,7 +2580,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 						LDNS_RCODE_SERVFAIL);
 				}
 				if(qs == 0 && 
-				   delegpt_count_missing_targets(iq->dp, NULL) == 0){
+				   delegpt_count_missing_targets(iq->dp) == 0){
 					/* it looked like there were missing
 					 * targets, but they did not turn up.
 					 * Try the bad choices again (if any),
@@ -2720,8 +2619,23 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,

 		/* otherwise, we have no current targets, so submerge 
 		 * until one of the target or direct queries return. */
-		verbose(VERB_ALGO, "no current targets");
-		check_waiting_queries(iq, qstate, id);
+		if(iq->num_target_queries>0 && iq->num_current_queries>0) {
+			verbose(VERB_ALGO, "no current targets -- waiting "
+				"for %d targets to resolve or %d outstanding"
+				" queries to respond", iq->num_target_queries, 
+				iq->num_current_queries);
+			qstate->ext_state[id] = module_wait_reply;
+		} else if(iq->num_target_queries>0) {
+			verbose(VERB_ALGO, "no current targets -- waiting "
+				"for %d targets to resolve.",
+				iq->num_target_queries);
+			qstate->ext_state[id] = module_wait_subquery;
+		} else {
+			verbose(VERB_ALGO, "no current targets -- waiting "
+				"for %d outstanding queries to respond.",
+				iq->num_current_queries);
+			qstate->ext_state[id] = module_wait_reply;
+		}
 		/* undo qname minimise step because we'll get back here
 		 * to do it again */
 		if(qout_orig && iq->minimise_count > 0) {
@@ -2732,9 +2646,22 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 		return 0;
 	}

-	/* Do not check ratelimit for forwarding queries or if we already got a
-	 * pass. */
-	sq_check_ratelimit = (!(iq->chase_flags & BIT_RD) && !iq->ratelimit_ok);
+	/* if not forwarding, check ratelimits per delegationpoint name */
+	if(!(iq->chase_flags & BIT_RD) && !iq->ratelimit_ok) {
+		if(!infra_ratelimit_inc(qstate->env->infra_cache, iq->dp->name,
+			iq->dp->namelen, *qstate->env->now, &qstate->qinfo,
+			qstate->reply)) {
+			lock_basic_lock(&ie->queries_ratelimit_lock);
+			ie->num_queries_ratelimited++;
+			lock_basic_unlock(&ie->queries_ratelimit_lock);
+			verbose(VERB_ALGO, "query exceeded ratelimits");
+			qstate->was_ratelimited = 1;
+			errinf_dname(qstate, "exceeded ratelimit for zone",
+				iq->dp->name);
+			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
+		}
+	}
+
 	/* We have a valid target. */
 	if(verbosity >= VERB_QUERY) {
 		log_query_info(VERB_QUERY, "sending query:", &iq->qinfo_out);
@@ -2746,32 +2673,25 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 	}
 	fptr_ok(fptr_whitelist_modenv_send_query(qstate->env->send_query));
 	outq = (*qstate->env->send_query)(&iq->qinfo_out,
-		iq->chase_flags | (iq->chase_to_rd?BIT_RD:0),
+		iq->chase_flags | (iq->chase_to_rd?BIT_RD:0), 
 		/* unset CD if to forwarder(RD set) and not dnssec retry
 		 * (blacklist nonempty) and no trust-anchors are configured
 		 * above the qname or on the first attempt when dnssec is on */
 		EDNS_DO| ((iq->chase_to_rd||(iq->chase_flags&BIT_RD)!=0)&&
 		!qstate->blacklist&&(!iter_qname_indicates_dnssec(qstate->env,
-		&iq->qinfo_out)||target->attempts==1)?0:BIT_CD),
+		&iq->qinfo_out)||target->attempts==1)?0:BIT_CD), 
 		iq->dnssec_expected, iq->caps_fallback || is_caps_whitelisted(
-		ie, iq), sq_check_ratelimit, &target->addr, target->addrlen,
+		ie, iq), &target->addr, target->addrlen,
 		iq->dp->name, iq->dp->namelen,
 		(iq->dp->tcp_upstream || qstate->env->cfg->tcp_upstream),
 		(iq->dp->ssl_upstream || qstate->env->cfg->ssl_upstream),
-		target->tls_auth_name, qstate, &sq_was_ratelimited);
+		target->tls_auth_name, qstate);
 	if(!outq) {
-		if(sq_was_ratelimited) {
-			lock_basic_lock(&ie->queries_ratelimit_lock);
-			ie->num_queries_ratelimited++;
-			lock_basic_unlock(&ie->queries_ratelimit_lock);
-			verbose(VERB_ALGO, "query exceeded ratelimits");
-			qstate->was_ratelimited = 1;
-			errinf_dname(qstate, "exceeded ratelimit for zone",
-				iq->dp->name);
-			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
-		}
 		log_addr(VERB_QUERY, "error sending query to auth server",
 			&target->addr, target->addrlen);
+		if(!(iq->chase_flags & BIT_RD) && !iq->ratelimit_ok)
+		    infra_ratelimit_dec(qstate->env->infra_cache, iq->dp->name,
+			iq->dp->namelen, *qstate->env->now);
 		if(qstate->env->cfg->qname_minimisation)
 			iq->minimisation_state = SKIP_MINIMISE_STATE;
 		return next_state(iq, QUERYTARGETS_STATE);
@@ -2945,12 +2865,9 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 		}
 		if(!qstate->no_cache_store)
 			iter_dns_store(qstate->env, &iq->response->qinfo,
-				iq->response->rep,
-				iq->qchase.qtype != iq->response->qinfo.qtype,
-				qstate->prefetch_leeway,
+				iq->response->rep, 0, qstate->prefetch_leeway,
 				iq->dp&&iq->dp->has_parent_side_NS,
-				qstate->region, qstate->query_flags,
-				qstate->qstarttime);
+				qstate->region, qstate->query_flags);
 		/* close down outstanding requests to be discarded */
 		outbound_list_clear(&iq->outlist);
 		iq->num_current_queries = 0;
@@ -3018,6 +2935,14 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 		 * delegation point, and back to the QUERYTARGETS_STATE. */
 		verbose(VERB_DETAIL, "query response was REFERRAL");

+		if(!(iq->chase_flags & BIT_RD) && !iq->ratelimit_ok) {
+			/* we have a referral, no ratelimit, we can send
+			 * our queries to the given name */
+			infra_ratelimit_dec(qstate->env->infra_cache,
+				iq->dp->name, iq->dp->namelen,
+				*qstate->env->now);
+		}
+
 		/* if hardened, only store referral if we asked for it */
 		if(!qstate->no_cache_store &&
 		(!qstate->env->cfg->harden_referral_path ||
@@ -3039,8 +2964,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 			/* Store the referral under the current query */
 			/* no prefetch-leeway, since its not the answer */
 			iter_dns_store(qstate->env, &iq->response->qinfo,
-				iq->response->rep, 1, 0, 0, NULL, 0,
-				qstate->qstarttime);
+				iq->response->rep, 1, 0, 0, NULL, 0);
 			if(iq->store_parent_NS)
 				iter_store_parentside_NS(qstate->env, 
 					iq->response->rep);
@@ -3154,7 +3078,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 			iter_dns_store(qstate->env, &iq->response->qinfo,
 				iq->response->rep, 1, qstate->prefetch_leeway,
 				iq->dp&&iq->dp->has_parent_side_NS, NULL,
-				qstate->query_flags, qstate->qstarttime);
+				qstate->query_flags);
 		/* set the current request's qname to the new value. */
 		iq->qchase.qname = sname;
 		iq->qchase.qname_len = snamelen;
@@ -3184,7 +3108,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 				iq->response = forged_response;
 				next_state(iq, FINISHED_STATE);
 				if(!iter_prepend(iq, qstate->return_msg, qstate->region)) {
-					log_err("rpz: after cname, prepend rrsets: out of memory");
+					log_err("rpz after cname, prepend rrsets: out of memory");
 					return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
 				}
 				qstate->return_msg->qinfo = qstate->qinfo;
@@ -3460,22 +3384,21 @@ processTargetResponse(struct module_qstate* qstate, int id,
 			log_err("out of memory adding pside glue");
 	}

-	/* This response is relevant to the current query, so we
-	 * add (attempt to add, anyway) this target(s) and reactivate
-	 * the original event.
-	 * NOTE: we could only look for the AnswerRRset if the
+	/* This response is relevant to the current query, so we 
+	 * add (attempt to add, anyway) this target(s) and reactivate 
+	 * the original event. 
+	 * NOTE: we could only look for the AnswerRRset if the 
 	 * response type was ANSWER. */
 	rrset = reply_find_answer_rrset(&iq->qchase, qstate->return_msg->rep);
 	if(rrset) {
 		int additions = 0;
 		/* if CNAMEs have been followed - add new NS to delegpt. */
 		/* BTW. RFC 1918 says NS should not have got CNAMEs. Robust. */
-		if(!delegpt_find_ns(foriq->dp, rrset->rk.dname,
+		if(!delegpt_find_ns(foriq->dp, rrset->rk.dname, 
 			rrset->rk.dname_len)) {
 			/* if dpns->lame then set newcname ns lame too */
-			if(!delegpt_add_ns(foriq->dp, forq->region,
-				rrset->rk.dname, dpns->lame, dpns->tls_auth_name,
-				dpns->port))
+			if(!delegpt_add_ns(foriq->dp, forq->region, 
+				rrset->rk.dname, dpns->lame))
 				log_err("out of memory adding cnamed-ns");
 		}
 		/* if dpns->lame then set the address(es) lame too */
@@ -3495,11 +3418,8 @@ processTargetResponse(struct module_qstate* qstate, int id,
 		delegpt_mark_neg(dpns, qstate->qinfo.qtype);
 		dpns->resolved = 1; /* fail the target */
 		if((dpns->got4 == 2 || !ie->supports_ipv4) &&
-			(dpns->got6 == 2 || !ie->supports_ipv6) &&
-			/* do not count cached answers */
-			(qstate->reply_origin && qstate->reply_origin->len != 0)) {
+			(dpns->got6 == 2 || !ie->supports_ipv6))
 			target_count_increase_nx(foriq, 1);
-		}
 	}
 }

@@ -3760,8 +3680,7 @@ processFinished(struct module_qstate* qstate, struct iter_qstate* iq,
 			iter_dns_store(qstate->env, &qstate->qinfo, 
 				iq->response->rep, 0, qstate->prefetch_leeway,
 				iq->dp&&iq->dp->has_parent_side_NS,
-				qstate->region, qstate->query_flags,
-				qstate->qstarttime);
+				qstate->region, qstate->query_flags);
 		}
 	}
 	qstate->return_rcode = LDNS_RCODE_NOERROR;
@@ -4118,11 +4037,8 @@ iter_clear(struct module_qstate* qstate, int id)
 	iq = (struct iter_qstate*)qstate->minfo[id];
 	if(iq) {
 		outbound_list_clear(&iq->outlist);
-		if(iq->target_count && --iq->target_count[TARGET_COUNT_REF] == 0) {
+		if(iq->target_count && --iq->target_count[0] == 0)
 			free(iq->target_count);
-			if(*iq->nxns_dp) free(*iq->nxns_dp);
-			free(iq->nxns_dp);
-		}
 		iq->num_current_queries = 0;
 	}
 	qstate->minfo[id] = NULL;
@@ -60,9 +60,6 @@ struct rbtree_type;
 /** max number of nxdomains allowed for target lookups for a query and
 * its subqueries */
 #define MAX_TARGET_NX		5
-/** max number of nxdomains allowed for target lookups for a query and
- * its subqueries when fallback has kicked in */
-#define MAX_TARGET_NX_FALLBACK	(MAX_TARGET_NX*2)
 /** max number of query restarts. Determines max number of CNAME chain. */
 #define MAX_RESTART_COUNT	11
 /** max number of referrals. Makes sure resolver does not run away */
@@ -83,7 +80,7 @@ struct rbtree_type;
 /**
 * number of labels from QNAME that are always send individually when using
 * QNAME minimisation, even when the number of labels of the QNAME is bigger
- * than MAX_MINIMISE_COUNT */
+ * tham MAX_MINIMISE_COUNT */
 #define MINIMISE_ONE_LAB	4
 #define MINIMISE_MULTIPLE_LABS	(MAX_MINIMISE_COUNT - MINIMISE_ONE_LAB)
 /** at what query-sent-count to stop target fetch policy */
@@ -94,17 +91,15 @@ struct rbtree_type;
 extern int UNKNOWN_SERVER_NICENESS;
 /** maximum timeout before a host is deemed unsuitable, in msec. 
 * After host_ttl this will be timed out and the host will be tried again. 
- * Equals RTT_MAX_TIMEOUT, and thus when RTT_MAX_TIMEOUT is overwritten by
- * config infra_cache_max_rtt, it will be overwritten as well. */
-extern int USEFUL_SERVER_TOP_TIMEOUT;
-/** penalty to validation failed blacklisted IPs
- * Equals USEFUL_SERVER_TOP_TIMEOUT*4, and thus when RTT_MAX_TIMEOUT is
- * overwritten by config infra_cache_max_rtt, it will be overwritten as well. */
-extern int BLACKLIST_PENALTY;
+ * Equals RTT_MAX_TIMEOUT
+ */
+#define USEFUL_SERVER_TOP_TIMEOUT	120000
 /** RTT band, within this amount from the best, servers are chosen randomly.
 * Chosen so that the UNKNOWN_SERVER_NICENESS falls within the band of a 
 * fast server, this causes server exploration as a side benefit. msec. */
 #define RTT_BAND 400
+/** Start value for blacklisting a host, 2*USEFUL_SERVER_TOP_TIMEOUT in sec */
+#define INFRA_BACKOFF_INITIAL 240

 /**
 * Global state for the iterator. 
@@ -222,21 +217,6 @@ enum iter_state {
 	FINISHED_STATE
 };

-/**
- * Shared counters for queries.
- */
-enum target_count_variables {
-	/** Reference count for the shared iter_qstate->target_count. */
-	TARGET_COUNT_REF = 0,
-	/** Number of target queries spawned for the query and subqueries. */
-	TARGET_COUNT_QUERIES,
-	/** Number of nxdomain responses encountered. */
-	TARGET_COUNT_NX,
-
-	/** This should stay last here, it is used for the allocation */
-	TARGET_COUNT_MAX,
-};
-
 /**
 * Per query state for the iterator module.
 */
@@ -330,20 +310,15 @@ struct iter_qstate {
 	/** number of queries fired off */
 	int sent_count;
 	
-	/** malloced-array shared with this query and its subqueries. It keeps
-	 * track of the defined enum target_count_variables counters. */
+	/** number of target queries spawned in [1], for this query and its
+	 * subqueries, the malloced-array is shared, [0] refcount.
+	 * in [2] the number of nxdomains is counted. */
 	int* target_count;

 	/** number of target lookups per delegation point. Reset to 0 after
 	 * receiving referral answer. Not shared with subqueries. */
 	int dp_target_count;

-	/** Delegation point that triggered the NXNS fallback; shared with
-	 * this query and its subqueries, count-referenced by the reference
-	 * counter in target_count.
-	 * This also marks the fallback activation. */
-	uint8_t** nxns_dp;
-
 	/** if true, already tested for ratelimiting and passed the test */
 	int ratelimit_ok;

@@ -404,7 +379,7 @@ struct iter_qstate {
 	/** list of pending queries to authoritative servers. */
 	struct outbound_list outlist;

-	/** QNAME minimisation state, RFC9156 */
+	/** QNAME minimisation state, RFC7816 */
 	enum minimisation_state minimisation_state;

 	/** State for capsfail: QNAME minimisation state for comparisons. */
@@ -650,7 +650,7 @@ int libworker_fg(struct ub_ctx* ctx, struct ctx_query* q)
 	}
 	/* process new query */
 	if(!mesh_new_callback(w->env->mesh, &qinfo, qflags, &edns, 
-		w->back->udp_buff, qid, libworker_fg_done_cb, q, 0)) {
+		w->back->udp_buff, qid, libworker_fg_done_cb, q)) {
 		free(qinfo.qname);
 		return UB_NOMEM;
 	}
@@ -730,7 +730,7 @@ int libworker_attach_mesh(struct ub_ctx* ctx, struct ctx_query* q,
 	if(async_id)
 		*async_id = q->querynum;
 	if(!mesh_new_callback(w->env->mesh, &qinfo, qflags, &edns, 
-		w->back->udp_buff, qid, libworker_event_done_cb, q, 0)) {
+		w->back->udp_buff, qid, libworker_event_done_cb, q)) {
 		free(qinfo.qname);
 		return UB_NOMEM;
 	}
@@ -867,7 +867,7 @@ handle_newq(struct libworker* w, uint8_t* buf, uint32_t len)
 	q->w = w;
 	/* process new query */
 	if(!mesh_new_callback(w->env->mesh, &qinfo, qflags, &edns, 
-		w->back->udp_buff, qid, libworker_bg_done_cb, q, 0)) {
+		w->back->udp_buff, qid, libworker_bg_done_cb, q)) {
 		add_bg_result(w, q, NULL, UB_NOMEM, NULL, 0);
 	}
 	free(qinfo.qname);
@@ -882,10 +882,9 @@ void libworker_alloc_cleanup(void* arg)

 struct outbound_entry* libworker_send_query(struct query_info* qinfo,
 	uint16_t flags, int dnssec, int want_dnssec, int nocaps,
-	int check_ratelimit,
 	struct sockaddr_storage* addr, socklen_t addrlen, uint8_t* zone,
 	size_t zonelen, int tcp_upstream, int ssl_upstream, char* tls_auth_name,
-	struct module_qstate* q, int* was_ratelimited)
+	struct module_qstate* q)
 {
 	struct libworker* w = (struct libworker*)q->env->worker;
 	struct outbound_entry* e = (struct outbound_entry*)regional_alloc(
@@ -894,10 +893,9 @@ struct outbound_entry* libworker_send_query(struct query_info* qinfo,
 		return NULL;
 	e->qstate = q;
 	e->qsent = outnet_serviced_query(w->back, qinfo, flags, dnssec,
-		want_dnssec, nocaps, check_ratelimit, tcp_upstream, ssl_upstream,
+		want_dnssec, nocaps, tcp_upstream, ssl_upstream,
 		tls_auth_name, addr, addrlen, zone, zonelen, q,
-		libworker_handle_service_reply, e, w->back->udp_buff, q->env,
-		was_ratelimited);
+		libworker_handle_service_reply, e, w->back->udp_buff, q->env);
 	if(!e->qsent) {
 		return NULL;
 	}
@@ -978,11 +976,10 @@ void worker_sighandler(int ATTR_UNUSED(sig), void* ATTR_UNUSED(arg))
 struct outbound_entry* worker_send_query(struct query_info* ATTR_UNUSED(qinfo),
 	uint16_t ATTR_UNUSED(flags), int ATTR_UNUSED(dnssec),
 	int ATTR_UNUSED(want_dnssec), int ATTR_UNUSED(nocaps),
-	int ATTR_UNUSED(check_ratelimit),
 	struct sockaddr_storage* ATTR_UNUSED(addr), socklen_t ATTR_UNUSED(addrlen),
 	uint8_t* ATTR_UNUSED(zone), size_t ATTR_UNUSED(zonelen), int ATTR_UNUSED(tcp_upstream),
 	int ATTR_UNUSED(ssl_upstream), char* ATTR_UNUSED(tls_auth_name),
-	struct module_qstate* ATTR_UNUSED(q), int* ATTR_UNUSED(was_ratelimited))
+	struct module_qstate* ATTR_UNUSED(q))
 {
 	log_assert(0);
 	return 0;
@@ -725,8 +725,6 @@ struct ub_server_stats {
 	long long qtcp;
 	/** number of outgoing queries over TCP */
 	long long qtcp_outgoing;
-	/** number of outgoing queries over UDP */
-	long long qudp_outgoing;
 	/** number of queries over (DNS over) TLS */
 	long long qtls;
 	/** number of queries over (DNS over) HTTPS */
@@ -58,7 +58,6 @@ struct query_info;
 * @param dnssec: if set, EDNS record will have DO bit set.
 * @param want_dnssec: signatures needed.
 * @param nocaps: ignore capsforid(if in config), do not perturb qname.
- * @param check_ratelimit: if set, will check ratelimit before sending out.
 * @param addr: where to.
 * @param addrlen: length of addr.
 * @param zone: delegation point name.
@@ -68,17 +67,14 @@ struct query_info;
 * @param tls_auth_name: if ssl_upstream, use this name with TLS
 * 	authentication.
 * @param q: which query state to reactivate upon return.
- * @param was_ratelimited: it will signal back if the query failed to pass the
- *	ratelimit check.
 * @return: false on failure (memory or socket related). no query was
 *      sent.
 */
 struct outbound_entry* libworker_send_query(struct query_info* qinfo,
 	uint16_t flags, int dnssec, int want_dnssec, int nocaps,
-	int check_ratelimit,
 	struct sockaddr_storage* addr, socklen_t addrlen, uint8_t* zone,
 	size_t zonelen, int tcp_upstream, int ssl_upstream, char* tls_auth_name,
-	struct module_qstate* q, int* was_ratelimited);
+	struct module_qstate* q);

 /** process incoming serviced query replies from the network */
 int libworker_handle_service_reply(struct comm_point* c, void* arg, int error,
@@ -114,7 +110,6 @@ void worker_sighandler(int sig, void* arg);
 * @param dnssec: if set, EDNS record will have DO bit set.
 * @param want_dnssec: signatures needed.
 * @param nocaps: ignore capsforid(if in config), do not perturb qname.
- * @param check_ratelimit: if set, will check ratelimit before sending out.
 * @param addr: where to.
 * @param addrlen: length of addr.
 * @param zone: wireformat dname of the zone.
@@ -124,17 +119,14 @@ void worker_sighandler(int sig, void* arg);
 * @param tls_auth_name: if ssl_upstream, use this name with TLS
 * 	authentication.
 * @param q: which query state to reactivate upon return.
- * @param was_ratelimited: it will signal back if the query failed to pass the
- *	ratelimit check.
 * @return: false on failure (memory or socket related). no query was
 *      sent.
 */
 struct outbound_entry* worker_send_query(struct query_info* qinfo,
 	uint16_t flags, int dnssec, int want_dnssec, int nocaps,
-	int check_ratelimit,
 	struct sockaddr_storage* addr, socklen_t addrlen, uint8_t* zone,
 	size_t zonelen, int tcp_upstream, int ssl_upstream, char* tls_auth_name,
-	struct module_qstate* q, int* was_ratelimited);
+	struct module_qstate* q);

 /** 
 * process control messages from the main thread. Frees the control 
@@ -268,12 +268,10 @@ if [ "$DOWIN" = "yes" ]; then
 		# before 1.0.1i need --cross-compile-prefix=i686-w64-mingw32-
 		if test "$mw64" = "mingw64"; then
 			sslflags="no-asm -DOPENSSL_NO_CAPIENG mingw64"
-			sspdll="/usr/x86_64-w64-mingw32/sys-root/mingw/bin/libssp-0.dll"
 		else
 			sslflags="no-asm -DOPENSSL_NO_CAPIENG mingw"
-			sspdll="/usr/i686-w64-mingw32/sys-root/mingw/bin/libssp-0.dll"
 		fi
-		if test -f "$sspdll"; then
+		if test -f /usr/x86_64-w64-mingw32/sys-root/mingw/bin/libssp-0.dll; then
 			# stack protector lib needs to link in to make
 			# -lws2_32 work in openssl link stage
 			SSPLIB="-l:libssp.a"
@@ -441,8 +439,8 @@ if [ "$DOWIN" = "yes" ]; then
 	cp ../../sslsharedinstall/lib64/libssl.dll.a libunbound/.
    fi
    cp ../../unbound_shared/unbound.h ../../unbound_shared/.libs/libunbound*.dll ../../unbound_shared/.libs/libunbound.dll.a ../../unbound_shared/.libs/libunbound.a ../../unbound_shared/.libs/libunbound*.def ../../sslsharedinstall/bin/libcrypto*.dll ../../sslsharedinstall/bin/libssl*.dll ../../wxpinstall/bin/libexpat*.dll ../../wxpinstall/lib/libexpat.dll.a libunbound/.
-    if test -f "$sspdll"; then
-	    cp "$sspdll" libunbound/.
+    if test -f /usr/x86_64-w64-mingw32/sys-root/mingw/bin/libssp-0.dll; then
+	    cp /usr/x86_64-w64-mingw32/sys-root/mingw/bin/libssp-0.dll libunbound/.
    fi
    # zipfile
    zip -r ../$file LICENSE README.txt unbound.exe unbound-anchor.exe unbound-host.exe unbound-control.exe unbound-checkconf.exe unbound-service-install.exe unbound-service-remove.exe unbound-control-setup.cmd example.conf service.conf root.key unbound-website.url create_unbound_ad_servers.cmd warmup.cmd unbound_cache.cmd Changelog libunbound
@@ -60,7 +60,7 @@ EDNS options

 .. function:: edns_opt_list_remove(list, code);

-    Remove an EDNS option code from the list.
+    Remove an ENDS option code from the list.
    .. note:: All :class:`edns_option` with the code will be removed

    :param list: linked list of :class:`edns_option`
@@ -77,7 +77,7 @@ module_qstate

    .. attribute:: edns_opts_back_in_iter

-        Iterator for `edns_opts_back_in`.
+        Iterator for `ends_opts_back_in`.

    .. attribute:: edns_opts_front_out

@@ -207,7 +207,7 @@ def inplace_servfail_callback(qinfo, qstate, rep, rcode, edns, opt_list_out,

    """
    log_info("python: called back while servfail.")
-    # Append the example EDNS option
+    # Append the example ENDS option
    b = bytearray.fromhex("")
    edns_opt_list_append(opt_list_out, 65003, b, region)

@@ -712,10 +712,9 @@ struct module_env {
    /* --- services --- */
    struct outbound_entry* (*send_query)(struct query_info* qinfo,
        uint16_t flags, int dnssec, int want_dnssec, int nocaps,
-        int check_ratelimit,
        struct sockaddr_storage* addr, socklen_t addrlen,
        uint8_t* zone, size_t zonelen, int tcp_upstream, int ssl_upstream,
-        char* tls_auth_name, struct module_qstate* q, int* was_ratelimited);
+        char* tls_auth_name, struct module_qstate* q);
    void (*detach_subs)(struct module_qstate* qstate);
    int (*attach_sub)(struct module_qstate* qstate,
        struct query_info* qinfo, uint16_t qflags, int prime,
@@ -1375,10 +1374,9 @@ int set_return_msg(struct module_qstate* qstate,
 /* Functions which we will need to lookup delegations */
 struct delegpt* dns_cache_find_delegation(struct module_env* env,
        uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass,
-        struct regional* region, struct dns_msg** msg, uint32_t timenow,
-        int noexpiredabove, uint8_t* expiretop, size_t expiretoplen);
+        struct regional* region, struct dns_msg** msg, uint32_t timenow);
 int iter_dp_is_useless(struct query_info* qinfo, uint16_t qflags,
-        struct delegpt* dp, int supports_ipv4, int supports_ipv6);
+        struct delegpt* dp);
 struct iter_hints_stub* hints_lookup_stub(struct iter_hints* hints,
        uint8_t* qname, uint16_t qclass, struct delegpt* dp);

@@ -1405,11 +1403,10 @@ struct delegpt* find_delegation(struct module_qstate* qstate, char *nm, size_t n
    qinfo.qclass = LDNS_RR_CLASS_IN;

    while(1) {
-        dp = dns_cache_find_delegation(qstate->env, (uint8_t*)nm, nmlen, qinfo.qtype, qinfo.qclass, region, &msg, timenow, 0, NULL, 0);
+        dp = dns_cache_find_delegation(qstate->env, (uint8_t*)nm, nmlen, qinfo.qtype, qinfo.qclass, region, &msg, timenow);
        if(!dp)
            return NULL;
-        if(iter_dp_is_useless(&qinfo, BIT_RD, dp,
-                qstate->env->cfg->do_ip4, qstate->env->cfg->do_ip6)) {
+        if(iter_dp_is_useless(&qinfo, BIT_RD, dp)) {
            if (dname_is_root((uint8_t*)nm))
                return NULL;
            nm = (char*)dp->name;
@@ -72,8 +72,7 @@ int storeQueryInCache(struct module_qstate* qstate, struct query_info* qinfo,
 	}

 	return dns_cache_store(qstate->env, qinfo, msgrep, is_referral,
-		qstate->prefetch_leeway, 0, NULL, qstate->query_flags,
-		qstate->qstarttime);
+		qstate->prefetch_leeway, 0, NULL, qstate->query_flags);
 }

 /* Invalidate the message associated with query_info stored in message cache */
@@ -833,11 +833,8 @@ static int
 respip_use_rpz(struct resp_addr* raddr, struct rpz* r,
 	enum respip_action* action,
 	struct ub_packed_rrset_key** data, int* rpz_log, char** log_name,
-	int* rpz_cname_override, struct regional* region, int* is_rpz,
-	int* rpz_passthru)
+	int* rpz_cname_override, struct regional* region, int* is_rpz)
 {
-	if(rpz_passthru && *rpz_passthru)
-		return 0;
 	if(r->action_override == RPZ_DISABLED_ACTION) {
 		*is_rpz = 0;
 		return 1;
@@ -851,9 +848,6 @@ respip_use_rpz(struct resp_addr* raddr, struct rpz* r,
 		*data = r->cname_override;
 		*rpz_cname_override = 1;
 	}
-	if(*action == respip_always_transparent /* RPZ_PASSTHRU_ACTION */
-		&& rpz_passthru)
-		*rpz_passthru = 1;
 	*rpz_log = r->log;
 	if(r->log_name)
 		if(!(*log_name = regional_strdup(region, r->log_name)))
@@ -867,7 +861,7 @@ respip_rewrite_reply(const struct query_info* qinfo,
 	const struct respip_client_info* cinfo, const struct reply_info* rep,
 	struct reply_info** new_repp, struct respip_action_info* actinfo,
 	struct ub_packed_rrset_key** alias_rrset, int search_only,
-	struct regional* region, struct auth_zones* az, int* rpz_passthru)
+	struct regional* region, struct auth_zones* az)
 {
 	const uint8_t* ctaglist;
 	size_t ctaglen;
@@ -940,7 +934,7 @@ respip_rewrite_reply(const struct query_info* qinfo,
 			ipset->tagname, ipset->num_tags);
 	}
 	lock_rw_rdlock(&az->rpz_lock);
-	for(a = az->rpz_first; a && !raddr && !(rpz_passthru && *rpz_passthru); a = a->rpz_az_next) {
+	for(a = az->rpz_first; a && !raddr; a = a->rpz_az_next) {
 		lock_rw_rdlock(&a->lock);
 		r = a->rpz;
 		if(!r->taglist || taglist_intersect(r->taglist, 
@@ -949,7 +943,7 @@ respip_rewrite_reply(const struct query_info* qinfo,
 				r->respip_set, &rrset_id, &rr_id))) {
 				if(!respip_use_rpz(raddr, r, &action, &data,
 					&rpz_log, &log_name, &rpz_cname_override,
-					region, &rpz_used, rpz_passthru)) {
+					region, &rpz_used)) {
 					log_err("out of memory");
 					lock_rw_unlock(&raddr->lock);
 					lock_rw_unlock(&a->lock);
@@ -970,7 +964,7 @@ respip_rewrite_reply(const struct query_info* qinfo,
 						addr_to_str(&raddr->node.addr,
 							raddr->node.addrlen,
 							nm, sizeof(nm));
-						verbose(VERB_ALGO, "respip: rpz: response-ip trigger %s/%d on %s %s with action %s", nm, raddr->node.net, qn, ip, rpz_action_to_string(respip_action_to_rpz_action(action)));
+						verbose(VERB_ALGO, "respip: rpz response-ip trigger %s/%d on %s %s with action %s", nm, raddr->node.net, qn, ip, rpz_action_to_string(respip_action_to_rpz_action(action)));
 					}
 					/* break to make sure 'a' stays pointed
 					 * to used auth_zone, and keeps lock */
@@ -1100,8 +1094,7 @@ respip_operate(struct module_qstate* qstate, enum module_ev event, int id,
 			if(!respip_rewrite_reply(&qstate->qinfo,
 				qstate->client_info, qstate->return_msg->rep,
 				&new_rep, &actinfo, &alias_rrset, 0,
-				qstate->region, qstate->env->auth_zones,
-				&qstate->rpz_passthru)) {
+				qstate->region, qstate->env->auth_zones)) {
 				goto servfail;
 			}
 			if(actinfo.action != respip_none) {
@@ -1176,7 +1169,7 @@ respip_merge_cname(struct reply_info* base_rep,

 	/* see if the target reply would be subject to a response-ip action. */
 	if(!respip_rewrite_reply(qinfo, cinfo, tgt_rep, &tmp_rep, &actinfo,
-		&alias_rrset, 1, region, az, NULL))
+		&alias_rrset, 1, region, az))
 		return 0;
 	if(actinfo.action != respip_none) {
 		log_info("CNAME target of redirect response-ip action would "
@@ -1308,7 +1301,7 @@ respip_inform_print(struct respip_action_info* respip_actinfo, uint8_t* qname,
 		respip, sizeof(respip));
 	if(respip_actinfo->rpz_log) {
 		txtlen += snprintf(txt+txtlen, sizeof(txt)-txtlen, "%s",
-			"rpz: applied ");
+			"RPZ applied ");
 		if(respip_actinfo->rpz_cname_override)
 			actionstr = rpz_action_to_string(
 				RPZ_CNAME_OVERRIDE_ACTION);
@@ -176,8 +176,6 @@ int respip_merge_cname(struct reply_info* base_rep,
 *   will be set (or intact) accordingly but the modified reply won't be built.
 * @param az: auth zones containing RPZ information.
 * @param region: allocator to build *new_repp.
- * @param rpz_passthru: keeps track of query state can have passthru that
- *   stops further rpz processing. Or NULL for cached answer processing.
 * @return 1 on success, 0 on error.
 */
 int respip_rewrite_reply(const struct query_info* qinfo,
@@ -185,8 +183,7 @@ int respip_rewrite_reply(const struct query_info* qinfo,
 	const struct reply_info *rep, struct reply_info** new_repp,
 	struct respip_action_info* actinfo,
 	struct ub_packed_rrset_key** alias_rrset,
-	int search_only, struct regional* region, struct auth_zones* az,
-	int* rpz_passthru);
+	int search_only, struct regional* region, struct auth_zones* az);

 /**
 * Get the response-ip function block.
@@ -132,7 +132,6 @@ msg_create(struct regional* region, struct query_info* qinfo)
 		return NULL;
 	msg->rep->flags = (uint16_t)(BIT_QR | BIT_AA);
 	msg->rep->authoritative = 1;
-	msg->rep->reason_bogus = LDNS_EDE_NONE;
 	msg->rep->qdcount = 1;
 	/* rrsets is NULL, no rrsets yet */
 	return msg;
@@ -1883,8 +1882,6 @@ static int auth_zone_zonemd_check_hash(struct auth_zone* z,
 	struct regional* region = NULL;
 	struct sldns_buffer* buf = NULL;
 	uint32_t soa_serial = 0;
-	char* unsupported_reason = NULL;
-	int only_unsupported = 1;
 	region = env->scratch;
 	regional_free_all(region);
 	buf = env->scratch_buffer;
@@ -1914,7 +1911,6 @@ static int auth_zone_zonemd_check_hash(struct auth_zone* z,
 			&hashalgo, &hash, &hashlen)) {
 			/* malformed RR */
 			*reason = "ZONEMD rdata malformed";
-			only_unsupported = 0;
 			continue;
 		}
 		/* check for duplicates */
@@ -1924,51 +1920,25 @@ static int auth_zone_zonemd_check_hash(struct auth_zone* z,
 			 * is not allowed. */
 			*reason = "ZONEMD RRSet contains more than one RR "
 				"with the same scheme and hash algorithm";
-			only_unsupported = 0;
 			continue;
 		}
 		regional_free_all(region);
 		if(serial != soa_serial) {
 			*reason = "ZONEMD serial is wrong";
-			only_unsupported = 0;
 			continue;
 		}
-		*reason = NULL;
 		if(auth_zone_generate_zonemd_check(z, scheme, hashalgo,
 			hash, hashlen, region, buf, reason)) {
 			/* success */
-			if(*reason) {
-				if(!unsupported_reason)
-					unsupported_reason = *reason;
-				/* continue to check for valid ZONEMD */
-				if(verbosity >= VERB_ALGO) {
-					char zstr[255+1];
-					dname_str(z->name, zstr);
-					verbose(VERB_ALGO, "auth-zone %s ZONEMD %d %d is unsupported: %s", zstr, (int)scheme, (int)hashalgo, *reason);
-				}
-				*reason = NULL;
-				continue;
-			}
 			if(verbosity >= VERB_ALGO) {
 				char zstr[255+1];
 				dname_str(z->name, zstr);
-				if(!*reason)
-					verbose(VERB_ALGO, "auth-zone %s ZONEMD hash is correct", zstr);
+				verbose(VERB_ALGO, "auth-zone %s ZONEMD hash is correct", zstr);
 			}
 			return 1;
 		}
-		only_unsupported = 0;
 		/* try next one */
 	}
-	/* have we seen no failures but only unsupported algo,
-	 * and one unsupported algorithm, or more. */
-	if(only_unsupported && unsupported_reason) {
-		/* only unsupported algorithms, with valid serial, not
-		 * malformed. Did not see supported algorithms, failed or
-		 * successful ones. */
-		*reason = unsupported_reason;
-		return 1;
-	}
 	/* fail, we may have reason */
 	if(!*reason)
 		*reason = "no ZONEMD records found";
@@ -3967,7 +3937,7 @@ probe_copy_masters_for_allow_notify(struct auth_xfer* xfr)
 	struct auth_master* list = NULL, *last = NULL;
 	struct auth_master* p;
 	/* build up new list with copies */
-	for(p = xfr->task_transfer->masters; p; p=p->next) {
+	for(p = xfr->task_probe->masters; p; p=p->next) {
 		struct auth_master* m = auth_master_copy(p);
 		if(!m) {
 			auth_free_masters(list);
@@ -4486,7 +4456,7 @@ chunkline_get_line_collated(struct auth_chunk** chunk, size_t* chunk_pos,
 	return 1;
 }

-/** process $ORIGIN for http, 0 nothing, 1 done, 2 error */
+/** process $ORIGIN for http */
 static int
 http_parse_origin(sldns_buffer* buf, struct sldns_file_parse_state* pstate)
 {
@@ -4497,16 +4467,13 @@ http_parse_origin(sldns_buffer* buf, struct sldns_file_parse_state* pstate)
 		pstate->origin_len = sizeof(pstate->origin);
 		s = sldns_str2wire_dname_buf(sldns_strip_ws(line+8),
 			pstate->origin, &pstate->origin_len);
-		if(s) {
-			pstate->origin_len = 0;
-			return 2;
-		}
+		if(s) pstate->origin_len = 0;
 		return 1;
 	}
 	return 0;
 }

-/** process $TTL for http, 0 nothing, 1 done, 2 error */
+/** process $TTL for http */
 static int
 http_parse_ttl(sldns_buffer* buf, struct sldns_file_parse_state* pstate)
 {
@@ -4514,12 +4481,8 @@ http_parse_ttl(sldns_buffer* buf, struct sldns_file_parse_state* pstate)
 	if(strncmp(line, "$TTL", 4) == 0 &&
 		isspace((unsigned char)line[4])) {
 		const char* end = NULL;
-		int overflow = 0;
 		pstate->default_ttl = sldns_str2period(
-			sldns_strip_ws(line+5), &end, &overflow);
-		if(overflow) {
-			return 2;
-		}
+			sldns_strip_ws(line+5), &end);
 		return 1;
 	}
 	return 0;
@@ -4530,20 +4493,15 @@ static int
 chunkline_non_comment_RR(struct auth_chunk** chunk, size_t* chunk_pos,
 	sldns_buffer* buf, struct sldns_file_parse_state* pstate)
 {
-	int ret;
 	while(chunkline_get_line_collated(chunk, chunk_pos, buf)) {
 		if(chunkline_is_comment_line_or_empty(buf)) {
 			/* a comment, go to next line */
 			continue;
 		}
-		if((ret=http_parse_origin(buf, pstate))!=0) {
-			if(ret == 2)
-				return 0;
+		if(http_parse_origin(buf, pstate)) {
 			continue; /* $ORIGIN has been handled */
 		}
-		if((ret=http_parse_ttl(buf, pstate))!=0) {
-			if(ret == 2)
-				return 0;
+		if(http_parse_ttl(buf, pstate)) {
 			continue; /* $TTL has been handled */
 		}
 		return 1;
@@ -5049,7 +5007,6 @@ apply_http(struct auth_xfer* xfr, struct auth_zone* z,
 	struct sldns_file_parse_state pstate;
 	struct auth_chunk* chunk;
 	size_t chunk_pos;
-	int ret;
 	memset(&pstate, 0, sizeof(pstate));
 	pstate.default_ttl = 3600;
 	if(xfr->namelen < sizeof(pstate.origin)) {
@@ -5106,24 +5063,10 @@ apply_http(struct auth_xfer* xfr, struct auth_zone* z,
 			continue;
 		}
 		/* parse line and add RR */
-		if((ret=http_parse_origin(scratch_buffer, &pstate))!=0) {
-			if(ret == 2) {
-				verbose(VERB_ALGO, "error parsing ORIGIN on line [%s:%d] %s",
-					xfr->task_transfer->master->file,
-					pstate.lineno,
-					sldns_buffer_begin(scratch_buffer));
-				return 0;
-			}
+		if(http_parse_origin(scratch_buffer, &pstate)) {
 			continue; /* $ORIGIN has been handled */
 		}
-		if((ret=http_parse_ttl(scratch_buffer, &pstate))!=0) {
-			if(ret == 2) {
-				verbose(VERB_ALGO, "error parsing TTL on line [%s:%d] %s",
-					xfr->task_transfer->master->file,
-					pstate.lineno,
-					sldns_buffer_begin(scratch_buffer));
-				return 0;
-			}
+		if(http_parse_ttl(scratch_buffer, &pstate)) {
 			continue; /* $TTL has been handled */
 		}
 		if(!http_parse_add_rr(xfr, z, scratch_buffer, &pstate)) {
@@ -5427,7 +5370,7 @@ xfr_transfer_lookup_host(struct auth_xfer* xfr, struct module_env* env)
 	 * called straight away */
 	lock_basic_unlock(&xfr->lock);
 	if(!mesh_new_callback(env->mesh, &qinfo, qflags, &edns, buf, 0,
-		&auth_xfer_transfer_lookup_callback, xfr, 0)) {
+		&auth_xfer_transfer_lookup_callback, xfr)) {
 		lock_basic_lock(&xfr->lock);
 		log_err("out of memory lookup up master %s", master->host);
 		return 0;
@@ -5512,8 +5455,6 @@ xfr_transfer_init_fetch(struct auth_xfer* xfr, struct module_env* env)
 			addr_to_str(&addr, addrlen, as, sizeof(as));
 			verbose(VERB_ALGO, "auth zone %s transfer next HTTP fetch from %s started", zname, as);
 		}
-		/* Create or refresh the list of allow_notify addrs */
-		probe_copy_masters_for_allow_notify(xfr);
 		return 1;
 	}

@@ -6620,7 +6561,7 @@ xfr_probe_lookup_host(struct auth_xfer* xfr, struct module_env* env)
 	 * called straight away */
 	lock_basic_unlock(&xfr->lock);
 	if(!mesh_new_callback(env->mesh, &qinfo, qflags, &edns, buf, 0,
-		&auth_xfer_probe_lookup_callback, xfr, 0)) {
+		&auth_xfer_probe_lookup_callback, xfr)) {
 		lock_basic_lock(&xfr->lock);
 		log_err("out of memory lookup up master %s", master->host);
 		return 0;
@@ -7691,16 +7632,13 @@ int auth_zone_generate_zonemd_check(struct auth_zone* z, int scheme,
 {
 	uint8_t gen[512];
 	size_t genlen = 0;
-	*reason = NULL;
 	if(!zonemd_hashalgo_supported(hashalgo)) {
-		/* allow it */
 		*reason = "unsupported algorithm";
-		return 1;
+		return 0;
 	}
 	if(!zonemd_scheme_supported(scheme)) {
-		/* allow it */
 		*reason = "unsupported scheme";
-		return 1;
+		return 0;
 	}
 	if(hashlen < 12) {
 		/* the ZONEMD draft requires digests to fail if too small */
@@ -7788,7 +7726,7 @@ static int zonemd_dnssec_verify_rrset(struct auth_zone* z,
 		auth_zone_log(z->name, VERB_ALGO,
 			"zonemd: verify %s RRset with DNSKEY", typestr);
 	}
-	sec = dnskeyset_verify_rrset(env, ve, &pk, dnskey, sigalg, why_bogus, NULL,
+	sec = dnskeyset_verify_rrset(env, ve, &pk, dnskey, sigalg, why_bogus,
 		LDNS_SECTION_ANSWER, NULL);
 	if(sec == sec_status_secure) {
 		return 1;
@@ -8065,13 +8003,9 @@ auth_zone_verify_zonemd_with_key(struct auth_zone* z, struct module_env* env,
 	}

 	/* success! log the success */
-	if(reason)
-		auth_zone_log(z->name, VERB_ALGO, "ZONEMD %s", reason);
-	else	auth_zone_log(z->name, VERB_ALGO, "ZONEMD verification successful");
+	auth_zone_log(z->name, VERB_ALGO, "ZONEMD verification successful");
 	if(result) {
-		if(reason)
-			*result = strdup(reason);
-		else	*result = strdup("ZONEMD verification successful");
+		*result = strdup("ZONEMD verification successful");
 		if(!*result) log_err("out of memory");
 	}
 }
@@ -8131,7 +8065,7 @@ zonemd_get_dnskey_from_anchor(struct auth_zone* z, struct module_env* env,
 	auth_zone_log(z->name, VERB_QUERY,
 		"zonemd: verify DNSKEY RRset with trust anchor");
 	sec = val_verify_DNSKEY_with_TA(env, ve, keystorage, anchor->ds_rrset,
-		anchor->dnskey_rrset, NULL, why_bogus, NULL, NULL);
+		anchor->dnskey_rrset, NULL, why_bogus, NULL);
 	regional_free_all(env->scratch);
 	if(sec == sec_status_secure) {
 		/* success */
@@ -8190,7 +8124,7 @@ auth_zone_verify_zonemd_key_with_ds(struct auth_zone* z,
 	keystorage->rk.rrset_class = htons(z->dclass);
 	auth_zone_log(z->name, VERB_QUERY, "zonemd: verify zone DNSKEY with DS");
 	sec = val_verify_DNSKEY_with_DS(env, ve, keystorage, ds, sigalg,
-		why_bogus, NULL, NULL);
+		why_bogus, NULL);
 	regional_free_all(env->scratch);
 	if(sec == sec_status_secure) {
 		/* success */
@@ -8406,7 +8340,7 @@ zonemd_lookup_dnskey(struct auth_zone* z, struct module_env* env)
 	/* the callback can be called straight away */
 	lock_rw_unlock(&z->lock);
 	if(!mesh_new_callback(env->mesh, &qinfo, qflags, &edns, buf, 0,
-		&auth_zonemd_dnskey_lookup_callback, z, 0)) {
+		&auth_zonemd_dnskey_lookup_callback, z)) {
 		lock_rw_wrlock(&z->lock);
 		log_err("out of memory lookup of %s for zonemd",
 			(fetch_ds?"DS":"DNSKEY"));
@@ -747,9 +747,6 @@ int zonemd_scheme_supported(int scheme);
 * @param region: temp region for allocs during canonicalisation.
 * @param buf: temp buffer during canonicalisation.
 * @param reason: string returned with failure reason.
- * 	If the hash cannot be checked, but it is allowed, for unknown
- * 	algorithms, the routine returns success, and the reason is nonNULL,
- * 	with the allowance reason.
 * @return false on failure.
 */
 int auth_zone_generate_zonemd_check(struct auth_zone* z, int scheme,
@@ -68,16 +68,11 @@
 * 	in a prefetch situation to be updated (without becoming sticky).
 * @param qrep: update rrsets here if cache is better
 * @param region: for qrep allocs.
- * @param qstarttime: time when delegations were looked up, this is perhaps
- *	earlier than the time in now. The time is used to determine if RRsets
- *	of type NS have expired, so that they can only be updated using
- *	lookups of delegation points that did not use them, since they had
- *	expired then.
 */
 static void
 store_rrsets(struct module_env* env, struct reply_info* rep, time_t now,
 	time_t leeway, int pside, struct reply_info* qrep,
-	struct regional* region, time_t qstarttime)
+	struct regional* region)
 {
 	size_t i;
 	/* see if rrset already exists in cache, if not insert it. */
@@ -86,8 +81,8 @@ store_rrsets(struct module_env* env, struct reply_info* rep, time_t now,
 		rep->ref[i].id = rep->rrsets[i]->id;
 		/* update ref if it was in the cache */
 		switch(rrset_cache_update(env->rrset_cache, &rep->ref[i],
-				env->alloc, ((ntohs(rep->ref[i].key->rk.type)==
-				LDNS_RR_TYPE_NS && !pside)?qstarttime:now + leeway))) {
+				env->alloc, now + ((ntohs(rep->ref[i].key->rk.type)==
+				LDNS_RR_TYPE_NS && !pside)?0:leeway))) {
 		case 0: /* ref unchanged, item inserted */
 			break;
 		case 2: /* ref updated, cache is superior */
@@ -160,8 +155,7 @@ msg_del_servfail(struct module_env* env, struct query_info* qinfo,
 void 
 dns_cache_store_msg(struct module_env* env, struct query_info* qinfo,
 	hashvalue_type hash, struct reply_info* rep, time_t leeway, int pside,
-	struct reply_info* qrep, uint32_t flags, struct regional* region,
-	time_t qstarttime)
+	struct reply_info* qrep, uint32_t flags, struct regional* region)
 {
 	struct msgreply_entry* e;
 	time_t ttl = rep->ttl;
@@ -176,8 +170,7 @@ dns_cache_store_msg(struct module_env* env, struct query_info* qinfo,
 	/* there was a reply_info_sortref(rep) here but it seems to be
 	 * unnecessary, because the cache gets locked per rrset. */
 	reply_info_set_ttls(rep, *env->now);
-	store_rrsets(env, rep, *env->now, leeway, pside, qrep, region,
-		qstarttime);
+	store_rrsets(env, rep, *env->now, leeway, pside, qrep, region);
 	if(ttl == 0 && !(flags & DNSCACHE_STORE_ZEROTTL)) {
 		/* we do not store the message, but we did store the RRs,
 		 * which could be useful for delegation information */
@@ -201,51 +194,10 @@ dns_cache_store_msg(struct module_env* env, struct query_info* qinfo,
 	slabhash_insert(env->msg_cache, hash, &e->entry, rep, env->alloc);
 }

-/** see if an rrset is expired above the qname, return upper qname. */
-static int
-rrset_expired_above(struct module_env* env, uint8_t** qname, size_t* qnamelen,
-	uint16_t searchtype, uint16_t qclass, time_t now, uint8_t* expiretop,
-	size_t expiretoplen)
-{
-	struct ub_packed_rrset_key *rrset;
-	uint8_t lablen;
-
-	while(*qnamelen > 0) {
-		/* look one label higher */
-		lablen = **qname;
-		*qname += lablen + 1;
-		*qnamelen -= lablen + 1;
-		if(*qnamelen <= 0)
-			break;
-
-		/* looks up with a time of 0, to see expired entries */
-		if((rrset = rrset_cache_lookup(env->rrset_cache, *qname,
-			*qnamelen, searchtype, qclass, 0, 0, 0))) {
-			struct packed_rrset_data* data =
-				(struct packed_rrset_data*)rrset->entry.data;
-			if(now > data->ttl) {
-				/* it is expired, this is not wanted */
-				lock_rw_unlock(&rrset->entry.lock);
-				log_nametypeclass(VERB_ALGO, "this rrset is expired", *qname, searchtype, qclass);
-				return 1;
-			}
-			/* it is not expired, continue looking */
-			lock_rw_unlock(&rrset->entry.lock);
-		}
-
-		/* do not look above the expiretop. */
-		if(expiretop && *qnamelen == expiretoplen &&
-			query_dname_compare(*qname, expiretop)==0)
-			break;
-	}
-	return 0;
-}
-
 /** find closest NS or DNAME and returns the rrset (locked) */
 static struct ub_packed_rrset_key*
 find_closest_of_type(struct module_env* env, uint8_t* qname, size_t qnamelen, 
-	uint16_t qclass, time_t now, uint16_t searchtype, int stripfront,
-	int noexpiredabove, uint8_t* expiretop, size_t expiretoplen)
+	uint16_t qclass, time_t now, uint16_t searchtype, int stripfront)
 {
 	struct ub_packed_rrset_key *rrset;
 	uint8_t lablen;
@@ -260,40 +212,8 @@ find_closest_of_type(struct module_env* env, uint8_t* qname, size_t qnamelen,
 	/* snip off front part of qname until the type is found */
 	while(qnamelen > 0) {
 		if((rrset = rrset_cache_lookup(env->rrset_cache, qname, 
-			qnamelen, searchtype, qclass, 0, now, 0))) {
-			uint8_t* origqname = qname;
-			size_t origqnamelen = qnamelen;
-			if(!noexpiredabove)
-				return rrset;
-			/* if expiretop set, do not look above it, but
-			 * qname is equal, so the just found result is also
-			 * the nonexpired above part. */
-			if(expiretop && qnamelen == expiretoplen &&
-				query_dname_compare(qname, expiretop)==0)
-				return rrset;
-			/* check for expiry, but we have to let go of the rrset
-			 * for the lock ordering */
-			lock_rw_unlock(&rrset->entry.lock);
-			/* the expired_above function always takes off one
-			 * label (if qnamelen>0) and returns the final qname
-			 * where it searched, so we can continue from there
-			 * turning the O N*N search into O N. */
-			if(!rrset_expired_above(env, &qname, &qnamelen,
-				searchtype, qclass, now, expiretop,
-				expiretoplen)) {
-				/* we want to return rrset, but it may be
-				 * gone from cache, if so, just loop like
-				 * it was not in the cache in the first place.
-				 */
-				if((rrset = rrset_cache_lookup(env->
-					rrset_cache, origqname, origqnamelen,
-					searchtype, qclass, 0, now, 0))) {
-					return rrset;
-				}
-			}
-			log_nametypeclass(VERB_ALGO, "ignoring rrset because expired rrsets exist above it", origqname, searchtype, qclass);
-			continue;
-		}
+			qnamelen, searchtype, qclass, 0, now, 0)))
+			return rrset;

 		/* snip off front label */
 		lablen = *qname;
@@ -508,7 +428,6 @@ dns_msg_create(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 		return NULL; /* integer overflow protection */
 	msg->rep->flags = BIT_QR; /* with QR, no AA */
 	msg->rep->qdcount = 1;
-	msg->rep->reason_bogus = LDNS_EDE_NONE;
 	msg->rep->rrsets = (struct ub_packed_rrset_key**)
 		regional_alloc(region, 
 		capacity*sizeof(struct ub_packed_rrset_key*));
@@ -542,8 +461,7 @@ dns_msg_ansadd(struct dns_msg* msg, struct regional* region,
 struct delegpt* 
 dns_cache_find_delegation(struct module_env* env, uint8_t* qname, 
 	size_t qnamelen, uint16_t qtype, uint16_t qclass, 
-	struct regional* region, struct dns_msg** msg, time_t now,
-	int noexpiredabove, uint8_t* expiretop, size_t expiretoplen)
+	struct regional* region, struct dns_msg** msg, time_t now)
 {
 	/* try to find closest NS rrset */
 	struct ub_packed_rrset_key* nskey;
@@ -551,7 +469,7 @@ dns_cache_find_delegation(struct module_env* env, uint8_t* qname,
 	struct delegpt* dp;

 	nskey = find_closest_of_type(env, qname, qnamelen, qclass, now,
-		LDNS_RR_TYPE_NS, 0, noexpiredabove, expiretop, expiretoplen);
+		LDNS_RR_TYPE_NS, 0);
 	if(!nskey) /* hope the caller has hints to prime or something */
 		return NULL;
 	nsdata = (struct packed_rrset_data*)nskey->entry.data;
@@ -606,7 +524,6 @@ gen_dns_msg(struct regional* region, struct query_info* q, size_t num)
 		sizeof(struct reply_info) - sizeof(struct rrset_ref));
 	if(!msg->rep)
 		return NULL;
-	msg->rep->reason_bogus = LDNS_EDE_NONE;
 	if(num > RR_COUNT_MAX)
 		return NULL; /* integer overflow protection */
 	msg->rep->rrsets = (struct ub_packed_rrset_key**)
@@ -660,7 +577,6 @@ tomsg(struct module_env* env, struct query_info* q, struct reply_info* r,
 	msg->rep->ar_numrrsets = r->ar_numrrsets;
 	msg->rep->rrset_count = r->rrset_count;
 	msg->rep->authoritative = r->authoritative;
-	msg->rep->reason_bogus = r->reason_bogus;
 	if(!rrset_array_lock(r->ref, r->rrset_count, now_control)) {
 		return NULL;
 	}
@@ -716,7 +632,6 @@ rrset_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
 	msg->rep->ns_numrrsets = 0;
 	msg->rep->ar_numrrsets = 0;
 	msg->rep->rrset_count = 1;
-	msg->rep->reason_bogus = LDNS_EDE_NONE;
 	msg->rep->rrsets[0] = packed_rrset_copy_region(rrset, region, now);
 	if(!msg->rep->rrsets[0]) /* copy CNAME */
 		return NULL;
@@ -755,7 +670,6 @@ synth_dname_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
 	msg->rep->ns_numrrsets = 0;
 	msg->rep->ar_numrrsets = 0;
 	msg->rep->rrset_count = 1;
-	msg->rep->reason_bogus = LDNS_EDE_NONE;
 	msg->rep->rrsets[0] = packed_rrset_copy_region(rrset, region, now);
 	if(!msg->rep->rrsets[0]) /* copy DNAME */
 		return NULL;
@@ -921,7 +835,7 @@ dns_cache_lookup(struct module_env* env,
 	 * consistent with the DNAME */
 	if(!no_partial &&
 		(rrset=find_closest_of_type(env, qname, qnamelen, qclass, now,
-		LDNS_RR_TYPE_DNAME, 1, 0, NULL, 0))) {
+		LDNS_RR_TYPE_DNAME, 1))) {
 		/* synthesize a DNAME+CNAME message based on this */
 		enum sec_status sec_status = sec_status_unchecked;
 		struct dns_msg* msg = synth_dname_msg(rrset, region, now, &k,
@@ -1054,7 +968,7 @@ dns_cache_lookup(struct module_env* env,
 int
 dns_cache_store(struct module_env* env, struct query_info* msgqinf,
        struct reply_info* msgrep, int is_referral, time_t leeway, int pside,
-	struct regional* region, uint32_t flags, time_t qstarttime)
+	struct regional* region, uint32_t flags)
 {
 	struct reply_info* rep = NULL;
 	/* alloc, malloc properly (not in region, like msg is) */
@@ -1077,9 +991,9 @@ dns_cache_store(struct module_env* env, struct query_info* msgqinf,
 			/*ignore ret: it was in the cache, ref updated */
 			/* no leeway for typeNS */
 			(void)rrset_cache_update(env->rrset_cache, &ref, 
-				env->alloc,
+				env->alloc, *env->now + 
 				((ntohs(ref.key->rk.type)==LDNS_RR_TYPE_NS
-				 && !pside) ? qstarttime:*env->now + leeway));
+				 && !pside) ? 0:leeway));
 		}
 		free(rep);
 		return 1;
@@ -1101,7 +1015,7 @@ dns_cache_store(struct module_env* env, struct query_info* msgqinf,
 		rep->flags &= ~(BIT_AA | BIT_CD);
 		h = query_info_hash(&qinf, (uint16_t)flags);
 		dns_cache_store_msg(env, &qinf, h, rep, leeway, pside, msgrep,
-			flags, region, qstarttime);
+			flags, region);
 		/* qname is used inside query_info_entrysetup, and set to 
 		 * NULL. If it has not been used, free it. free(0) is safe. */
 		free(qinf.qname);
@@ -88,13 +88,11 @@ struct dns_msg {
 * @param flags: flags with BIT_CD for AAAA queries in dns64 translation.
 *   The higher 16 bits are used internally to customize the cache policy.
 *   (See DNSCACHE_STORE_xxx flags).
- * @param qstarttime: time when the query was started, and thus when the
- * 	delegations were looked up.
 * @return 0 on alloc error (out of memory).
 */
 int dns_cache_store(struct module_env* env, struct query_info* qinf,
        struct reply_info* rep, int is_referral, time_t leeway, int pside,
-	struct regional* region, uint32_t flags, time_t qstarttime);
+	struct regional* region, uint32_t flags);

 /**
 * Store message in the cache. Stores in message cache and rrset cache.
@@ -114,14 +112,11 @@ int dns_cache_store(struct module_env* env, struct query_info* qinf,
 * 	can be updated to full TTL even in prefetch situations.
 * @param qrep: message that can be altered with better rrs from cache.
 * @param flags: customization flags for the cache policy.
- * @param qstarttime: time when the query was started, and thus when the
- * 	delegations were looked up.
 * @param region: to allocate into for qmsg.
 */
 void dns_cache_store_msg(struct module_env* env, struct query_info* qinfo,
 	hashvalue_type hash, struct reply_info* rep, time_t leeway, int pside,
-	struct reply_info* qrep, uint32_t flags, struct regional* region,
-	time_t qstarttime);
+	struct reply_info* qrep, uint32_t flags, struct regional* region);

 /**
 * Find a delegation from the cache.
@@ -134,18 +129,11 @@ void dns_cache_store_msg(struct module_env* env, struct query_info* qinfo,
 * @param msg: if not NULL, delegation message is returned here, synthesized
 *	from the cache.
 * @param timenow: the time now, for checking if TTL on cache entries is OK.
- * @param noexpiredabove: if set, no expired NS rrsets above the one found
- * 	are tolerated. It only returns delegations where the delegations above
- * 	it are valid.
- * @param expiretop: if not NULL, name where check for expiry ends for
- * 	noexpiredabove.
- * @param expiretoplen: length of expiretop dname.
 * @return new delegation or NULL on error or if not found in cache.
 */
 struct delegpt* dns_cache_find_delegation(struct module_env* env, 
 	uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass, 
-	struct regional* region, struct dns_msg** msg, time_t timenow,
-	int noexpiredabove, uint8_t* expiretop, size_t expiretoplen);
+	struct regional* region, struct dns_msg** msg, time_t timenow);

 /**
 * generate dns_msg from cached message
@@ -721,13 +721,13 @@ infra_get_lame_rtt(struct infra_cache* infra,
 			else	*rtt = USEFUL_SERVER_TOP_TIMEOUT-1000;
 		}
 	}
-	/* expired entry */
 	if(timenow > host->ttl) {
-
+		/* expired entry */
 		/* see if this can be a re-probe of an unresponsive server */
 		/* minus 1000 because that is outside of the RTTBAND, so
 		 * blacklisted servers stay blacklisted if this is chosen */
-		if(host->rtt.rto >= USEFUL_SERVER_TOP_TIMEOUT) {
+		if(host->rtt.rto >= USEFUL_SERVER_TOP_TIMEOUT ||
+			infra->infra_keep_probing) {
 			lock_rw_unlock(&e->lock);
 			*rtt = USEFUL_SERVER_TOP_TIMEOUT-1000;
 			*lame = 0;
@@ -898,9 +898,8 @@ static void infra_ip_create_ratedata(struct infra_cache* infra,
 	slabhash_insert(infra->client_ip_rates, h, &k->entry, d, NULL);
 }

-/** Find the second and return its rate counter. If none and should_add, remove
- *  oldest to accommodate. Else return none. */
-static int* infra_rate_find_second_or_none(void* data, time_t t, int should_add)
+/** find the second and return its rate counter, if none, remove oldest */
+static int* infra_rate_find_second(void* data, time_t t)
 {
 	struct rate_data* d = (struct rate_data*)data;
 	int i, oldest;
@@ -908,7 +907,6 @@ static int* infra_rate_find_second_or_none(void* data, time_t t, int should_add)
 		if(d->timestamp[i] == t)
 			return &(d->qps[i]);
 	}
-	if(!should_add) return NULL;
 	/* remove oldest timestamp, and insert it at t with 0 qps */
 	oldest = 0;
 	for(i=0; i<RATE_WINDOW; i++) {
@@ -920,41 +918,21 @@ static int* infra_rate_find_second_or_none(void* data, time_t t, int should_add)
 	return &(d->qps[oldest]);
 }

-/** find the second and return its rate counter, if none, remove oldest to
- *  accommodate */
-static int* infra_rate_give_second(void* data, time_t t)
-{
-    return infra_rate_find_second_or_none(data, t, 1);
-}
-
-/** find the second and return its rate counter only if it exists. Caller
- *  should check for NULL return value */
-static int* infra_rate_get_second(void* data, time_t t)
-{
-    return infra_rate_find_second_or_none(data, t, 0);
-}
-
-int infra_rate_max(void* data, time_t now, int backoff)
+int infra_rate_max(void* data, time_t now)
 {
 	struct rate_data* d = (struct rate_data*)data;
 	int i, max = 0;
 	for(i=0; i<RATE_WINDOW; i++) {
-		if(backoff) {
-			if(now-d->timestamp[i] <= RATE_WINDOW &&
-				d->qps[i] > max) {
+		if(now-d->timestamp[i] <= RATE_WINDOW) {
+			if(d->qps[i] > max)
 				max = d->qps[i];
-			}
-		} else {
-			if(now == d->timestamp[i]) {
-				return d->qps[i];
-			}
 		}
 	}
 	return max;
 }

 int infra_ratelimit_inc(struct infra_cache* infra, uint8_t* name,
-	size_t namelen, time_t timenow, int backoff, struct query_info* qinfo,
+	size_t namelen, time_t timenow, struct query_info* qinfo,
 	struct comm_reply* replylist)
 {
 	int lim, max;
@@ -971,13 +949,13 @@ int infra_ratelimit_inc(struct infra_cache* infra, uint8_t* name,
 	/* find or insert ratedata */
 	entry = infra_find_ratedata(infra, name, namelen, 1);
 	if(entry) {
-		int premax = infra_rate_max(entry->data, timenow, backoff);
-		int* cur = infra_rate_give_second(entry->data, timenow);
+		int premax = infra_rate_max(entry->data, timenow);
+		int* cur = infra_rate_find_second(entry->data, timenow);
 		(*cur)++;
-		max = infra_rate_max(entry->data, timenow, backoff);
+		max = infra_rate_max(entry->data, timenow);
 		lock_rw_unlock(&entry->lock);

-		if(premax <= lim && max > lim) {
+		if(premax < lim && max >= lim) {
 			char buf[257], qnm[257], ts[12], cs[12], ip[128];
 			dname_str(name, buf);
 			dname_str(qinfo->qname, qnm);
@@ -992,12 +970,12 @@ int infra_ratelimit_inc(struct infra_cache* infra, uint8_t* name,
 				verbose(VERB_OPS, "ratelimit exceeded %s %d query %s %s %s", buf, lim, qnm, cs, ts);
 			}
 		}
-		return (max <= lim);
+		return (max < lim);
 	}

 	/* create */
 	infra_create_ratedata(infra, name, namelen, timenow);
-	return (1 <= lim);
+	return (1 < lim);
 }

 void infra_ratelimit_dec(struct infra_cache* infra, uint8_t* name,
@@ -1009,19 +987,14 @@ void infra_ratelimit_dec(struct infra_cache* infra, uint8_t* name,
 		return; /* not enabled */
 	entry = infra_find_ratedata(infra, name, namelen, 1);
 	if(!entry) return; /* not cached */
-	cur = infra_rate_get_second(entry->data, timenow);
-	if(cur == NULL) {
-		/* our timenow is not available anymore; nothing to decrease */
-		lock_rw_unlock(&entry->lock);
-		return;
-	}
+	cur = infra_rate_find_second(entry->data, timenow);
 	if((*cur) > 0)
 		(*cur)--;
 	lock_rw_unlock(&entry->lock);
 }

 int infra_ratelimit_exceeded(struct infra_cache* infra, uint8_t* name,
-	size_t namelen, time_t timenow, int backoff)
+	size_t namelen, time_t timenow)
 {
 	struct lruhash_entry* entry;
 	int lim, max;
@@ -1037,7 +1010,7 @@ int infra_ratelimit_exceeded(struct infra_cache* infra, uint8_t* name,
 	entry = infra_find_ratedata(infra, name, namelen, 0);
 	if(!entry)
 		return 0; /* not cached */
-	max = infra_rate_max(entry->data, timenow, backoff);
+	max = infra_rate_max(entry->data, timenow);
 	lock_rw_unlock(&entry->lock);

 	return (max >= lim);
@@ -1054,8 +1027,7 @@ infra_get_mem(struct infra_cache* infra)
 }

 int infra_ip_ratelimit_inc(struct infra_cache* infra,
-	struct comm_reply* repinfo, time_t timenow, int backoff,
-	struct sldns_buffer* buffer)
+  struct comm_reply* repinfo, time_t timenow, struct sldns_buffer* buffer)
 {
 	int max;
 	struct lruhash_entry* entry;
@@ -1067,10 +1039,10 @@ int infra_ip_ratelimit_inc(struct infra_cache* infra,
 	/* find or insert ratedata */
 	entry = infra_find_ip_ratedata(infra, repinfo, 1);
 	if(entry) {
-		int premax = infra_rate_max(entry->data, timenow, backoff);
-		int* cur = infra_rate_give_second(entry->data, timenow);
+		int premax = infra_rate_max(entry->data, timenow);
+		int* cur = infra_rate_find_second(entry->data, timenow);
 		(*cur)++;
-		max = infra_rate_max(entry->data, timenow, backoff);
+		max = infra_rate_max(entry->data, timenow);
 		lock_rw_unlock(&entry->lock);

 		if(premax < infra_ip_ratelimit && max >= infra_ip_ratelimit) {
@@ -368,7 +368,6 @@ long long infra_get_host_rto(struct infra_cache* infra,
 * @param name: zone name
 * @param namelen: zone name length
 * @param timenow: what time it is now.
- * @param backoff: if backoff is enabled.
 * @param qinfo: for logging, query name.
 * @param replylist: for logging, querier's address (if any).
 * @return 1 if it could be incremented. 0 if the increment overshot the
@@ -376,7 +375,7 @@ long long infra_get_host_rto(struct infra_cache* infra,
 * Failures like alloc failures are not returned (probably as 1).
 */
 int infra_ratelimit_inc(struct infra_cache* infra, uint8_t* name,
-	size_t namelen, time_t timenow, int backoff, struct query_info* qinfo,
+	size_t namelen, time_t timenow, struct query_info* qinfo,
 	struct comm_reply* replylist);

 /**
@@ -399,15 +398,13 @@ void infra_ratelimit_dec(struct infra_cache* infra, uint8_t* name,
 * @param name: zone name
 * @param namelen: zone name length
 * @param timenow: what time it is now.
- * @param backoff: if backoff is enabled.
 * @return true if exceeded.
 */
 int infra_ratelimit_exceeded(struct infra_cache* infra, uint8_t* name,
-	size_t namelen, time_t timenow, int backoff);
+	size_t namelen, time_t timenow);

-/** find the maximum rate stored. 0 if no information.
- *  When backoff is enabled look for the maximum in the whole RATE_WINDOW. */
-int infra_rate_max(void* data, time_t now, int backoff);
+/** find the maximum rate stored, not too old. 0 if no information. */
+int infra_rate_max(void* data, time_t now);

 /** find the ratelimit in qps for a domain. 0 if no limit for domain. */
 int infra_find_ratelimit(struct infra_cache* infra, uint8_t* name,
@@ -418,12 +415,11 @@ int infra_find_ratelimit(struct infra_cache* infra, uint8_t* name,
 *  @param infra: infra cache
 *  @param repinfo: information about client
 *  @param timenow: what time it is now.
- *  @param backoff: if backoff is enabled.
 *  @param buffer: with query for logging.
 *  @return 1 if it could be incremented. 0 if the increment overshot the
 *  ratelimit and the query should be dropped. */
 int infra_ip_ratelimit_inc(struct infra_cache* infra,
-	struct comm_reply* repinfo, time_t timenow, int backoff,
+	struct comm_reply* repinfo, time_t timenow,
 	struct sldns_buffer* buffer);

 /**
@@ -47,7 +47,6 @@
 #ifdef USE_TCP_FASTOPEN
 #include <netinet/tcp.h>
 #endif
-#include <ctype.h>
 #include "services/listen_dnsport.h"
 #include "services/outside_network.h"
 #include "util/netevent.h"
@@ -490,7 +489,6 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 			return -1;
 		}
 # elif defined(IPV6_MTU)
-#   ifndef USE_WINSOCK
 		/*
 		 * On Linux, to send no larger than 1280, the PMTUD is
 		 * disabled by default for datagrams anyway, so we set
@@ -498,27 +496,13 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 		 */
 		if (setsockopt(s, IPPROTO_IPV6, IPV6_MTU,
 			(void*)&mtu, (socklen_t)sizeof(mtu)) < 0) {
-			log_err("setsockopt(..., IPV6_MTU, ...) failed: %s",
+			log_err("setsockopt(..., IPV6_MTU, ...) failed: %s", 
 				sock_strerror(errno));
 			sock_close(s);
 			*noproto = 0;
 			*inuse = 0;
 			return -1;
 		}
-#   elif defined(IPV6_USER_MTU)
-		/* As later versions of the mingw crosscompiler define
-		 * IPV6_MTU, do the same for windows but use IPV6_USER_MTU
-		 * instead which is writable; IPV6_MTU is readonly there. */
-		if (setsockopt(s, IPPROTO_IPV6, IPV6_USER_MTU,
-			(void*)&mtu, (socklen_t)sizeof(mtu)) < 0) {
-			log_err("setsockopt(..., IPV6_USER_MTU, ...) failed: %s",
-				wsa_strerror(WSAGetLastError()));
-			sock_close(s);
-			*noproto = 0;
-			*inuse = 0;
-			return -1;
-		}
-#   endif /* USE_WINSOCK */
 # endif /* IPv6 MTU */
 # if defined(IPV6_MTU_DISCOVER) && defined(IP_PMTUDISC_DONT)
 #  if defined(IP_PMTUDISC_OMIT)
@@ -1173,7 +1157,7 @@ if_is_ssl(const char* ifname, const char* port, int ssl_port,
 * @param do_auto: use automatic interface detection.
 * 	If enabled, then ifname must be the wildcard name.
 * @param do_udp: if udp should be used.
- * @param do_tcp: if tcp should be used.
+ * @param do_tcp: if udp should be used.
 * @param hints: for getaddrinfo. family and flags have to be set by caller.
 * @param port: Port number to use (as string).
 * @param list: list of open ports, appended to, changed to point to list head.
@@ -1385,39 +1369,40 @@ listen_create(struct comm_base* base, struct listen_port* ports,
 	while(ports) {
 		struct comm_point* cp = NULL;
 		if(ports->ftype == listen_type_udp ||
-		   ports->ftype == listen_type_udp_dnscrypt) {
-			cp = comm_point_create_udp(base, ports->fd,
+		   ports->ftype == listen_type_udp_dnscrypt)
+			cp = comm_point_create_udp(base, ports->fd, 
 				front->udp_buff, cb, cb_arg, ports->socket);
-		} else if(ports->ftype == listen_type_tcp ||
-				ports->ftype == listen_type_tcp_dnscrypt) {
-			cp = comm_point_create_tcp(base, ports->fd,
+		else if(ports->ftype == listen_type_tcp ||
+				ports->ftype == listen_type_tcp_dnscrypt)
+			cp = comm_point_create_tcp(base, ports->fd, 
 				tcp_accept_count, tcp_idle_timeout,
 				harden_large_queries, 0, NULL,
 				tcp_conn_limit, bufsize, front->udp_buff,
 				ports->ftype, cb, cb_arg, ports->socket);
-		} else if(ports->ftype == listen_type_ssl ||
+		else if(ports->ftype == listen_type_ssl ||
 			ports->ftype == listen_type_http) {
-			cp = comm_point_create_tcp(base, ports->fd,
+			cp = comm_point_create_tcp(base, ports->fd, 
 				tcp_accept_count, tcp_idle_timeout,
 				harden_large_queries,
 				http_max_streams, http_endpoint,
 				tcp_conn_limit, bufsize, front->udp_buff,
 				ports->ftype, cb, cb_arg, ports->socket);
+			if(http_notls && ports->ftype == listen_type_http)
+				cp->ssl = NULL;
+			else
+				cp->ssl = sslctx;
 			if(ports->ftype == listen_type_http) {
 				if(!sslctx && !http_notls) {
-					log_warn("HTTPS port configured, but "
-						"no TLS tls-service-key or "
-						"tls-service-pem set");
+				  log_warn("HTTPS port configured, but no TLS "
+					"tls-service-key or tls-service-pem "
+					"set");
 				}
 #ifndef HAVE_SSL_CTX_SET_ALPN_SELECT_CB
-				if(!http_notls) {
-					log_warn("Unbound is not compiled "
-						"with an OpenSSL version "
-						"supporting ALPN "
-						"(OpenSSL >= 1.0.2). This "
-						"is required to use "
-						"DNS-over-HTTPS");
-				}
+				if(!http_notls)
+				  log_warn("Unbound is not compiled with an "
+					"OpenSSL version supporting ALPN "
+					" (OpenSSL >= 1.0.2). This is required "
+					"to use DNS-over-HTTPS");
 #endif
 #ifndef HAVE_NGHTTP2_NGHTTP2_H
 				log_warn("Unbound is not compiled with "
@@ -1426,25 +1411,14 @@ listen_create(struct comm_base* base, struct listen_port* ports,
 #endif
 			}
 		} else if(ports->ftype == listen_type_udpancil ||
-				  ports->ftype == listen_type_udpancil_dnscrypt) {
-			cp = comm_point_create_udp_ancil(base, ports->fd,
+				  ports->ftype == listen_type_udpancil_dnscrypt)
+			cp = comm_point_create_udp_ancil(base, ports->fd, 
 				front->udp_buff, cb, cb_arg, ports->socket);
-		}
 		if(!cp) {
-			log_err("can't create commpoint");
+			log_err("can't create commpoint");	
 			listen_delete(front);
 			return NULL;
 		}
-		if((http_notls && ports->ftype == listen_type_http) ||
-			(ports->ftype == listen_type_tcp) ||
-			(ports->ftype == listen_type_udp) ||
-			(ports->ftype == listen_type_udpancil) ||
-			(ports->ftype == listen_type_tcp_dnscrypt) ||
-			(ports->ftype == listen_type_udp_dnscrypt) ||
-			(ports->ftype == listen_type_udpancil_dnscrypt))
-			cp->ssl = NULL;
-		else
-			cp->ssl = sslctx;
 		cp->dtenv = dtenv;
 		cp->do_not_close = 1;
 #ifdef USE_DNSCRYPT
@@ -1732,63 +1706,6 @@ listening_ports_open(struct config_file* cfg, char** ifs, int num_ifs,
 	}
 	/* create ip4 and ip6 ports so that return addresses are nice. */
 	if(do_auto || num_ifs == 0) {
-		if(do_auto && cfg->if_automatic_ports &&
-			cfg->if_automatic_ports[0]!=0) {
-			char* now = cfg->if_automatic_ports;
-			while(now && *now) {
-				char* after;
-				int extraport;
-				while(isspace((unsigned char)*now))
-					now++;
-				if(!*now)
-					break;
-				after = now;
-				extraport = (int)strtol(now, &after, 10);
-				if(extraport < 0 || extraport > 65535) {
-					log_err("interface-automatic-ports port number out of range, at position %d of '%s'", (int)(now-cfg->if_automatic_ports)+1, cfg->if_automatic_ports);
-					listening_ports_free(list);
-					return NULL;
-				}
-				if(extraport == 0 && now == after) {
-					log_err("interface-automatic-ports could not be parsed, at position %d of '%s'", (int)(now-cfg->if_automatic_ports)+1, cfg->if_automatic_ports);
-					listening_ports_free(list);
-					return NULL;
-				}
-				now = after;
-				snprintf(portbuf, sizeof(portbuf), "%d", extraport);
-				if(do_ip6) {
-					hints.ai_family = AF_INET6;
-					if(!ports_create_if("::0",
-						do_auto, cfg->do_udp, do_tcp,
-						&hints, portbuf, &list,
-						cfg->so_rcvbuf, cfg->so_sndbuf,
-						cfg->ssl_port, cfg->tls_additional_port,
-						cfg->https_port, reuseport, cfg->ip_transparent,
-						cfg->tcp_mss, cfg->ip_freebind,
-						cfg->http_nodelay, cfg->use_systemd,
-						cfg->dnscrypt_port, cfg->ip_dscp)) {
-						listening_ports_free(list);
-						return NULL;
-					}
-				}
-				if(do_ip4) {
-					hints.ai_family = AF_INET;
-					if(!ports_create_if("0.0.0.0",
-						do_auto, cfg->do_udp, do_tcp,
-						&hints, portbuf, &list,
-						cfg->so_rcvbuf, cfg->so_sndbuf,
-						cfg->ssl_port, cfg->tls_additional_port,
-						cfg->https_port, reuseport, cfg->ip_transparent,
-						cfg->tcp_mss, cfg->ip_freebind,
-						cfg->http_nodelay, cfg->use_systemd,
-						cfg->dnscrypt_port, cfg->ip_dscp)) {
-						listening_ports_free(list);
-						return NULL;
-					}
-				}
-			}
-			return list;
-		}
 		if(do_ip6) {
 			hints.ai_family = AF_INET6;
 			if(!ports_create_if(do_auto?"::0":"::1", 
@@ -194,6 +194,8 @@ local_zone_create(uint8_t* nm, size_t len, int labs,
 	z->name = nm;
 	z->namelen = len;
 	z->namelabs = labs;
+	z->do_ede = -1; /* do not set EDE (RFC8914) (0/1 is set) */
+	z->default_ede = -1; /* do not overwrite EDE (RFC8914) codes */
 	lock_rw_init(&z->lock);
 	z->region = regional_create_nochunk(sizeof(struct regional));
 	if(!z->region) {
@@ -695,6 +697,177 @@ lz_enter_zone_tag(struct local_zones* zones, char* zname, uint8_t* list,
 	return r;
 }

+/** enter do-ede option into zone */
+static int
+lz_enter_respond_ede(struct local_zones* zones, char* zname, char* option)
+{
+	uint8_t dname[LDNS_MAX_DOMAINLEN+1];
+	size_t dname_len = sizeof(dname);
+	int dname_label_count;
+	struct local_zone* z;
+
+	/* parse zone name */
+	if(sldns_str2wire_dname_buf(zname, dname, &dname_len) != 0) {
+		log_err("cannot parse zone name in local-zone-do-ede: %s",
+			zname);
+		return 0;
+	}
+	dname_label_count = dname_count_labels(dname);
+
+	/* find localzone entry */
+	lock_rw_rdlock(&zones->lock);
+	z = local_zones_find(zones, dname,
+		    dname_len, dname_label_count, LDNS_RR_CLASS_IN);
+	if (!z) {
+		lock_rw_unlock(&zones->lock);
+		log_err("no local-zone for local-zone-do-ede: %s", zname);
+		return 0;
+	}
+
+	lock_rw_wrlock(&z->lock);
+	lock_rw_unlock(&zones->lock);
+
+	if (z->do_ede != -1) {
+		lock_rw_unlock(&z->lock);
+		log_err("duplicate local-zone-do-ede: %s", zname);
+		return 1;
+	}
+
+	/* parse option and check that the global default is also negative */
+	if ((strcmp(option, "no") == 0)) {
+		z->do_ede = 0;
+		lock_rw_unlock(&z->lock);
+		return 1;
+	}
+
+	z->do_ede = 1; /* respond with EDEs in this local-zone */
+	lock_rw_unlock(&z->lock);
+	return 1;
+}
+
+static int
+ede_string_to_sldns_ede_code(char* code)
+{
+	if (strcmp("other", code) == 0)
+		return LDNS_EDE_OTHER;
+	else if (strcmp("unsupported_dnskey_algorithm", code) == 0)
+		return LDNS_EDE_UNSUPPORTED_DNSKEY_ALG;
+	else if (strcmp("unsupported_ds_digest_type", code) == 0)
+		return LDNS_EDE_UNSUPPORTED_DS_DIGEST;
+	else if (strcmp("stale_answer", code) == 0)
+		return LDNS_EDE_STALE_ANSWER;
+	else if (strcmp("forged", code) == 0)
+		return LDNS_EDE_FORGED_ANSWER;
+	else if (strcmp("dnssec_indeterminate", code) == 0)
+		return LDNS_EDE_DNSSEC_INDETERMINATE;
+	else if (strcmp("dnssec_bogus", code) == 0)
+		return LDNS_EDE_DNSSEC_BOGUS;
+	else if (strcmp("signature_expired", code) == 0)
+		return LDNS_EDE_SIGNATURE_EXPIRED;
+	else if (strcmp("signature_not_yet_valid", code) == 0)
+		return LDNS_EDE_SIGNATURE_NOT_YET_VALID;
+	else if (strcmp("dnskey_missing", code) == 0)
+		return LDNS_EDE_DNSKEY_MISSING;
+	else if (strcmp("rrsigs_missing", code) == 0)
+		return LDNS_EDE_RRSIGS_MISSING;
+	else if (strcmp("no_zone_key_bit_set", code) == 0)
+		return LDNS_EDE_NO_ZONE_KEY_BIT_SET;
+	else if (strcmp("nsec_missing", code) == 0)
+		return LDNS_EDE_NSEC_MISSING;
+	else if (strcmp("cached_error", code) == 0)
+		return LDNS_EDE_CACHED_ERROR;
+	else if (strcmp("not_ready", code) == 0)
+		return LDNS_EDE_NOT_READY;
+	else if (strcmp("blocked", code) == 0)
+		return LDNS_EDE_BLOCKED;
+	else if (strcmp("censored", code) == 0)
+		return LDNS_EDE_CENSORED;
+	else if (strcmp("filtered", code) == 0)
+		return LDNS_EDE_FILTERED;
+	else if (strcmp("prohibited", code) == 0)
+		return LDNS_EDE_PROHIBITED;
+	else if (strcmp("stale_nxdomain_answer", code) == 0)
+		return LDNS_EDE_STALE_NXDOMAIN_ANSWER;
+	else if (strcmp("not_authoritative", code) == 0)
+		return LDNS_EDE_NOT_AUTHORITATIVE;
+	else if (strcmp("not_supported", code) == 0)
+		return LDNS_EDE_NOT_SUPPORTED;
+	else if (strcmp("no_reachable_authority", code) == 0)
+		return LDNS_EDE_NO_REACHABLE_AUTHORITY;
+	else if (strcmp("network_error", code) == 0)
+		return LDNS_EDE_NETWORK_ERROR;
+	else if (strcmp("invalid_data", code) == 0)
+		return LDNS_EDE_INVALID_DATA;
+
+	return -1;
+}
+
+static int
+lz_enter_default_ede_response(struct local_zones* zones, char* zname, char* code)
+{
+	uint8_t dname[LDNS_MAX_DOMAINLEN+1];
+	size_t dname_len = sizeof(dname);
+	int dname_label_count;
+	struct local_zone* z;
+	int default_ede;
+
+	/* parse zone name */
+	if(sldns_str2wire_dname_buf(zname, dname, &dname_len) != 0) {
+		log_err("cannot parse zone name in local-zone-default-ede: %s",
+			zname);
+		return 0;
+	}
+	dname_label_count = dname_count_labels(dname);
+
+	/* parse option in case of a textual string or integer value */
+	if (atoi(code) != 0) {
+		default_ede = (int) ede_string_to_sldns_ede_code(code);
+		if (default_ede == -1) {
+			log_err("incorect EDE code string found for "
+					"local-zone-default-ede: %s", zname);
+			return 0;
+		}
+	} else {
+		int tmp = atoi(code);
+		if (!(tmp >= 0 && tmp < 65635)) {
+			log_err("incorrect EDE code integer value for"
+					"local-zone-default-ede: %s", zname);
+			return 0;
+		}
+		default_ede = tmp;
+	}
+
+	/* find localzone entry */
+	lock_rw_rdlock(&zones->lock);
+	z = local_zones_find(zones, dname,
+		    dname_len, dname_label_count, LDNS_RR_CLASS_IN);
+	if(!z) {
+		lock_rw_unlock(&zones->lock);
+		log_err("no local-zone for local-zone-default-ede: %s", zname);
+		return 0;
+	}
+	lock_rw_wrlock(&z->lock);
+	lock_rw_unlock(&zones->lock);
+
+	if (z->default_ede) {
+		lock_rw_unlock(&z->lock);
+		log_err("duplicate local-zone-default-ede: %s", zname);
+		return 1;
+	}
+
+	if (!(z->default_ede >= 0)) {
+		lock_rw_unlock(&z->lock);
+		log_err("default-ede set for zone that does not have"
+				"local-zone-do-ede enabled: %s", zname);
+		return 1;
+	}
+
+	z->default_ede = default_ede; /* respond with EDEs in this local-zone */
+	lock_rw_unlock(&z->lock);
+	return 1;
+}
+
+
 /** enter override into zone */
 static int
 lz_enter_override(struct local_zones* zones, char* zname, char* netblock,
@@ -981,6 +1154,30 @@ lz_enter_overrides(struct local_zones* zones, struct config_file* cfg)
 	return 1;
 }

+/** parse local-zone-do-ede: statements */
+static int
+lz_enter_respond_ede_zones(struct local_zones* zones, struct config_file* cfg)
+{
+	struct config_str2list* p;
+	for(p = cfg->local_zone_do_ede; p; p = p->next) {
+		if(!lz_enter_respond_ede(zones, p->str, p->str2))
+			return 0;
+	}
+	return 1;
+}
+
+/** parse local_zone_default_ede: statements */
+static int
+lz_enter_default_ede_response_zones(struct local_zones* zones, struct config_file* cfg)
+{
+	struct config_str2list* p;
+	for(p = cfg->local_zone_default_ede; p; p = p->next) {
+		if(!lz_enter_default_ede_response(zones, p->str, p->str2))
+			return 0;
+	}
+	return 1;
+}
+
 /** setup parent pointers, so that a lookup can be done for closest match */
 static void
 init_parents(struct local_zones* zones)
@@ -1194,6 +1391,15 @@ local_zones_apply_cfg(struct local_zones* zones, struct config_file* cfg)
 	if(!lz_enter_overrides(zones, cfg)) {
 		return 0;
 	}
+	/* enter EDE (RFC8914) response options for local zones */
+	if(!lz_enter_respond_ede_zones(zones, cfg)) {
+		return 0;
+	}
+	/* enter default EDE (RFC8914) response options for local zones */
+	if(!lz_enter_default_ede_response_zones(zones, cfg)) {
+		return 0;
+	}
+
 	/* create implicit transparent zone from data. */
 	if(!lz_setup_implicit(zones, cfg)) {
 		return 0;
@@ -1324,12 +1530,65 @@ local_encode(struct query_info* qinfo, struct module_env* env,
 	return 1;
 }

+/** encode answer consisting of 1 rrset (with EDE code) */
+static int
+local_encode_ede(struct local_zone* zone, struct query_info* qinfo,
+	struct module_env* env, struct edns_data* edns,
+	struct comm_reply* repinfo, sldns_buffer* buf, struct regional* temp,
+	struct ub_packed_rrset_key* rrset, int ansec, int rcode,
+	sldns_ede_code ede_code, const char* ede_txt, int do_ede)
+{
+	struct reply_info rep;
+	uint16_t udpsize;
+
+	/* make answer with time=0 for fixed TTL values */
+	memset(&rep, 0, sizeof(rep));
+	rep.flags = (uint16_t)((BIT_QR | BIT_AA | BIT_RA) | rcode);
+	rep.qdcount = 1;
+	if(ansec)
+		rep.an_numrrsets = 1;
+	else	rep.ns_numrrsets = 1;
+	rep.rrset_count = 1;
+	rep.rrsets = &rrset;
+	udpsize = edns->udp_size;
+	edns->edns_version = EDNS_ADVERTISED_VERSION;
+	edns->udp_size = EDNS_ADVERTISED_SIZE;
+	edns->ext_rcode = 0;
+	edns->bits &= EDNS_DO;
+	if(!inplace_cb_reply_local_call(env, qinfo, NULL, &rep, rcode, edns,
+		repinfo, temp, env->now_tv)) {
+		error_encode(buf, (LDNS_RCODE_SERVFAIL|BIT_AA), qinfo,
+			*(uint16_t*)sldns_buffer_begin(buf),
+			sldns_buffer_read_u16_at(buf, 2), edns);
+		return 1;
+	}
+	/* check global and local-zone EDE settings */
+	if (do_ede == 1 ||                     /* local precedes global */
+		(do_ede == -1 &&
+		 env->cfg->ede_local_zones == 1)){ /* global set, but local not */
+
+		if (zone != NULL && zone->default_ede != -1)
+			ede_code = zone->default_ede;
+
+		edns_opt_list_append_ede(&edns->opt_list_out, temp, ede_code, ede_txt);
+	}
+	if(!reply_info_answer_encode(qinfo, &rep,
+		*(uint16_t*)sldns_buffer_begin(buf), sldns_buffer_read_u16_at(buf, 2),
+		buf, 0, 0, temp, udpsize, edns, (int)(edns->bits&EDNS_DO), 0)) {
+		error_encode(buf, (LDNS_RCODE_SERVFAIL|BIT_AA), qinfo,
+			*(uint16_t*)sldns_buffer_begin(buf),
+			sldns_buffer_read_u16_at(buf, 2), edns);
+	}
+	return 1;
+}
+
 /** encode local error answer */
 static void
-local_error_encode(struct query_info* qinfo, struct module_env* env,
-	struct edns_data* edns, struct comm_reply* repinfo, sldns_buffer* buf,
-	struct regional* temp, int rcode, int r, int ede_code,
-	const char* ede_txt)
+local_error_encode(struct local_zone* zone, struct query_info* qinfo,
+	struct module_env* env, struct edns_data* edns,
+	struct comm_reply* repinfo, sldns_buffer* buf, struct regional* temp,
+	int rcode, int r, sldns_ede_code ede_code, const char* ede_txt,
+	int do_ede)
 {
 	edns->edns_version = EDNS_ADVERTISED_VERSION;
 	edns->udp_size = EDNS_ADVERTISED_SIZE;
@@ -1339,12 +1598,16 @@ local_error_encode(struct query_info* qinfo, struct module_env* env,
 	if(!inplace_cb_reply_local_call(env, qinfo, NULL, NULL,
 		rcode, edns, repinfo, temp, env->now_tv))
 		edns->opt_list_inplace_cb_out = NULL;
+	/* check global and local-zone ede settings */
+	if (do_ede == 1 ||                     /* local precedes global */
+		(do_ede == -1 &&
+		 env->cfg->ede_local_zones == 1)){ /* global set, but local not */

-	if(ede_code != LDNS_EDE_NONE && env->cfg->ede) {
-		edns_opt_list_append_ede(&edns->opt_list_out, temp,
-			ede_code, ede_txt);
+		if (zone != NULL && zone->default_ede != -1)
+			ede_code = zone->default_ede;
+
+		edns_opt_list_append_ede(&edns->opt_list_out, temp, ede_code, ede_txt);
 	}
-
 	error_encode(buf, r, qinfo, *(uint16_t*)sldns_buffer_begin(buf),
 		sldns_buffer_read_u16_at(buf, 2), edns);
 }
@@ -1467,7 +1730,7 @@ local_data_answer(struct local_zone* z, struct module_env* env,
 	struct comm_reply* repinfo, sldns_buffer* buf,
 	struct regional* temp, int labs, struct local_data** ldp,
 	enum localzone_type lz_type, int tag, struct config_strlist** tag_datas,
-	size_t tag_datas_size, char** tagname, int num_tags)
+	size_t tag_datas_size, char** tagname, int num_tags, int do_ede)
 {
 	struct local_data key;
 	struct local_data* ld;
@@ -1540,11 +1803,11 @@ local_data_answer(struct local_zone* z, struct module_env* env,

 			if(newtargetlen > LDNS_MAX_DOMAINLEN) {
 				qinfo->local_alias = NULL;
-				local_error_encode(qinfo, env, edns, repinfo,
+				local_error_encode(z, qinfo, env, edns,repinfo,
 					buf, temp, LDNS_RCODE_YXDOMAIN,
 					(LDNS_RCODE_YXDOMAIN|BIT_AA),
 					LDNS_EDE_OTHER,
-					"DNAME expansion became too large");
+					"DNAME expansion became too large", do_ede);
 				return 1;
 			}
 			memset(&qinfo->local_alias->rrset->entry, 0,
@@ -1589,8 +1852,8 @@ local_data_answer(struct local_zone* z, struct module_env* env,
 		return local_encode(qinfo, env, edns, repinfo, buf, temp, &r, 1,
 			LDNS_RCODE_NOERROR);
 	}
-	return local_encode(qinfo, env, edns, repinfo, buf, temp, lr->rrset, 1,
-		LDNS_RCODE_NOERROR);
+	return local_encode_ede(z, qinfo, env, edns, repinfo, buf, temp, lr->rrset, 1,
+		LDNS_RCODE_NOERROR, LDNS_EDE_FORGED_ANSWER, "", do_ede);
 }

 /**
@@ -1635,7 +1898,7 @@ int
 local_zones_zone_answer(struct local_zone* z, struct module_env* env,
 	struct query_info* qinfo, struct edns_data* edns,
 	struct comm_reply* repinfo, sldns_buffer* buf, struct regional* temp,
-	struct local_data* ld, enum localzone_type lz_type)
+	struct local_data* ld, enum localzone_type lz_type, int do_ede)
 {
 	if(lz_type == local_zone_deny ||
 		lz_type == local_zone_always_deny ||
@@ -1646,9 +1909,9 @@ local_zones_zone_answer(struct local_zone* z, struct module_env* env,
 		return 1;
 	} else if(lz_type == local_zone_refuse
 		|| lz_type == local_zone_always_refuse) {
-		local_error_encode(qinfo, env, edns, repinfo, buf, temp,
+		local_error_encode(z, qinfo, env, edns, repinfo, buf, temp,
 			LDNS_RCODE_REFUSED, (LDNS_RCODE_REFUSED|BIT_AA),
-			LDNS_EDE_NONE, NULL);
+			LDNS_EDE_BLOCKED, "", do_ede);
 		return 1;
 	} else if(lz_type == local_zone_static ||
 		lz_type == local_zone_redirect ||
@@ -1673,8 +1936,8 @@ local_zones_zone_answer(struct local_zone* z, struct module_env* env,
 		if(z != NULL && z->soa && z->soa_negative)
 			return local_encode(qinfo, env, edns, repinfo, buf, temp,
 				z->soa_negative, 0, rcode);
-		local_error_encode(qinfo, env, edns, repinfo, buf, temp,
-			rcode, (rcode|BIT_AA), LDNS_EDE_NONE, NULL);
+		local_error_encode(z, qinfo, env, edns, repinfo, buf, temp,
+			rcode, (rcode|BIT_AA), LDNS_EDE_BLOCKED, "", do_ede);
 		return 1;
 	} else if(lz_type == local_zone_typetransparent
 		|| lz_type == local_zone_always_transparent) {
@@ -1712,16 +1975,17 @@ local_zones_zone_answer(struct local_zone* z, struct module_env* env,
 			d.rr_len = &rr_len;
 			d.rr_data = &rr_datas;
 			d.rr_ttl = &rr_ttl;
-			return local_encode(qinfo, env, edns, repinfo, buf, temp,
-				&lrr, 1, LDNS_RCODE_NOERROR);
+			return local_encode_ede(z, qinfo, env, edns, repinfo, buf, temp,
+				&lrr, 1, LDNS_RCODE_NOERROR, LDNS_EDE_FORGED_ANSWER, "", do_ede);
 		} else {
 			/* NODATA: No EDE needed */
-			local_error_encode(qinfo, env, edns, repinfo, buf,
+			local_error_encode(z, qinfo, env, edns, repinfo, buf,
 				temp, LDNS_RCODE_NOERROR,
-				(LDNS_RCODE_NOERROR|BIT_AA), -1, NULL);
+				(LDNS_RCODE_NOERROR|BIT_AA), -1, NULL, 0);
 		}
 		return 1;
 	}
+
 	/* else lz_type == local_zone_transparent */

 	/* if the zone is transparent and the name exists, but the type
@@ -1732,8 +1996,8 @@ local_zones_zone_answer(struct local_zone* z, struct module_env* env,
 			return local_encode(qinfo, env, edns, repinfo, buf, temp,
 				z->soa_negative, 0, rcode);
 		/* NODATA: No EDE needed */
-		local_error_encode(qinfo, env, edns, repinfo, buf, temp, rcode,
-			(rcode|BIT_AA), LDNS_EDE_NONE, NULL);
+		local_error_encode(z, qinfo, env, edns, repinfo, buf, temp, rcode,
+			(rcode|BIT_AA), -1, NULL, 0);
 		return 1;
 	}

@@ -1896,13 +2160,15 @@ local_zones_answer(struct local_zones* zones, struct module_env* env,
 		&& lzt != local_zone_always_nodata
 		&& lzt != local_zone_always_deny
 		&& local_data_answer(z, env, qinfo, edns, repinfo, buf, temp, labs,
-			&ld, lzt, tag, tag_datas, tag_datas_size, tagname, num_tags)) {
+			&ld, lzt, tag, tag_datas, tag_datas_size, tagname, num_tags,
+			z->do_ede)) {
 		lock_rw_unlock(&z->lock);
 		/* We should tell the caller that encode is deferred if we found
 		 * a local alias. */
 		return !qinfo->local_alias;
 	}
-	r = local_zones_zone_answer(z, env, qinfo, edns, repinfo, buf, temp, ld, lzt);
+	r = local_zones_zone_answer(z, env, qinfo, edns, repinfo, buf, temp, ld,
+			lzt, z->do_ede);
 	lock_rw_unlock(&z->lock);
 	return r && !qinfo->local_alias; /* see above */
 }
@@ -47,6 +47,7 @@
 #include "util/module.h"
 #include "services/view.h"
 #include "sldns/sbuffer.h"
+#include "sldns/rrdef.h"
 struct packed_rrset_data;
 struct ub_packed_rrset_key;
 struct regional;
@@ -164,6 +165,10 @@ struct local_zone {
 	 * artificial negative SOA rrset (TTL is the minimum of the TTL and the
 	 * SOA.MINIMUM). */
 	struct ub_packed_rrset_key* soa_negative;
+        /** should local_data result in EDE (RFC8914) code inclusion? */
+        int do_ede;
+        /** the default EDE (RFC8914) code for this zone */
+        int default_ede;
 };

 /**
@@ -343,7 +348,8 @@ int
 local_zones_zone_answer(struct local_zone* z, struct module_env* env,
 	struct query_info* qinfo, struct edns_data* edns,
 	struct comm_reply* repinfo, sldns_buffer* buf, struct regional* temp,
-	struct local_data* ld, enum localzone_type lz_type);
+	struct local_data* ld, enum localzone_type lz_type,
+        int do_ede);

 /**
 * Parse the string into localzone type.
@@ -608,7 +614,7 @@ local_data_answer(struct local_zone* z, struct module_env* env,
 	struct comm_reply* repinfo, sldns_buffer* buf,
 	struct regional* temp, int labs, struct local_data** ldp,
 	enum localzone_type lz_type, int tag, struct config_strlist** tag_datas,
-	size_t tag_datas_size, char** tagname, int num_tags);
+	size_t tag_datas_size, char** tagname, int num_tags, int do_ede);

 /**
 * Add RR to local zone.
@@ -64,11 +64,6 @@
 #include "respip/respip.h"
 #include "services/listen_dnsport.h"

-#ifdef CLIENT_SUBNET
-#include "edns-subnet/subnetmod.h"
-#include "edns-subnet/edns-subnet.h"
-#endif
-
 /** subtract timers and the values do not overflow or become negative */
 static void
 timeval_subtract(struct timeval* d, const struct timeval* end, const struct timeval* start)
@@ -463,8 +458,7 @@ mesh_serve_expired_init(struct mesh_state* mstate, int timeout)

 void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 	struct respip_client_info* cinfo, uint16_t qflags,
-	struct edns_data* edns, struct comm_reply* rep, uint16_t qid,
-	int rpz_passthru)
+	struct edns_data* edns, struct comm_reply* rep, uint16_t qid)
 {
 	struct mesh_state* s = NULL;
 	int unique = unique_mesh_state(edns->opt_list_in, mesh->env);
@@ -519,7 +513,6 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 		}
 		if(unique)
 			mesh_state_make_unique(s);
-		s->s.rpz_passthru = rpz_passthru;
 		/* copy the edns options we got from the front */
 		if(edns->opt_list_in) {
 			s->s.edns_opts_front_in = edns_opt_copy_region(edns->opt_list_in,
@@ -613,7 +606,7 @@ servfail_mem:
 int 
 mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo,
 	uint16_t qflags, struct edns_data* edns, sldns_buffer* buf, 
-	uint16_t qid, mesh_cb_func_type cb, void* cb_arg, int rpz_passthru)
+	uint16_t qid, mesh_cb_func_type cb, void* cb_arg)
 {
 	struct mesh_state* s = NULL;
 	int unique = unique_mesh_state(edns->opt_list_in, mesh->env);
@@ -639,7 +632,6 @@ mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo,
 		}
 		if(unique)
 			mesh_state_make_unique(s);
-		s->s.rpz_passthru = rpz_passthru;
 		if(edns->opt_list_in) {
 			s->s.edns_opts_front_in = edns_opt_copy_region(edns->opt_list_in,
 				s->s.region);
@@ -694,8 +686,7 @@ mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo,
 * 0 (false), in which case the new state is only made runnable so it
 * will not be run recursively on top of the current state. */
 static void mesh_schedule_prefetch(struct mesh_area* mesh,
-	struct query_info* qinfo, uint16_t qflags, time_t leeway, int run,
-	int rpz_passthru)
+	struct query_info* qinfo, uint16_t qflags, time_t leeway, int run)
 {
 	struct mesh_state* s = mesh_area_find(mesh, NULL, qinfo,
 		qflags&(BIT_RD|BIT_CD), 0, 0);
@@ -741,16 +732,15 @@ static void mesh_schedule_prefetch(struct mesh_area* mesh,
 		/* move to either the forever or the jostle_list */
 		if(mesh->num_forever_states < mesh->max_forever_states) {
 			mesh->num_forever_states ++;
-			mesh_list_insert(s, &mesh->forever_first,
+			mesh_list_insert(s, &mesh->forever_first, 
 				&mesh->forever_last);
 			s->list_select = mesh_forever_list;
 		} else {
-			mesh_list_insert(s, &mesh->jostle_first,
+			mesh_list_insert(s, &mesh->jostle_first, 
 				&mesh->jostle_last);
 			s->list_select = mesh_jostle_list;
 		}
 	}
-	s->s.rpz_passthru = rpz_passthru;

 	if(!run) {
 #ifdef UNBOUND_DEBUG
@@ -766,115 +756,10 @@ static void mesh_schedule_prefetch(struct mesh_area* mesh,
 	mesh_run(mesh, s, module_event_new, NULL);
 }

-#ifdef CLIENT_SUBNET
-/* Same logic as mesh_schedule_prefetch but tailored to the subnet module logic
- * like passing along the comm_reply info. This will be faked into an EDNS
- * option for processing by the subnet module if the client has not already
- * attached its own ECS data. */
-static void mesh_schedule_prefetch_subnet(struct mesh_area* mesh,
-	struct query_info* qinfo, uint16_t qflags, time_t leeway, int run,
-	int rpz_passthru, struct comm_reply* rep, struct edns_option* edns_list)
-{
-	struct mesh_state* s = NULL;
-	struct edns_option* opt = NULL;
-#ifdef UNBOUND_DEBUG
-	struct rbnode_type* n;
-#endif
-	if(!mesh_make_new_space(mesh, NULL)) {
-		verbose(VERB_ALGO, "Too many queries. dropped prefetch.");
-		mesh->stats_dropped ++;
-		return;
-	}
-
-	s = mesh_state_create(mesh->env, qinfo, NULL,
-		qflags&(BIT_RD|BIT_CD), 0, 0);
-	if(!s) {
-		log_err("prefetch_subnet mesh_state_create: out of memory");
-		return;
-	}
-	mesh_state_make_unique(s);
-
-	opt = edns_opt_list_find(edns_list, mesh->env->cfg->client_subnet_opcode);
-	if(opt) {
-		/* Use the client's ECS data */
-		if(!edns_opt_list_append(&s->s.edns_opts_front_in, opt->opt_code,
-			opt->opt_len, opt->opt_data, s->s.region)) {
-			log_err("prefetch_subnet edns_opt_list_append: out of memory");
-			return;
-		}
-	} else {
-		/* Fake the ECS data from the client's IP */
-		struct ecs_data ecs;
-		memset(&ecs, 0, sizeof(ecs));
-		subnet_option_from_ss(&rep->addr, &ecs, mesh->env->cfg);
-		if(ecs.subnet_validdata == 0) {
-			log_err("prefetch_subnet subnet_option_from_ss: invalid data");
-			return;
-		}
-		subnet_ecs_opt_list_append(&ecs, &s->s.edns_opts_front_in,
-			&s->s, s->s.region);
-		if(!s->s.edns_opts_front_in) {
-			log_err("prefetch_subnet subnet_ecs_opt_list_append: out of memory");
-			return;
-		}
-	}
-#ifdef UNBOUND_DEBUG
-	n =
-#else
-	(void)
-#endif
-	rbtree_insert(&mesh->all, &s->node);
-	log_assert(n != NULL);
-	/* set detached (it is now) */
-	mesh->num_detached_states++;
-	/* make it ignore the cache */
-	sock_list_insert(&s->s.blacklist, NULL, 0, s->s.region);
-	s->s.prefetch_leeway = leeway;
-
-	if(s->list_select == mesh_no_list) {
-		/* move to either the forever or the jostle_list */
-		if(mesh->num_forever_states < mesh->max_forever_states) {
-			mesh->num_forever_states ++;
-			mesh_list_insert(s, &mesh->forever_first,
-				&mesh->forever_last);
-			s->list_select = mesh_forever_list;
-		} else {
-			mesh_list_insert(s, &mesh->jostle_first,
-				&mesh->jostle_last);
-			s->list_select = mesh_jostle_list;
-		}
-	}
-	s->s.rpz_passthru = rpz_passthru;
-
-	if(!run) {
-#ifdef UNBOUND_DEBUG
-		n =
-#else
-		(void)
-#endif
-		rbtree_insert(&mesh->run, &s->run_node);
-		log_assert(n != NULL);
-		return;
-	}
-
-	mesh_run(mesh, s, module_event_new, NULL);
-}
-#endif /* CLIENT_SUBNET */
-
 void mesh_new_prefetch(struct mesh_area* mesh, struct query_info* qinfo,
-	uint16_t qflags, time_t leeway, int rpz_passthru,
-	struct comm_reply* rep, struct edns_option* opt_list)
+        uint16_t qflags, time_t leeway)
 {
-	(void)opt_list;
-	(void)rep;
-#ifdef CLIENT_SUBNET
-	if(rep)
-		mesh_schedule_prefetch_subnet(mesh, qinfo, qflags, leeway, 1,
-			rpz_passthru, rep, opt_list);
-	else
-#endif
-		mesh_schedule_prefetch(mesh, qinfo, qflags, leeway, 1,
-			rpz_passthru);
+	mesh_schedule_prefetch(mesh, qinfo, qflags, leeway, 1);
 }

 void mesh_report_reply(struct mesh_area* mesh, struct outbound_entry* e,
@@ -954,7 +839,6 @@ mesh_state_create(struct module_env* env, struct query_info* qinfo,
 	mstate->s.no_cache_store = 0;
 	mstate->s.need_refetch = 0;
 	mstate->s.was_ratelimited = 0;
-	mstate->s.qstarttime = *env->now;

 	/* init modules */
 	for(i=0; i<env->mesh->mods.num; i++) {
@@ -1350,7 +1234,7 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
 		(rep->security <= sec_status_bogus ||
 		rep->security == sec_status_secure_sentinel_fail)) {
 		rcode = LDNS_RCODE_SERVFAIL;
-		if(m->s.env->cfg->stat_extended)
+		if(m->s.env->cfg->stat_extended) 
 			m->s.env->mesh->ans_bogus++;
 	}
 	if(rep && rep->security == sec_status_secure)
@@ -1407,33 +1291,19 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
 					r->edns.opt_list_inplace_cb_out = NULL;
 		}
 		/* Send along EDE BOGUS EDNS0 option when answer is bogus */
-		if(m->s.env->cfg->ede && rcode == LDNS_RCODE_SERVFAIL &&
+		if(rcode == LDNS_RCODE_SERVFAIL &&
 			m->s.env->need_to_validate && (!(r->qflags&BIT_CD) ||
 			m->s.env->cfg->ignore_cd) && rep &&
 			(rep->security <= sec_status_bogus ||
 			rep->security == sec_status_secure_sentinel_fail)) {
+
 			char *reason = m->s.env->cfg->val_log_level >= 2
-				? errinf_to_str_bogus(&m->s) : NULL;
+			             ? errinf_to_str_bogus(&m->s) : NULL;
+			sldns_ede_code reason_bogus = rep->reason_bogus != LDNS_EDE_DNSSEC_BOGUS
+			                            ? rep->reason_bogus : errinf_to_reason_bogus(&m->s);

-			/* During validation the EDE code can be received via two
-			 * code paths. One code path fills the reply_info EDE, and
-			 * the other fills it in the errinf_strlist. These paths
-			 * intersect at some points, but where is opaque due to
-			 * the complexity of the validator. At the time of writing
-			 * we make the choice to prefer the EDE from errinf_strlist
-			 * but a compelling reason to do otherwise is just as valid
-			 */
-			sldns_ede_code reason_bogus = errinf_to_reason_bogus(&m->s);
-			if ((reason_bogus == LDNS_EDE_DNSSEC_BOGUS &&
-				rep->reason_bogus != LDNS_EDE_NONE) ||
-				reason_bogus == LDNS_EDE_NONE) {
-					reason_bogus = rep->reason_bogus;
-			}
-
-			if(reason_bogus != LDNS_EDE_NONE) {
-				edns_opt_list_append_ede(&r->edns.opt_list_out,
-					m->s.region, reason_bogus, reason);
-			}
+			edns_opt_list_append_ede(&r->edns.opt_list_out, m->s.region,
+					reason_bogus, reason);
 			free(reason);
 		}
 		error_encode(r_buffer, rcode, &m->s.qinfo, r->qid,
@@ -1672,7 +1542,7 @@ int mesh_state_add_reply(struct mesh_state* s, struct edns_data* edns,
        struct comm_reply* rep, uint16_t qid, uint16_t qflags,
        const struct query_info* qinfo)
 {
-	struct mesh_reply* r = regional_alloc(s->s.region,
+	struct mesh_reply* r = regional_alloc(s->s.region, 
 		sizeof(struct mesh_reply));
 	if(!r)
 		return 0;
@@ -1841,7 +1711,6 @@ mesh_continue(struct mesh_area* mesh, struct mesh_state* mstate,
 		if(mstate->s.curmod == 0) {
 			struct query_info* qinfo = NULL;
 			uint16_t qflags;
-			int rpz_p = 0;

 			mesh_query_done(mstate);
 			mesh_walk_supers(mesh, mstate);
@@ -1850,15 +1719,13 @@ mesh_continue(struct mesh_area* mesh, struct mesh_state* mstate,
 			 * from an external DNS server, we'll need to schedule
 			 * a prefetch after removing the current state, so
 			 * we need to make a copy of the query info here. */
-			if(mstate->s.need_refetch) {
+			if(mstate->s.need_refetch)
 				mesh_copy_qinfo(mstate, &qinfo, &qflags);
-				rpz_p = mstate->s.rpz_passthru;
-			}

 			mesh_state_delete(&mstate->s);
 			if(qinfo) {
 				mesh_schedule_prefetch(mesh, qinfo, qflags,
-					0, 1, rpz_p);
+					0, 1);
 			}
 			return 0;
 		}
@@ -2068,7 +1935,7 @@ apply_respip_action(struct module_qstate* qstate,
 		return 1;

 	if(!respip_rewrite_reply(qinfo, cinfo, rep, encode_repp, actinfo,
-		alias_rrset, 0, qstate->region, az, NULL))
+		alias_rrset, 0, qstate->region, az))
 		return 0;

 	/* xxx_deny actions mean dropping the reply, unless the original reply
@@ -2193,14 +2060,6 @@ mesh_serve_expired_callback(void* arg)
 			}
 		}

-		/* Add EDE Stale Answer (RCF8914). Ignore global ede as this is
-		 * warning instead of an error */
-		if (r->edns.edns_present && qstate->env->cfg->ede_serve_expired &&
-			qstate->env->cfg->ede) {
-			edns_opt_list_append_ede(&r->edns.opt_list_out,
-				mstate->s.region, LDNS_EDE_STALE_ANSWER, NULL);
-		}
-
 		r_buffer = r->query_reply.c->buffer;
 		if(r->query_reply.c->tcp_req_info)
 			r_buffer = r->query_reply.c->tcp_req_info->spool_buffer;
@@ -296,13 +296,10 @@ void mesh_delete(struct mesh_area* mesh);
 * @param edns: edns data from client query.
 * @param rep: where to reply to.
 * @param qid: query id to reply with.
- * @param rpz_passthru: if true, the rpz passthru was previously found and
- * 	further rpz processing is stopped.
 */
 void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 	struct respip_client_info* cinfo, uint16_t qflags,
-	struct edns_data* edns, struct comm_reply* rep, uint16_t qid,
-	int rpz_passthru);
+	struct edns_data* edns, struct comm_reply* rep, uint16_t qid);

 /**
 * New query with callback. Create new query state if needed, and
@@ -317,13 +314,11 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 * @param qid: query id to reply with.
 * @param cb: callback function.
 * @param cb_arg: callback user arg.
- * @param rpz_passthru: if true, the rpz passthru was previously found and
- * 	further rpz processing is stopped.
 * @return 0 on error.
 */
 int mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo,
 	uint16_t qflags, struct edns_data* edns, struct sldns_buffer* buf, 
-	uint16_t qid, mesh_cb_func_type cb, void* cb_arg, int rpz_passthru);
+	uint16_t qid, mesh_cb_func_type cb, void* cb_arg);

 /**
 * New prefetch message. Create new query state if needed.
@@ -333,15 +328,9 @@ int mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo,
 * @param qinfo: query from client.
 * @param qflags: flags from client query.
 * @param leeway: TTL leeway what to expire earlier for this update.
- * @param rpz_passthru: if true, the rpz passthru was previously found and
- * 	further rpz processing is stopped.
- * @param rep: comm_reply for the client; to be used when subnet is enabled.
- * @param opt_list: edns opt_list from the client; to be used when subnet is
- *	enabled.
 */
 void mesh_new_prefetch(struct mesh_area* mesh, struct query_info* qinfo,
-	uint16_t qflags, time_t leeway, int rpz_passthru,
-	struct comm_reply* rep, struct edns_option* opt_list);
+	uint16_t qflags, time_t leeway);

 /**
 * Handle new event from the wire. A serviced query has returned.
@@ -94,16 +94,6 @@ static void waiting_list_remove(struct outside_network* outnet,
 static uint16_t tcp_select_id(struct outside_network* outnet,
 	struct reuse_tcp* reuse);

-/** Perform serviced query UDP sending operation */
-static int serviced_udp_send(struct serviced_query* sq, sldns_buffer* buff);
-
-/** Send serviced query over TCP return false on initial failure */
-static int serviced_tcp_send(struct serviced_query* sq, sldns_buffer* buff);
-
-/** call the callbacks for a serviced query */
-static void serviced_callbacks(struct serviced_query* sq, int error,
-	struct comm_point* c, struct comm_reply* rep);
-
 int 
 pending_cmp(const void* key1, const void* key2)
 {
@@ -271,7 +261,7 @@ outnet_get_tcp_fd(struct sockaddr_storage* addr, socklen_t addrlen, int tcp_mss,
 	int s;
 	int af;
 	char* err;
-#if defined(SO_REUSEADDR) || defined(IP_BIND_ADDRESS_NO_PORT)
+#ifdef SO_REUSEADDR
 	int on = 1;
 #endif
 #ifdef INET6
@@ -317,13 +307,7 @@ outnet_get_tcp_fd(struct sockaddr_storage* addr, socklen_t addrlen, int tcp_mss,
 			" setsockopt(TCP_MAXSEG) unsupported");
 #endif /* defined(IPPROTO_TCP) && defined(TCP_MAXSEG) */
 	}
-#ifdef IP_BIND_ADDRESS_NO_PORT
-	if(setsockopt(s, IPPROTO_IP, IP_BIND_ADDRESS_NO_PORT, (void*)&on,
-		(socklen_t)sizeof(on)) < 0) {
-		verbose(VERB_ALGO, "outgoing tcp:"
-			" setsockopt(.. IP_BIND_ADDRESS_NO_PORT ..) failed");
-	}
-#endif /* IP_BIND_ADDRESS_NO_PORT */
+
 	return s;
 }

@@ -852,7 +836,6 @@ outnet_add_tcp_waiting_first(struct outside_network* outnet,
 	if(w->on_tcp_waiting_list)
 		return;
 	w->next_waiting = outnet->tcp_wait_first;
-	log_assert(w->next_waiting != w);
 	if(!outnet->tcp_wait_last)
 		outnet->tcp_wait_last = w;
 	outnet->tcp_wait_first = w;
@@ -1153,22 +1136,6 @@ static void reuse_cb_readwait_for_failure(rbtree_type* tree_by_id, int err)
 	}
 }

-/** mark the entry for being in the cb_and_decommission stage */
-static void mark_for_cb_and_decommission(rbnode_type* node,
-	void* ATTR_UNUSED(arg))
-{
-	struct waiting_tcp* w = (struct waiting_tcp*)node->key;
-	/* Mark the waiting_tcp to signal later code (serviced_delete) that
-	 * this item is part of the backed up tree_by_id and will be deleted
-	 * later. */
-	w->in_cb_and_decommission = 1;
-	/* Mark the serviced_query for deletion so that later code through
-	 * callbacks (iter_clear .. outnet_serviced_query_stop) won't
-	 * prematurely delete it. */
-	if(w->cb)
-		((struct serviced_query*)w->cb_arg)->to_be_deleted = 1;
-}
-
 /** perform callbacks for failure and also decommission pending tcp.
 * the callbacks remove references in sq->pending to the waiting_tcp
 * members of the tree_by_id in the pending tcp.  The pending_tcp is
@@ -1184,9 +1151,6 @@ static void reuse_cb_and_decommission(struct outside_network* outnet,
 	pend->reuse.write_wait_first = NULL;
 	pend->reuse.write_wait_last = NULL;
 	decommission_pending_tcp(outnet, pend);
-	if(store.root != NULL && store.root != RBTREE_NULL) {
-		traverse_postorder(&store, &mark_for_cb_and_decommission, NULL);
-	}
 	reuse_cb_readwait_for_failure(&store, error);
 	reuse_del_readwait(&store);
 }
@@ -1284,12 +1248,6 @@ outnet_tcp_cb(struct comm_point* c, void* arg, int error,
 				c->buffer));
 			/* find the query the reply is for */
 			w = reuse_tcp_by_id_find(&pend->reuse, id);
-			/* Make sure that the reply we got is at least for a
-			 * sent query with the same ID; the waiting_tcp that
-			 * gets a reply is assumed to not be waiting to be
-			 * sent. */
-			if(w && (w->on_tcp_waiting_list || w->write_wait_queued))
-				w = NULL;
 		}
 	}
 	if(error == NETEVENT_NOERROR && !w) {
@@ -1307,8 +1265,6 @@ outnet_tcp_cb(struct comm_point* c, void* arg, int error,
 		}
 	}
 	if(w) {
-		log_assert(!w->on_tcp_waiting_list);
-		log_assert(!w->write_wait_queued);
 		reuse_tree_by_id_delete(&pend->reuse, w);
 		verbose(VERB_CLIENT, "outnet tcp callback query err %d buflen %d",
 			error, (int)sldns_buffer_limit(c->buffer));
@@ -1368,7 +1324,7 @@ outnet_send_wait_udp(struct outside_network* outnet)
 {
 	struct pending* pend;
 	/* process waiting queries */
-	while(outnet->udp_wait_first && outnet->unused_fds
+	while(outnet->udp_wait_first && outnet->unused_fds 
 		&& !outnet->want_to_quit) {
 		pend = outnet->udp_wait_first;
 		outnet->udp_wait_first = pend->next_waiting;
@@ -1377,10 +1333,8 @@ outnet_send_wait_udp(struct outside_network* outnet)
 		sldns_buffer_write(outnet->udp_buff, pend->pkt, pend->pkt_len);
 		sldns_buffer_flip(outnet->udp_buff);
 		free(pend->pkt); /* freeing now makes get_mem correct */
-		pend->pkt = NULL;
+		pend->pkt = NULL; 
 		pend->pkt_len = 0;
-		log_assert(!pend->sq->busy);
-		pend->sq->busy = 1;
 		if(!randomize_and_send_udp(pend, outnet->udp_buff,
 			pend->timeout)) {
 			/* callback error on pending */
@@ -1390,8 +1344,6 @@ outnet_send_wait_udp(struct outside_network* outnet)
 					NETEVENT_CLOSED, NULL);
 			}
 			pending_delete(outnet, pend);
-		} else {
-			pend->sq->busy = 0;
 		}
 	}
 }
@@ -1502,6 +1454,7 @@ calc_num46(char** ifs, int num_ifs, int do_ip4, int do_ip6,
 				(*num_ip4)++;
 		}
 	}
+
 }

 void
@@ -1614,7 +1567,6 @@ outside_network_create(struct comm_base *base, size_t bufsize,
 	outnet->tcp_reuse_timeout= tcp_reuse_timeout;
 	outnet->tcp_auth_query_timeout = tcp_auth_query_timeout;
 	outnet->num_tcp_outgoing = 0;
-	outnet->num_udp_outgoing = 0;
 	outnet->infra = infra;
 	outnet->rnd = rnd;
 	outnet->sslctx = sslctx;
@@ -1756,9 +1708,16 @@ static void
 serviced_node_del(rbnode_type* node, void* ATTR_UNUSED(arg))
 {
 	struct serviced_query* sq = (struct serviced_query*)node;
-	alloc_reg_release(sq->alloc, sq->region);
-	if(sq->timer)
-		comm_timer_delete(sq->timer);
+	struct service_callback* p = sq->cblist, *np;
+	free(sq->qbuf);
+	free(sq->zone);
+	free(sq->tls_auth_name);
+	edns_opt_list_free(sq->opt_list);
+	while(p) {
+		np = p->next;
+		free(p);
+		p = np;
+	}
 	free(sq);
 }

@@ -2001,9 +1960,6 @@ static int udp_connect_needs_log(int err)
 #  endif
 #  ifdef ENETDOWN
 	case ENETDOWN:
-#  endif
-#  ifdef EADDRNOTAVAIL
-	case EADDRNOTAVAIL:
 #  endif
 	case EPERM:
 	case EACCES:
@@ -2149,7 +2105,6 @@ randomize_and_send_udp(struct pending* pend, sldns_buffer* packet, int timeout)
 		portcomm_loweruse(outnet, pend->pc);
 		return 0;
 	}
-	outnet->num_udp_outgoing++;

 	/* system calls to set timeout after sending UDP to make roundtrip
 	   smaller. */
@@ -2219,13 +2174,10 @@ pending_udp_query(struct serviced_query* sq, struct sldns_buffer* packet,
 		sq->outnet->udp_wait_last = pend;
 		return pend;
 	}
-	log_assert(!sq->busy);
-	sq->busy = 1;
 	if(!randomize_and_send_udp(pend, packet, timeout)) {
 		pending_delete(sq->outnet, pend);
 		return NULL;
 	}
-	sq->busy = 0;
 	return pend;
 }

@@ -2295,7 +2247,7 @@ reuse_tcp_select_id(struct reuse_tcp* reuse, struct outside_network* outnet)
 	}

 	/* equally pick a random unused element from the tree that is
-	 * not in use.  Pick a the n-th index of an unused number,
+	 * not in use.  Pick a the n-th index of an ununused number,
 	 * then loop over the empty spaces in the tree and find it */
 	log_assert(reuse->tree_by_id.count < 0xffff);
 	select = ub_random_max(outnet->rnd, 0xffff - reuse->tree_by_id.count);
@@ -2305,7 +2257,7 @@ reuse_tcp_select_id(struct reuse_tcp* reuse, struct outside_network* outnet)
 	node = rbtree_first(&reuse->tree_by_id);
 	log_assert(node && node != RBTREE_NULL); /* tree not empty */
 	/* see if select is before first node */
-	if(select < (unsigned)tree_by_id_get_id(node))
+	if(select < tree_by_id_get_id(node))
 		return select;
 	count += tree_by_id_get_id(node);
 	/* perhaps select is between nodes */
@@ -2408,7 +2360,6 @@ pending_tcp_query(struct serviced_query* sq, sldns_buffer* packet,
 #ifdef USE_DNSTAP
 	w->sq = NULL;
 #endif
-	w->in_cb_and_decommission = 0;
 	if(pend) {
 		/* we have a buffer available right now */
 		if(reuse) {
@@ -2505,62 +2456,30 @@ lookup_serviced(struct outside_network* outnet, sldns_buffer* buff, int dnssec,
 	return (struct serviced_query*)rbtree_search(outnet->serviced, &key);
 }

-void
-serviced_timer_cb(void* arg)
-{
-	struct serviced_query* sq = (struct serviced_query*)arg;
-	struct outside_network* outnet = sq->outnet;
-	verbose(VERB_ALGO, "serviced send timer");
-	/* By the time this cb is called, if we don't have any registered
-	 * callbacks for this serviced_query anymore; do not send. */
-	if(!sq->cblist)
-		goto delete;
-	/* perform first network action */
-	if(outnet->do_udp && !(sq->tcp_upstream || sq->ssl_upstream)) {
-		if(!serviced_udp_send(sq, outnet->udp_buff))
-			goto delete;
-	} else {
-		if(!serviced_tcp_send(sq, outnet->udp_buff))
-			goto delete;
-	}
-	/* Maybe by this time we don't have callbacks attached anymore. Don't
-	 * proactively try to delete; let it run and maybe another callback
-	 * will get attached by the time we get an answer. */
-	return;
-delete:
-	serviced_callbacks(sq, NETEVENT_CLOSED, NULL, NULL);
-}
-
 /** Create new serviced entry */
 static struct serviced_query*
 serviced_create(struct outside_network* outnet, sldns_buffer* buff, int dnssec,
 	int want_dnssec, int nocaps, int tcp_upstream, int ssl_upstream,
 	char* tls_auth_name, struct sockaddr_storage* addr, socklen_t addrlen,
 	uint8_t* zone, size_t zonelen, int qtype, struct edns_option* opt_list,
-	size_t pad_queries_block_size, struct alloc_cache* alloc,
-	struct regional* region)
+	size_t pad_queries_block_size)
 {
 	struct serviced_query* sq = (struct serviced_query*)malloc(sizeof(*sq));
-	struct timeval t;
 #ifdef UNBOUND_DEBUG
 	rbnode_type* ins;
 #endif
 	if(!sq) 
 		return NULL;
 	sq->node.key = sq;
-	sq->alloc = alloc;
-	sq->region = region;
-	sq->qbuf = regional_alloc_init(region, sldns_buffer_begin(buff),
-		sldns_buffer_limit(buff));
+	sq->qbuf = memdup(sldns_buffer_begin(buff), sldns_buffer_limit(buff));
 	if(!sq->qbuf) {
-		alloc_reg_release(alloc, region);
 		free(sq);
 		return NULL;
 	}
 	sq->qbuflen = sldns_buffer_limit(buff);
-	sq->zone = regional_alloc_init(region, zone, zonelen);
+	sq->zone = memdup(zone, zonelen);
 	if(!sq->zone) {
-		alloc_reg_release(alloc, region);
+		free(sq->qbuf);
 		free(sq);
 		return NULL;
 	}
@@ -2572,9 +2491,10 @@ serviced_create(struct outside_network* outnet, sldns_buffer* buff, int dnssec,
 	sq->tcp_upstream = tcp_upstream;
 	sq->ssl_upstream = ssl_upstream;
 	if(tls_auth_name) {
-		sq->tls_auth_name = regional_strdup(region, tls_auth_name);
+		sq->tls_auth_name = strdup(tls_auth_name);
 		if(!sq->tls_auth_name) {
-			alloc_reg_release(alloc, region);
+			free(sq->zone);
+			free(sq->qbuf);
 			free(sq);
 			return NULL;
 		}
@@ -2583,16 +2503,17 @@ serviced_create(struct outside_network* outnet, sldns_buffer* buff, int dnssec,
 	}
 	memcpy(&sq->addr, addr, addrlen);
 	sq->addrlen = addrlen;
-	sq->opt_list = opt_list;
-	sq->busy = 0;
-	sq->timer = comm_timer_create(outnet->base, serviced_timer_cb, sq);
-	if(!sq->timer) {
-		alloc_reg_release(alloc, region);
-		free(sq);
-		return NULL;
+	sq->opt_list = NULL;
+	if(opt_list) {
+		sq->opt_list = edns_opt_copy_alloc(opt_list);
+		if(!sq->opt_list) {
+			free(sq->tls_auth_name);
+			free(sq->zone);
+			free(sq->qbuf);
+			free(sq);
+			return NULL;
+		}
 	}
-	memset(&t, 0, sizeof(t));
-	comm_timer_set(sq->timer, &t);
 	sq->outnet = outnet;
 	sq->cblist = NULL;
 	sq->pending = NULL;
@@ -2601,7 +2522,7 @@ serviced_create(struct outside_network* outnet, sldns_buffer* buff, int dnssec,
 	sq->to_be_deleted = 0;
 	sq->padding_block_size = pad_queries_block_size;
 #ifdef UNBOUND_DEBUG
-	ins =
+	ins = 
 #else
 	(void)
 #endif
@@ -2699,38 +2620,29 @@ serviced_delete(struct serviced_query* sq)
 			struct waiting_tcp* w = (struct waiting_tcp*)
 				sq->pending;
 			verbose(VERB_CLIENT, "serviced_delete: TCP");
-			log_assert(!(w->write_wait_queued && w->on_tcp_waiting_list));
 			/* if on stream-write-waiting list then
 			 * remove from waiting list and waiting_tcp_delete */
 			if(w->write_wait_queued) {
 				struct pending_tcp* pend =
 					(struct pending_tcp*)w->next_waiting;
 				verbose(VERB_CLIENT, "serviced_delete: writewait");
-				if(!w->in_cb_and_decommission)
-					reuse_tree_by_id_delete(&pend->reuse, w);
+				reuse_tree_by_id_delete(&pend->reuse, w);
 				reuse_write_wait_remove(&pend->reuse, w);
-				if(!w->in_cb_and_decommission)
-					waiting_tcp_delete(w);
+				waiting_tcp_delete(w);
 			} else if(!w->on_tcp_waiting_list) {
 				struct pending_tcp* pend =
 					(struct pending_tcp*)w->next_waiting;
 				verbose(VERB_CLIENT, "serviced_delete: tcpreusekeep");
-				/* w needs to stay on tree_by_id to not assign
-				 * the same ID; remove the callback since its
-				 * serviced_query will be gone. */
-				w->cb = NULL;
 				if(!reuse_tcp_remove_serviced_keep(w, sq)) {
-					if(!w->in_cb_and_decommission)
-						reuse_cb_and_decommission(sq->outnet,
-							pend, NETEVENT_CLOSED);
+					reuse_cb_and_decommission(sq->outnet,
+						pend, NETEVENT_CLOSED);
 					use_free_buffer(sq->outnet);
 				}
 				sq->pending = NULL;
 			} else {
 				verbose(VERB_CLIENT, "serviced_delete: tcpwait");
 				waiting_list_remove(sq->outnet, w);
-				if(!w->in_cb_and_decommission)
-					waiting_tcp_delete(w);
+				waiting_tcp_delete(w);
 			}
 		}
 	}
@@ -2980,8 +2892,7 @@ serviced_callbacks(struct serviced_query* sq, int error, struct comm_point* c,
 		 * use secondary buffer to store the query.
 		 * This is a data copy, but faster than packet to server */
 		backlen = sldns_buffer_limit(c->buffer);
-		backup_p = regional_alloc_init(sq->region,
-			sldns_buffer_begin(c->buffer), backlen);
+		backup_p = memdup(sldns_buffer_begin(c->buffer), backlen);
 		if(!backup_p) {
 			log_err("malloc failure in serviced query callbacks");
 			error = NETEVENT_CLOSED;
@@ -2999,8 +2910,10 @@ serviced_callbacks(struct serviced_query* sq, int error, struct comm_point* c,
 		}
 		fptr_ok(fptr_whitelist_serviced_query(p->cb));
 		(void)(*p->cb)(c, p->cb_arg, error, rep);
+		free(p);
 	}
 	if(backup_p) {
+		free(backup_p);
 		sq->outnet->svcd_overhead = 0;
 	}
 	verbose(VERB_ALGO, "svcd callbacks end");
@@ -3018,7 +2931,7 @@ serviced_tcp_callback(struct comm_point* c, void* arg, int error,
 	struct waiting_tcp* w = (struct waiting_tcp*)sq->pending;
 	struct pending_tcp* pend_tcp = NULL;
 	struct port_if* pi = NULL;
-	if(w && !w->on_tcp_waiting_list && w->next_waiting) {
+	if(!w->on_tcp_waiting_list && w->next_waiting) {
 		pend_tcp = (struct pending_tcp*)w->next_waiting;
 		pi = pend_tcp->pi;
 	}
@@ -3114,11 +3027,8 @@ serviced_tcp_initiate(struct serviced_query* sq, sldns_buffer* buff)
 		sq->status==serviced_query_TCP_EDNS?"EDNS":"");
 	serviced_encode(sq, buff, sq->status == serviced_query_TCP_EDNS);
 	sq->last_sent_time = *sq->outnet->now_tv;
-	log_assert(!sq->busy);
-	sq->busy = 1;
 	sq->pending = pending_tcp_query(sq, buff, sq->outnet->tcp_auth_query_timeout,
 		serviced_tcp_callback, sq);
-	sq->busy = 0;
 	if(!sq->pending) {
 		/* delete from tree so that a retry by above layer does not
 		 * clash with this entry */
@@ -3150,11 +3060,8 @@ serviced_tcp_send(struct serviced_query* sq, sldns_buffer* buff)
 	} else {
 		timeout = sq->outnet->tcp_auth_query_timeout;
 	}
-	log_assert(!sq->busy);
-	sq->busy = 1;
 	sq->pending = pending_tcp_query(sq, buff, timeout,
 		serviced_tcp_callback, sq);
-	sq->busy = 0;
 	return sq->pending != NULL;
 }

@@ -3205,6 +3112,7 @@ serviced_udp_callback(struct comm_point* c, void* arg, int error,
 	struct timeval now = *sq->outnet->now_tv;
 #ifdef USE_DNSTAP
 	struct pending* p = (struct pending*)sq->pending;
+	struct port_if* pi = p->pc->pif;
 #endif

 	sq->pending = NULL; /* removed after callback */
@@ -3246,16 +3154,14 @@ serviced_udp_callback(struct comm_point* c, void* arg, int error,
 	/*
 	 * sending src (local service)/dst (upstream) addresses over DNSTAP
 	 */
-	if(error == NETEVENT_NOERROR && outnet->dtenv && p->pc &&
-		(outnet->dtenv->log_resolver_response_messages ||
-		outnet->dtenv->log_forwarder_response_messages)) {
+	if(error == NETEVENT_NOERROR && outnet->dtenv &&
+	   (outnet->dtenv->log_resolver_response_messages ||
+	    outnet->dtenv->log_forwarder_response_messages)) {
 		log_addr(VERB_ALGO, "response from upstream", &sq->addr, sq->addrlen);
-		log_addr(VERB_ALGO, "to local addr", &p->pc->pif->addr,
-			p->pc->pif->addrlen);
-		dt_msg_send_outside_response(outnet->dtenv, &sq->addr,
-			&p->pc->pif->addr, c->type, sq->zone, sq->zonelen,
-			sq->qbuf, sq->qbuflen, &sq->last_sent_time,
-			sq->outnet->now_tv, c->buffer);
+		log_addr(VERB_ALGO, "to local addr", &pi->addr, pi->addrlen);
+		dt_msg_send_outside_response(outnet->dtenv, &sq->addr, &pi->addr, c->type,
+		  sq->zone, sq->zonelen, sq->qbuf, sq->qbuflen,
+		  &sq->last_sent_time, sq->outnet->now_tv, c->buffer);
 	}
 #endif
 	if( (sq->status == serviced_query_UDP_EDNS 
@@ -3345,117 +3251,64 @@ serviced_udp_callback(struct comm_point* c, void* arg, int error,
 struct serviced_query* 
 outnet_serviced_query(struct outside_network* outnet,
 	struct query_info* qinfo, uint16_t flags, int dnssec, int want_dnssec,
-	int nocaps, int check_ratelimit, int tcp_upstream, int ssl_upstream,
-	char* tls_auth_name, struct sockaddr_storage* addr, socklen_t addrlen,
-	uint8_t* zone, size_t zonelen, struct module_qstate* qstate,
-	comm_point_callback_type* callback, void* callback_arg,
-	sldns_buffer* buff, struct module_env* env, int* was_ratelimited)
+	int nocaps, int tcp_upstream, int ssl_upstream, char* tls_auth_name,
+	struct sockaddr_storage* addr, socklen_t addrlen, uint8_t* zone,
+	size_t zonelen, struct module_qstate* qstate,
+	comm_point_callback_type* callback, void* callback_arg, sldns_buffer* buff,
+	struct module_env* env)
 {
 	struct serviced_query* sq;
 	struct service_callback* cb;
 	struct edns_string_addr* client_string_addr;
-	struct regional* region;
-	struct edns_option* backed_up_opt_list = qstate->edns_opts_back_out;
-	struct edns_option* per_upstream_opt_list = NULL;
-	time_t timenow = 0;

-	/* If we have an already populated EDNS option list make a copy since
-	 * we may now add upstream specific EDNS options. */
-	/* Use a region that could be attached to a serviced_query, if it needs
-	 * to be created. If an existing one is found then this region will be
-	 * destroyed here. */
-	region = alloc_reg_obtain(env->alloc);
-	if(!region) return NULL;
-	if(qstate->edns_opts_back_out) {
-		per_upstream_opt_list = edns_opt_copy_region(
-			qstate->edns_opts_back_out, region);
-		if(!per_upstream_opt_list) {
-			alloc_reg_release(env->alloc, region);
+	if(!inplace_cb_query_call(env, qinfo, flags, addr, addrlen, zone, zonelen,
+		qstate, qstate->region))
 			return NULL;
-		}
-		qstate->edns_opts_back_out = per_upstream_opt_list;
-	}
-
-	if(!inplace_cb_query_call(env, qinfo, flags, addr, addrlen, zone,
-		zonelen, qstate, region)) {
-		alloc_reg_release(env->alloc, region);
-		return NULL;
-	}
-	/* Restore the option list; we can explicitly use the copied one from
-	 * now on. */
-	per_upstream_opt_list = qstate->edns_opts_back_out;
-	qstate->edns_opts_back_out = backed_up_opt_list;

 	if((client_string_addr = edns_string_addr_lookup(
 		&env->edns_strings->client_strings, addr, addrlen))) {
-		edns_opt_list_append(&per_upstream_opt_list,
+		edns_opt_list_append(&qstate->edns_opts_back_out,
 			env->edns_strings->client_string_opcode,
 			client_string_addr->string_len,
-			client_string_addr->string, region);
+			client_string_addr->string, qstate->region);
 	}

 	serviced_gen_query(buff, qinfo->qname, qinfo->qname_len, qinfo->qtype,
 		qinfo->qclass, flags);
 	sq = lookup_serviced(outnet, buff, dnssec, addr, addrlen,
-		per_upstream_opt_list);
+		qstate->edns_opts_back_out);
+	/* duplicate entries are included in the callback list, because
+	 * there is a counterpart registration by our caller that needs to
+	 * be doubly-removed (with callbacks perhaps). */
+	if(!(cb = (struct service_callback*)malloc(sizeof(*cb))))
+		return NULL;
 	if(!sq) {
-		/* Check ratelimit only for new serviced_query */
-		if(check_ratelimit) {
-			timenow = *env->now;
-			if(!infra_ratelimit_inc(env->infra_cache, zone,
-				zonelen, timenow, env->cfg->ratelimit_backoff,
-				&qstate->qinfo, qstate->reply)) {
-				/* Can we pass through with slip factor? */
-				if(env->cfg->ratelimit_factor == 0 ||
-					ub_random_max(env->rnd,
-					env->cfg->ratelimit_factor) != 1) {
-					*was_ratelimited = 1;
-					alloc_reg_release(env->alloc, region);
-					return NULL;
-				}
-				log_nametypeclass(VERB_ALGO,
-					"ratelimit allowed through for "
-					"delegation point", zone,
-					LDNS_RR_TYPE_NS, LDNS_RR_CLASS_IN);
-			}
-		}
 		/* make new serviced query entry */
 		sq = serviced_create(outnet, buff, dnssec, want_dnssec, nocaps,
 			tcp_upstream, ssl_upstream, tls_auth_name, addr,
 			addrlen, zone, zonelen, (int)qinfo->qtype,
-			per_upstream_opt_list,
+			qstate->edns_opts_back_out,
 			( ssl_upstream && env->cfg->pad_queries
-			? env->cfg->pad_queries_block_size : 0 ),
-			env->alloc, region);
+			? env->cfg->pad_queries_block_size : 0 ));
 		if(!sq) {
-			if(check_ratelimit) {
-				infra_ratelimit_dec(env->infra_cache,
-					zone, zonelen, timenow);
-			}
-			alloc_reg_release(env->alloc, region);
+			free(cb);
 			return NULL;
 		}
-		if(!(cb = (struct service_callback*)regional_alloc(
-			sq->region, sizeof(*cb)))) {
-			if(check_ratelimit) {
-				infra_ratelimit_dec(env->infra_cache,
-					zone, zonelen, timenow);
+		/* perform first network action */
+		if(outnet->do_udp && !(tcp_upstream || ssl_upstream)) {
+			if(!serviced_udp_send(sq, buff)) {
+				(void)rbtree_delete(outnet->serviced, sq);
+				serviced_node_del(&sq->node, NULL);
+				free(cb);
+				return NULL;
+			}
+		} else {
+			if(!serviced_tcp_send(sq, buff)) {
+				(void)rbtree_delete(outnet->serviced, sq);
+				serviced_node_del(&sq->node, NULL);
+				free(cb);
+				return NULL;
 			}
-			(void)rbtree_delete(outnet->serviced, sq);
-			serviced_node_del(&sq->node, NULL);
-			return NULL;
-		}
-		/* No network action at this point; it will be invoked with the
-		 * serviced_query timer instead to run outside of the mesh. */
-	} else {
-		/* We don't need this region anymore. */
-		alloc_reg_release(env->alloc, region);
-		/* duplicate entries are included in the callback list, because
-		 * there is a counterpart registration by our caller that needs
-		 * to be doubly-removed (with callbacks perhaps). */
-		if(!(cb = (struct service_callback*)regional_alloc(
-			sq->region, sizeof(*cb)))) {
-			return NULL;
 		}
 	}
 	/* add callback to list of callbacks */
@@ -3475,6 +3328,7 @@ callback_list_remove(struct serviced_query* sq, void* cb_arg)
 		if((*pp)->cb_arg == cb_arg) {
 			struct service_callback* del = *pp;
 			*pp = del->next;
+			free(del);
 			return;
 		}
 		pp = &(*pp)->next;
@@ -3483,13 +3337,13 @@ callback_list_remove(struct serviced_query* sq, void* cb_arg)

 void outnet_serviced_query_stop(struct serviced_query* sq, void* cb_arg)
 {
-	if(!sq)
+	if(!sq) 
 		return;
 	callback_list_remove(sq, cb_arg);
 	/* if callbacks() routine scheduled deletion, let it do that */
-	if(!sq->cblist && !sq->busy && !sq->to_be_deleted) {
+	if(!sq->cblist && !sq->to_be_deleted) {
 		(void)rbtree_delete(sq->outnet->serviced, sq);
-		serviced_delete(sq);
+		serviced_delete(sq); 
 	}
 }

@@ -43,9 +43,7 @@
 #ifndef OUTSIDE_NETWORK_H
 #define OUTSIDE_NETWORK_H

-#include "util/alloc.h"
 #include "util/rbtree.h"
-#include "util/regional.h"
 #include "util/netevent.h"
 #include "dnstap/dnstap_config.h"
 struct pending;
@@ -113,8 +111,6 @@ struct outside_network {
 	/** if we perform udp-connect, connect() for UDP socket to mitigate
 	 * ICMP side channel leakage */
 	int udp_connect;
-	/** number of udp packets sent. */
-	size_t num_udp_outgoing;

 	/** array of outgoing IP4 interfaces */
 	struct port_if* ip4_ifs;
@@ -416,8 +412,6 @@ struct waiting_tcp {
 	char* tls_auth_name;
 	/** the packet was involved in an error, to stop looping errors */
 	int error_count;
-	/** if true, the item is at the cb_and_decommission stage */
-	int in_cb_and_decommission;
 #ifdef USE_DNSTAP
 	/** serviced query pointer for dnstap to get logging info, if nonNULL*/
 	struct serviced_query* sq;
@@ -518,15 +512,6 @@ struct serviced_query {
 	void* pending;
 	/** block size with which to pad encrypted queries (default: 128) */
 	size_t padding_block_size;
-	/** region for this serviced query. Will be cleared when this
-	 * serviced_query will be deleted */
-	struct regional* region;
-	/** allocation service for the region */
-	struct alloc_cache* alloc;
-	/** flash timer to start the net I/O as a separate event */
-	struct comm_timer* timer;
-	/** true if serviced_query is currently doing net I/O and may block */
-	int busy;
 };

 /**
@@ -634,7 +619,6 @@ void pending_delete(struct outside_network* outnet, struct pending* p);
 * @param want_dnssec: signatures are needed, without EDNS the answer is
 * 	likely to be useless.
 * @param nocaps: ignore use_caps_for_id and use unperturbed qname.
- * @param check_ratelimit: if set, will check ratelimit before sending out.
 * @param tcp_upstream: use TCP for upstream queries.
 * @param ssl_upstream: use SSL for upstream queries.
 * @param tls_auth_name: when ssl_upstream is true, use this name to check
@@ -651,18 +635,16 @@ void pending_delete(struct outside_network* outnet, struct pending* p);
 * @param callback_arg: user argument to callback function.
 * @param buff: scratch buffer to create query contents in. Empty on exit.
 * @param env: the module environment.
- * @param was_ratelimited: it will signal back if the query failed to pass the
- *	ratelimit check.
 * @return 0 on error, or pointer to serviced query that is used to answer
 *	this serviced query may be shared with other callbacks as well.
 */
 struct serviced_query* outnet_serviced_query(struct outside_network* outnet,
 	struct query_info* qinfo, uint16_t flags, int dnssec, int want_dnssec,
-	int nocaps, int check_ratelimit, int tcp_upstream, int ssl_upstream,
-	char* tls_auth_name, struct sockaddr_storage* addr, socklen_t addrlen,
-	uint8_t* zone, size_t zonelen, struct module_qstate* qstate,
+	int nocaps, int tcp_upstream, int ssl_upstream, char* tls_auth_name,
+	struct sockaddr_storage* addr, socklen_t addrlen, uint8_t* zone,
+	size_t zonelen, struct module_qstate* qstate,
 	comm_point_callback_type* callback, void* callback_arg,
-	struct sldns_buffer* buff, struct module_env* env, int* was_ratelimited);
+	struct sldns_buffer* buff, struct module_env* env);

 /**
 * Remove service query callback.
@@ -803,9 +785,6 @@ void pending_udp_timer_delay_cb(void *arg);
 /** callback for outgoing TCP timer event */
 void outnet_tcptimer(void* arg);

-/** callback to send serviced queries */
-void serviced_timer_cb(void *arg);
-
 /** callback for serviced query UDP answers */
 int serviced_udp_callback(struct comm_point* c, void* arg, int error,
        struct comm_reply* rep);
@@ -513,6 +513,13 @@ rpz_create(struct config_auth* p)
 		goto err;
 	}

+	/* Respond with EDEs (RFC 8914) in this zone*/
+	if (p->rpz_do_ede)
+		r->do_ede = 1;
+	else
+		r->do_ede = 0;
+
+
 	r->taglistlen = p->rpz_taglistlen;
 	r->taglist = memdup(p->rpz_taglist, r->taglistlen);
 	if(p->rpz_action_override) {
@@ -526,13 +533,13 @@ rpz_create(struct config_auth* p)
 		size_t nmlen = sizeof(nm);

 		if(!p->rpz_cname) {
-			log_err("rpz: override with cname action found, but no "
+			log_err("RPZ override with cname action found, but no "
 				"rpz-cname-override configured");
 			goto err;
 		}

 		if(sldns_str2wire_dname_buf(p->rpz_cname, nm, &nmlen) != 0) {
-			log_err("rpz: cannot parse cname override: %s",
+			log_err("cannot parse RPZ cname override: %s",
 				p->rpz_cname);
 			goto err;
 		}
@@ -614,7 +621,7 @@ rpz_insert_local_zones_trigger(struct local_zones* lz, uint8_t* dname,
 			return; /* no need to log these types as unsupported */
 		}
 		dname_str(dname, str);
-		verbose(VERB_ALGO, "rpz: qname trigger, %s skipping unsupported action: %s",
+		verbose(VERB_ALGO, "RPZ: qname trigger, %s skipping unsupported action: %s",
 			str, rpz_action_to_string(a));
 		free(dname);
 		return;
@@ -999,7 +1006,7 @@ rpz_insert_response_ip_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,
 		rpz_action_to_respip_action(a) == respip_invalid) {
 		char str[255+1];
 		dname_str(dname, str);
-		verbose(VERB_ALGO, "rpz: respip trigger, %s skipping unsupported action: %s",
+		verbose(VERB_ALGO, "RPZ: respip trigger, %s skipping unsupported action: %s",
 			str, rpz_action_to_string(a));
 		return 0;
 	}
@@ -1560,9 +1567,7 @@ rpz_local_encode(struct module_env* env, struct query_info* qinfo,
 }

 static struct local_rrset*
-rpz_find_synthesized_rrset(uint16_t qtype,
-	struct clientip_synthesized_rr* data)
-{
+rpz_find_synthesized_rrset(int qtype, struct clientip_synthesized_rr* data) {
 	struct local_rrset* cursor = data->data;
 	while( cursor != NULL) {
 		struct packed_rrset_key* packed_rrset = &cursor->rrset->rk;
@@ -1895,6 +1900,8 @@ rpz_synthesize_qname_localdata(struct module_env* env, struct rpz* r,
 {
 	struct local_data* ld = NULL;
 	int ret = 0;
+	int do_ede = 0;
+
 	if(r->action_override == RPZ_CNAME_OVERRIDE_ACTION) {
 		qinfo->local_alias = regional_alloc_zero(temp, sizeof(struct local_rrset));
 		if(qinfo->local_alias == NULL) {
@@ -1915,9 +1922,13 @@ rpz_synthesize_qname_localdata(struct module_env* env, struct rpz* r,
 		return 0;
 	}

+	/* check the rpz if we want to respond with EDE (RFC8914) */
+	if (r->do_ede)
+		do_ede = r->do_ede;
+
 	if(lzt == local_zone_redirect && local_data_answer(z, env, qinfo,
 		edns, repinfo, buf, temp, dname_count_labels(qinfo->qname),
-		&ld, lzt, -1, NULL, 0, NULL, 0)) {
+		&ld, lzt, -1, NULL, 0, NULL, 0, do_ede)) {
 		if(r->log) {
 			log_rpz_apply("qname", z->name, NULL,
 				localzone_type_to_rpz_action(lzt), qinfo,
@@ -1928,7 +1939,7 @@ rpz_synthesize_qname_localdata(struct module_env* env, struct rpz* r,
 	}

 	ret = local_zones_zone_answer(z, env, qinfo, edns, repinfo, buf, temp,
-		0 /* no local data used */, lzt);
+		0 /* no local data used */, lzt, do_ede);
 	if(r->signal_nxdomain_ra && LDNS_RCODE_WIRE(sldns_buffer_begin(buf))
 		== LDNS_RCODE_NXDOMAIN)
 		LDNS_RA_CLR(sldns_buffer_begin(buf));
@@ -1999,7 +2010,6 @@ rpz_apply_nsip_trigger(struct module_qstate* ms, struct rpz* r,
 		break;
 	case RPZ_PASSTHRU_ACTION:
 		ret = NULL;
-		ms->rpz_passthru = 1;
 		break;
 	default:
 		verbose(VERB_ALGO, "rpz: nsip: bug: unhandled or invalid action: '%s'",
@@ -2054,7 +2064,6 @@ rpz_apply_nsdname_trigger(struct module_qstate* ms, struct rpz* r,
 		break;
 	case RPZ_PASSTHRU_ACTION:
 		ret = NULL;
-		ms->rpz_passthru = 1;
 		break;
 	default:
 		verbose(VERB_ALGO, "rpz: nsip: bug: unhandled or invalid action: '%s'",
@@ -2118,11 +2127,6 @@ rpz_callback_from_iterator_module(struct module_qstate* ms, struct iter_qstate*
 	struct local_zone* z = NULL;
 	struct matched_delegation_point match = {0};

-	if(ms->rpz_passthru) {
-		verbose(VERB_ALGO, "query is rpz_passthru, no further processing");
-		return NULL;
-	}
-
 	if(ms->env == NULL || ms->env->auth_zones == NULL) { return 0; }

 	az = ms->env->auth_zones;
@@ -2188,11 +2192,6 @@ struct dns_msg* rpz_callback_from_iterator_cname(struct module_qstate* ms,
 	enum localzone_type lzt;
 	struct dns_msg* ret = NULL;

-	if(ms->rpz_passthru) {
-		verbose(VERB_ALGO, "query is rpz_passthru, no further processing");
-		return NULL;
-	}
-
 	if(ms->env == NULL || ms->env->auth_zones == NULL) { return 0; }
 	az = ms->env->auth_zones;

@@ -2267,7 +2266,6 @@ struct dns_msg* rpz_callback_from_iterator_cname(struct module_qstate* ms,
 		break;
 	case RPZ_PASSTHRU_ACTION:
 		ret = NULL;
-		ms->rpz_passthru = 1;
 		break;
 	default:
 		verbose(VERB_ALGO, "rpz: qname trigger after cname: bug: unhandled or invalid action: '%s'",
@@ -2285,18 +2283,16 @@ rpz_apply_maybe_clientip_trigger(struct auth_zones* az, struct module_env* env,
 	uint8_t* taglist, size_t taglen, struct ub_server_stats* stats,
 	sldns_buffer* buf, struct regional* temp,
 	/* output parameters */
-	struct local_zone** z_out, struct auth_zone** a_out, struct rpz** r_out,
-	int* passthru)
+	struct local_zone** z_out, struct auth_zone** a_out, struct rpz** r_out)
 {
 	int ret = 0;
 	enum rpz_action client_action;
 	struct clientip_synthesized_rr* node = rpz_resolve_client_action_and_zone(
 		az, qinfo, repinfo, taglist, taglen, stats, z_out, a_out, r_out);
+	int do_ede;

 	client_action = ((node == NULL) ? RPZ_INVALID_ACTION : node->action);
-	if(client_action == RPZ_PASSTHRU_ACTION) {
-		*passthru = 1;
-	}
+
 	if(*z_out == NULL || (client_action != RPZ_INVALID_ACTION &&
 			      client_action != RPZ_PASSTHRU_ACTION)) {
 		if(client_action == RPZ_PASSTHRU_ACTION
@@ -2318,9 +2314,15 @@ rpz_apply_maybe_clientip_trigger(struct auth_zones* az, struct module_env* env,
 					(node?&node->node:NULL),
 					client_action, qinfo, repinfo, NULL,
 					(*r_out)->log_name);
+			/* check the rpz zone if we want to respond with EDE (RFC8914) */
+			if (*r_out && (*r_out)->do_ede)
+				do_ede = (*r_out)->do_ede;
+			else 
+				do_ede = 0;
+
 			local_zones_zone_answer(*z_out /*likely NULL, no zone*/, env, qinfo, edns,
 				repinfo, buf, temp, 0 /* no local data used */,
-				rpz_action_to_localzone_type(client_action));
+				rpz_action_to_localzone_type(client_action), do_ede);
 			if(*r_out && (*r_out)->signal_nxdomain_ra &&
 				LDNS_RCODE_WIRE(sldns_buffer_begin(buf))
 				== LDNS_RCODE_NXDOMAIN)
@@ -2341,7 +2343,7 @@ int
 rpz_callback_from_worker_request(struct auth_zones* az, struct module_env* env,
 	struct query_info* qinfo, struct edns_data* edns, sldns_buffer* buf,
 	struct regional* temp, struct comm_reply* repinfo, uint8_t* taglist,
-	size_t taglen, struct ub_server_stats* stats, int* passthru)
+	size_t taglen, struct ub_server_stats* stats)
 {
 	struct rpz* r = NULL;
 	struct auth_zone* a = NULL;
@@ -2350,8 +2352,7 @@ rpz_callback_from_worker_request(struct auth_zones* az, struct module_env* env,
 	enum localzone_type lzt;

 	int clientip_trigger = rpz_apply_maybe_clientip_trigger(az, env, qinfo,
-		edns, repinfo, taglist, taglen, stats, buf, temp, &z, &a, &r,
-		passthru);
+		edns, repinfo, taglist, taglen, stats, buf, temp, &z, &a, &r);
 	if(clientip_trigger >= 0) {
 		if(a) {
 			lock_rw_unlock(&a->lock);
@@ -2376,10 +2377,6 @@ rpz_callback_from_worker_request(struct auth_zones* az, struct module_env* env,
 	} else {
 		lzt = rpz_action_to_localzone_type(r->action_override);
 	}
-	if(r->action_override == RPZ_PASSTHRU_ACTION ||
-		lzt == local_zone_always_transparent /* RPZ_PASSTHRU_ACTION */) {
-		*passthru = 1;
-	}

 	if(verbosity >= VERB_ALGO) {
 		char nm[255+1], zn[255+1];
@@ -2415,3 +2412,17 @@ void rpz_disable(struct rpz* r)
        return;
    r->disabled = 1;
 }
+
+void rpz_do_ede_enable(struct rpz* r)
+{
+    if(!r)
+        return;
+    r->do_ede = 1;
+}
+
+void rpz_do_ede_disable(struct rpz* r)
+{
+    if(!r)
+        return;
+    r->do_ede = 0;
+}
@@ -127,6 +127,7 @@ struct rpz {
 	int signal_nxdomain_ra;
 	struct regional* region;
 	int disabled;
+    int do_ede;
 };

 /**
@@ -176,14 +177,12 @@ void rpz_remove_rr(struct rpz* r, size_t aznamelen, uint8_t* dname,
 * @param taglist: taglist to lookup.
 * @param taglen: length of taglist.
 * @param stats: worker stats struct
- * @param passthru: returns if the query can passthru further rpz processing.
 * @return: 1 if client answer is ready, 0 to continue resolving
 */
 int rpz_callback_from_worker_request(struct auth_zones* az, struct module_env* env,
 	struct query_info* qinfo, struct edns_data* edns, sldns_buffer* buf,
 	struct regional* temp, struct comm_reply* repinfo,
-	uint8_t* taglist, size_t taglen, struct ub_server_stats* stats,
-	int* passthru);
+	uint8_t* taglist, size_t taglen, struct ub_server_stats* stats);

 /**
 * Callback to process when the iterator module is about to send queries.
@@ -263,4 +262,16 @@ void rpz_enable(struct rpz* r);
 */
 void rpz_disable(struct rpz* r);

+/**
+ * Enable RPZ EDE (RFC 8914) responses
+ * @param r: RPZ struct containing member to disable
+ */
+void rpz_do_ede_enable(struct rpz* r);
+
+/**
+ * Disable RPZ EDE (RFC 8914) responses
+ * @param r: RPZ struct containing member to disable
+ */
+void rpz_do_ede_disable(struct rpz* r);
+
 #endif /* SERVICES_RPZ_H */
@@ -250,8 +250,7 @@ sldns_key_buf2dsa_raw(unsigned char* key, size_t len)
 	if(!(dsa = DSA_new())) {
 		return NULL;
 	}
-#if OPENSSL_VERSION_NUMBER < 0x10100000 || \
-        (defined(HAVE_LIBRESSL) && LIBRESSL_VERSION_NUMBER < 0x02070000f)
+#if OPENSSL_VERSION_NUMBER < 0x10100000 || defined(HAVE_LIBRESSL)
 #ifndef S_SPLINT_S
 	dsa->p = P;
 	dsa->q = Q;
@@ -429,8 +428,7 @@ sldns_key_buf2rsa_raw(unsigned char* key, size_t len)
 		BN_free(modulus);
 		return NULL;
 	}
-#if OPENSSL_VERSION_NUMBER < 0x10100000 || \
-        (defined(HAVE_LIBRESSL) && LIBRESSL_VERSION_NUMBER < 0x02070000f)
+#if OPENSSL_VERSION_NUMBER < 0x10100000 || defined(HAVE_LIBRESSL)
 #ifndef S_SPLINT_S
 	rsa->n = modulus;
 	rsa->e = exponent;
@@ -34,7 +34,7 @@ sldns_fget_token_l(FILE *f, char *token, const char *delim, size_t limit, int *l
 {
 	int c, prev_c;
 	int p; /* 0 -> no parentheses seen, >0 nr of ( seen */
-	int com, quoted, only_blank;
+	int com, quoted;
 	char *t;
 	size_t i;
 	const char *d;
@@ -53,7 +53,6 @@ sldns_fget_token_l(FILE *f, char *token, const char *delim, size_t limit, int *l
 	com = 0;
 	quoted = 0;
 	prev_c = 0;
-	only_blank = 1;	/* Assume we got only <blank> until now */
 	t = token;
 	if (del[0] == '"') {
 		quoted = 1;
@@ -102,22 +101,6 @@ sldns_fget_token_l(FILE *f, char *token, const char *delim, size_t limit, int *l
 			if (line_nr) {
 				*line_nr = *line_nr + 1;
 			}
-			if (only_blank && i > 0) {
-				/* Got only <blank> so far. Reset and try
-				 * again with the next line.
-				 */
-				i = 0;
-				t = token;
-			}
-			if (p == 0) {
-				/* If p != 0 then the next line is a continuation. So
-				 * we assume that the next line starts with a blank only
-				 * if it is actually a new line.
-				 */
-				only_blank = 1;	/* Assume next line starts with
-						 * <blank>.
-						 */
-			}
 			if (p == 0 && i > 0) {
 				goto tokenread;
 			} else {
@@ -148,29 +131,12 @@ sldns_fget_token_l(FILE *f, char *token, const char *delim, size_t limit, int *l

 		/* check if we hit the delim */
 		for (d = del; *d; d++) {
-			if (c == *d)
-				break;
-		}
-
-		if (c == *d && i > 0 && prev_c != '\\' && p == 0) {
-			if (c == '\n' && line_nr) {
-				*line_nr = *line_nr + 1;
+			if (c == *d && i > 0 && prev_c != '\\' && p == 0) {
+				if (c == '\n' && line_nr) {
+					*line_nr = *line_nr + 1;
+				}
+				goto tokenread;
 			}
-			if (only_blank) {
-				/* Got only <blank> so far. Reset and
-				 * try again with the next line.
-				 */
-				i = 0;
-				t = token;
-				only_blank = 1;
-				prev_c = c;
-				continue;
-			}
-			goto tokenread;
-		}
-		if (c != ' ' && c != '\t') {
-			/* Found something that is not <blank> */
-			only_blank= 0;
 		}
 		if (c != '\0' && c != '\n') {
 			i++;
@@ -183,13 +149,8 @@ sldns_fget_token_l(FILE *f, char *token, const char *delim, size_t limit, int *l
 		if (c != '\0' && c != '\n') {
 			*t++ = c;
 		}
-		if (c == '\n') {
-			if (line_nr) {
-				*line_nr = *line_nr + 1;
-			}
-			only_blank = 1;	/* Assume next line starts with
-					 * <blank>.
-					 */
+		if (c == '\n' && line_nr) {
+			*line_nr = *line_nr + 1;
 		}
 		if (c == '\\' && prev_c == '\\')
 			prev_c = 0;
@@ -209,13 +209,11 @@ sldns_hexdigit_to_int(char ch)
 }

 uint32_t
-sldns_str2period(const char *nptr, const char **endptr, int* overflow)
+sldns_str2period(const char *nptr, const char **endptr)
 {
 	int sign = 0;
 	uint32_t i = 0;
 	uint32_t seconds = 0;
-	const uint32_t maxint = 0xffffffff;
-	*overflow = 0;

 	for(*endptr = nptr; **endptr; (*endptr)++) {
 		switch (**endptr) {
@@ -238,46 +236,26 @@ sldns_str2period(const char *nptr, const char **endptr, int* overflow)
 				break;
 			case 's':
 			case 'S':
-				if(seconds > maxint-i) {
-					*overflow = 1;
-					return 0;
-				}
 				seconds += i;
 				i = 0;
 				break;
 			case 'm':
 			case 'M':
-				if(i > maxint/60 || seconds > maxint-(i*60)) {
-					*overflow = 1;
-					return 0;
-				}
 				seconds += i * 60;
 				i = 0;
 				break;
 			case 'h':
 			case 'H':
-				if(i > maxint/(60*60) || seconds > maxint-(i*60*60)) {
-					*overflow = 1;
-					return 0;
-				}
 				seconds += i * 60 * 60;
 				i = 0;
 				break;
 			case 'd':
 			case 'D':
-				if(i > maxint/(60*60*24) || seconds > maxint-(i*60*60*24)) {
-					*overflow = 1;
-					return 0;
-				}
 				seconds += i * 60 * 60 * 24;
 				i = 0;
 				break;
 			case 'w':
 			case 'W':
-				if(i > maxint/(60*60*24*7) || seconds > maxint-(i*60*60*24*7)) {
-					*overflow = 1;
-					return 0;
-				}
 				seconds += i * 60 * 60 * 24 * 7;
 				i = 0;
 				break;
@@ -291,27 +269,15 @@ sldns_str2period(const char *nptr, const char **endptr, int* overflow)
 			case '7':
 			case '8':
 			case '9':
-				if(i > maxint/10 || i*10 > maxint - (**endptr - '0')) {
-					*overflow = 1;
-					return 0;
-				}
 				i *= 10;
 				i += (**endptr - '0');
 				break;
 			default:
-				if(seconds > maxint-i) {
-					*overflow = 1;
-					return 0;
-				}
 				seconds += i;
 				/* disregard signedness */
 				return seconds;
 		}
 	}
-	if(seconds > maxint-i) {
-		*overflow = 1;
-		return 0;
-	}
 	seconds += i;
 	/* disregard signedness */
 	return seconds;
@@ -74,11 +74,9 @@ struct tm * sldns_serial_arithmetics_gmtime_r(int32_t time, time_t now, struct t
 * converts a ttl value (like 5d2h) to a long.
 * \param[in] nptr the start of the string
 * \param[out] endptr points to the last char in case of error
- * \param[out] overflow returns if the string causes integer overflow error,
- * 	       the number is too big, string of digits too long.
 * \return the convert duration value
 */
-uint32_t sldns_str2period(const char *nptr, const char **endptr, int* overflow);
+uint32_t sldns_str2period(const char *nptr, const char **endptr);

 /**
 * Returns the int value of the given (hex) digit
@@ -381,9 +381,9 @@ static sldns_rr_descriptor rdata_field_descriptors[] = {
 	/* 63 */
 	{LDNS_RR_TYPE_ZONEMD, "ZONEMD", 4, 4, type_zonemd_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
 	/* 64 */
-	{LDNS_RR_TYPE_SVCB, "SVCB", 2, 2, type_svcb_wireformat, LDNS_RDF_TYPE_SVCPARAM, LDNS_RR_NO_COMPRESS, 1 },
+	{LDNS_RR_TYPE_SVCB, "SVCB", 2, 2, type_svcb_wireformat, LDNS_RDF_TYPE_SVCPARAM, LDNS_RR_NO_COMPRESS, 0 },
 	/* 65 */
-	{LDNS_RR_TYPE_HTTPS, "HTTPS", 2, 2, type_svcb_wireformat, LDNS_RDF_TYPE_SVCPARAM, LDNS_RR_NO_COMPRESS, 1 },
+	{LDNS_RR_TYPE_HTTPS, "HTTPS", 2, 2, type_svcb_wireformat, LDNS_RDF_TYPE_SVCPARAM, LDNS_RR_NO_COMPRESS, 0 },
 {(enum sldns_enum_rr_type)0, "TYPE66", 1, 1, type_0_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
 {(enum sldns_enum_rr_type)0, "TYPE67", 1, 1, type_0_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
 {(enum sldns_enum_rr_type)0, "TYPE68", 1, 1, type_0_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
@@ -442,7 +442,6 @@ typedef enum sldns_enum_edns_option sldns_edns_option;

 enum sldns_enum_ede_code
 {
-	LDNS_EDE_NONE = -1, /* EDE undefined for internal use */
 	LDNS_EDE_OTHER = 0,
 	LDNS_EDE_UNSUPPORTED_DNSKEY_ALG = 1,
 	LDNS_EDE_UNSUPPORTED_DS_DIGEST = 2,
@@ -467,7 +466,7 @@ enum sldns_enum_ede_code
 	LDNS_EDE_NOT_SUPPORTED = 21,
 	LDNS_EDE_NO_REACHABLE_AUTHORITY = 22,
 	LDNS_EDE_NETWORK_ERROR = 23,
-	LDNS_EDE_INVALID_DATA = 24,
+	LDNS_EDE_INVALID_DATA = 24
 };
 typedef enum sldns_enum_ede_code sldns_ede_code;

@@ -25,10 +25,8 @@
 #include <netdb.h>
 #endif

-/** bits for the offset */
-#define RET_OFFSET_MASK (((unsigned)(~LDNS_WIREPARSE_MASK))>>LDNS_WIREPARSE_SHIFT)
 /** return an error */
-#define RET_ERR(e, off) ((int)(((e)&LDNS_WIREPARSE_MASK)|(((off)&RET_OFFSET_MASK)<<LDNS_WIREPARSE_SHIFT)))
+#define RET_ERR(e, off) ((int)((e)|((off)<<LDNS_WIREPARSE_SHIFT)))
 /** Move parse error but keep its ID */
 #define RET_ERR_SHIFT(e, move) RET_ERR(LDNS_WIREPARSE_ERROR(e), LDNS_WIREPARSE_OFFSET(e)+(move));

@@ -249,16 +247,11 @@ rrinternal_get_ttl(sldns_buffer* strbuf, char* token, size_t token_len,
 	int* not_there, uint32_t* ttl, uint32_t default_ttl)
 {
 	const char* endptr;
-	int overflow;
 	if(sldns_bget_token(strbuf, token, "\t\n ", token_len) == -1) {
 		return RET_ERR(LDNS_WIREPARSE_ERR_SYNTAX_TTL,
 			sldns_buffer_position(strbuf));
 	}
-	*ttl = (uint32_t) sldns_str2period(token, &endptr, &overflow);
-	if(overflow) {
-		return RET_ERR(LDNS_WIREPARSE_ERR_SYNTAX_INTEGER_OVERFLOW,
-			sldns_buffer_position(strbuf));
-	}
+	*ttl = (uint32_t) sldns_str2period(token, &endptr);

 	if (strlen(token) > 0 && !isdigit((unsigned char)token[0])) {
 		*not_there = 1;
@@ -378,8 +371,7 @@ rrinternal_get_quoted(sldns_buffer* strbuf, const char** delimiters,

 		/* skip spaces */
 		while(sldns_buffer_remaining(strbuf) > 0 &&
-			(*(sldns_buffer_current(strbuf)) == ' ' ||
-			*(sldns_buffer_current(strbuf)) == '\t')) {
+			*(sldns_buffer_current(strbuf)) == ' ') {
 			sldns_buffer_skip(strbuf, 1);
 		}

@@ -610,10 +602,7 @@ sldns_affix_token(sldns_buffer* strbuf, char* token, size_t* token_len,
 	size_t addstrlen = 0;

 	/* add space */
-	/* when addlen < 2, the token buffer is full considering the NULL byte
-	 * from strlen and will lead to buffer overflow with the second
-	 * assignment below. */
-	if(addlen < 2) return 0;
+	if(addlen < 1) return 0;
 	token[*token_strlen] = ' ';
 	token[++(*token_strlen)] = 0;

@@ -676,10 +665,10 @@ static int sldns_str2wire_check_svcbparams(uint8_t* rdata, uint16_t rdata_len)
 	     ,sldns_str2wire_svcparam_key_cmp);


-	/* The code below revolves around semantic errors in the SVCParam set.
+	/* The code below revolves around sematic errors in the SVCParam set.
 	 * So long as we do not distinguish between running Unbound as a primary
 	 * or as a secondary, we default to secondary behavior and we ignore the
-	 * semantic errors. */
+	 * sematic errors. */

 #ifdef SVCB_SEMANTIC_ERRORS
 	{
@@ -781,8 +770,7 @@ rrinternal_parse_rdata(sldns_buffer* strbuf, char* token, size_t token_len,

 		/* unknown RR data */
 		if(token_strlen>=2 && strncmp(token, "\\#", 2) == 0 &&
-			!quoted && (token_strlen == 2 || token[2]==' ' ||
-			token[2]=='\t')) {
+			!quoted && (token_strlen == 2 || token[2]==' ')) {
 			was_unknown_rr_format = 1;
 			if((status=rrinternal_parse_unknown(strbuf, token,
 				token_len, rr, rr_len, &rr_cur_len, 
@@ -1062,15 +1050,12 @@ int sldns_fp2wire_rr_buf(FILE* in, uint8_t* rr, size_t* len, size_t* dname_len,
 		return s;
 	} else if(strncmp(line, "$TTL", 4) == 0 && isspace((unsigned char)line[4])) {
 		const char* end = NULL;
-		int overflow = 0;
 		strlcpy((char*)rr, line, *len);
 		*len = 0;
 		*dname_len = 0;
 		if(!parse_state) return LDNS_WIREPARSE_ERR_OK;
 		parse_state->default_ttl = sldns_str2period(
-			sldns_strip_ws(line+5), &end, &overflow);
-		if(overflow)
-			return LDNS_WIREPARSE_ERR_SYNTAX_INTEGER_OVERFLOW;
+			sldns_strip_ws(line+5), &end);
 	} else if (strncmp(line, "$INCLUDE", 8) == 0) {
 		strlcpy((char*)rr, line, *len);
 		*len = 0;
@@ -1127,7 +1112,7 @@ sldns_str2wire_svcparam_key_lookup(const char *key, size_t key_len)
 		if (!strncmp(key, "mandatory", sizeof("mandatory")-1))
 			return SVCB_KEY_MANDATORY;
 		if (!strncmp(key, "echconfig", sizeof("echconfig")-1))
-			return SVCB_KEY_ECH; /* allow "echconfig" as well as "ech" */
+			return SVCB_KEY_ECH; /* allow "echconfig as well as "ech" */
 		break;

 	case sizeof("alpn")-1:
@@ -1366,7 +1351,7 @@ sldns_str2wire_svcbparam_mandatory(const char* val, uint8_t* rd, size_t* rd_len)
 	 */
 	qsort((void *)(rd + 4), count, sizeof(uint16_t), sldns_network_uint16_cmp);

-	/* The code below revolves around semantic errors in the SVCParam set.
+	/* The code below revolves around sematic errors in the SVCParam set.
 	 * So long as we do not distinguish between running Unbound as a primary
 	 * or as a secondary, we default to secondary behavior and we ignore the
 	 * semantic errors. */
@@ -1598,12 +1583,12 @@ static int sldns_str2wire_svcparam_buf(const char* str, uint8_t* rd, size_t* rd_
 		if (*val_in == '"') {
 			val_in++;
 			while (*val_in != '"'
-			&& (size_t)(val_out - unescaped_val + 1) < sizeof(unescaped_val)
+			&& (unsigned)(val_out - unescaped_val + 1) < sizeof(unescaped_val)
 			&& sldns_parse_char( (uint8_t*) val_out, &val_in)) {
 				val_out++;
 			}
 		} else {
-			while ((size_t)(val_out - unescaped_val + 1) < sizeof(unescaped_val)
+			while ((unsigned)(val_out - unescaped_val + 1) < sizeof(unescaped_val)
 			&& sldns_parse_char( (uint8_t*) val_out, &val_in)) {
 				val_out++;
 			}
@@ -2167,13 +2152,9 @@ int sldns_str2wire_tsigtime_buf(const char* str, uint8_t* rd, size_t* len)
 int sldns_str2wire_period_buf(const char* str, uint8_t* rd, size_t* len)
 {
 	const char* end;
-	int overflow;
-	uint32_t p = sldns_str2period(str, &end, &overflow);
+	uint32_t p = sldns_str2period(str, &end);
 	if(*end != 0)
 		return RET_ERR(LDNS_WIREPARSE_ERR_SYNTAX_PERIOD, end-str);
-	if(overflow)
-		return RET_ERR(LDNS_WIREPARSE_ERR_SYNTAX_INTEGER_OVERFLOW,
-			end-str);
 	if(*len < 4)
 		return LDNS_WIREPARSE_ERR_BUFFER_TOO_SMALL;
 	sldns_write_uint32(rd, p);
@@ -187,7 +187,7 @@ uint8_t* sldns_wirerr_get_rdatawl(uint8_t* rr, size_t len, size_t dname_len);
 #define LDNS_WIREPARSE_MASK 0x0fff
 #define LDNS_WIREPARSE_SHIFT 12
 #define LDNS_WIREPARSE_ERROR(e) ((e)&LDNS_WIREPARSE_MASK)
-#define LDNS_WIREPARSE_OFFSET(e) ((((unsigned)(e))&~LDNS_WIREPARSE_MASK)>>LDNS_WIREPARSE_SHIFT)
+#define LDNS_WIREPARSE_OFFSET(e) (((e)&~LDNS_WIREPARSE_MASK)>>LDNS_WIREPARSE_SHIFT)
 /* use lookuptable to get error string, sldns_wireparse_errors */
 #define LDNS_WIREPARSE_ERR_OK 0
 #define LDNS_WIREPARSE_ERR_GENERAL 342
@@ -194,7 +194,6 @@ static sldns_lookup_table sldns_edns_options_data[] = {
 	{ 8, "edns-client-subnet" },
 	{ 11, "edns-tcp-keepalive"},
 	{ 12, "Padding" },
-	{ 15, "EDE"},
 	{ 0, NULL}
 };
 sldns_lookup_table* sldns_edns_options = sldns_edns_options_data;
@@ -818,7 +817,6 @@ int sldns_wire2str_dname_scan(uint8_t** d, size_t* dlen, char** s, size_t* slen,
 	unsigned i, counter=0;
 	unsigned maxcompr = MAX_COMPRESS_PTRS; /* loop detection, max compr ptrs */
 	int in_buf = 1;
-	size_t dname_len = 0;
 	if(comprloop) {
 		if(*comprloop != 0)
 			maxcompr = 30; /* for like ipv6 reverse name, per label */
@@ -874,16 +872,6 @@ int sldns_wire2str_dname_scan(uint8_t** d, size_t* dlen, char** s, size_t* slen,
 			labellen = (uint8_t)*dlen;
 		else if(!in_buf && pos+(size_t)labellen > pkt+pktlen)
 			labellen = (uint8_t)(pkt + pktlen - pos);
-		dname_len += ((size_t)labellen)+1;
-		if(dname_len > LDNS_MAX_DOMAINLEN) {
-			/* dname_len counts the uncompressed length we have
-			 * seen so far, and the domain name has become too
-			 * long, prevent the loop from printing overly long
-			 * content. */
-			w += sldns_str_print(s, slen,
-				"ErrorDomainNameTooLong");
-			return w;
-		}
 		for(i=0; i<(unsigned)labellen; i++) {
 			w += dname_char_print(s, slen, *pos++);
 		}
@@ -1071,7 +1059,7 @@ static int sldns_wire2str_svcparam_mandatory2str(char** s,
 	assert(data_len > 0);

 	if (data_len % sizeof(uint16_t))
-		return -1; /* wireformat error, data_len must be multiple of shorts */
+		return -1; // wireformat error, data_len must be multiple of shorts
 	w += sldns_str_print(s, slen, "=");
 	w += sldns_print_svcparamkey(s, slen, sldns_read_uint16(data));
 	data += 2;
@@ -408,28 +408,6 @@ interfacechecks(struct config_file* cfg)
 	}
 }

-/** check interface-automatic-ports */
-static void
-ifautomaticportschecks(char* ifautomaticports)
-{
-	char* now = ifautomaticports;
-	while(now && *now) {
-		char* after;
-		int extraport;
-		while(isspace((unsigned char)*now))
-			now++;
-		if(!*now)
-			break;
-		after = now;
-		extraport = (int)strtol(now, &after, 10);
-		if(extraport < 0 || extraport > 65535)
-			fatal_exit("interface-automatic-ports: port out of range at position %d in '%s'", (int)(now-ifautomaticports)+1, ifautomaticports);
-		if(extraport == 0 && now == after)
-			fatal_exit("interface-automatic-ports: parse error at position %d in '%s'", (int)(now-ifautomaticports)+1, ifautomaticports);
-		now = after;
-	}
-}
-
 /** check acl ips */
 static void
 aclchecks(struct config_file* cfg)
@@ -630,7 +608,6 @@ morechecks(struct config_file* cfg)
 	warn_hosts("stub-host", cfg->stubs);
 	warn_hosts("forward-host", cfg->forwards);
 	interfacechecks(cfg);
-	ifautomaticportschecks(cfg->if_automatic_ports);
 	aclchecks(cfg);
 	tcpconnlimitchecks(cfg);

@@ -810,10 +787,6 @@ morechecks(struct config_file* cfg)
 		&& strcmp(cfg->module_conf, "validator python cachedb iterator") != 0
 		&& strcmp(cfg->module_conf, "respip validator python cachedb iterator") != 0
 #endif
-#if defined(CLIENT_SUBNET) && defined(USE_CACHEDB)
-		&& strcmp(cfg->module_conf, "respip subnetcache validator cachedb iterator") != 0
-		&& strcmp(cfg->module_conf, "subnetcache validator cachedb iterator") != 0
-#endif
 #ifdef CLIENT_SUBNET
 		&& strcmp(cfg->module_conf, "subnetcache iterator") != 0
 		&& strcmp(cfg->module_conf, "respip subnetcache iterator") != 0
@@ -155,9 +155,9 @@ usage(void)
 	printf("  ratelimit_list [+a]		list ratelimited domains\n");
 	printf("  ip_ratelimit_list [+a]	list ratelimited ip addresses\n");
 	printf("		+a		list all, also not ratelimited\n");
-	printf("  list_auth_zones		list auth zones (includes RPZ zones)\n");
-	printf("  auth_zone_reload zone		reload auth zone (or RPZ zone) from zonefile\n");
-	printf("  auth_zone_transfer zone	transfer auth zone (or RPZ zone) from master\n");
+	printf("  list_auth_zones		list auth zones\n");
+	printf("  auth_zone_reload zone		reload auth zone from zonefile\n");
+	printf("  auth_zone_transfer zone	transfer auth zone from master\n");
 	printf("  view_list_local_zones	view	list local-zones in view\n");
 	printf("  view_list_local_data	view	list local-data RRs in view\n");
 	printf("  view_local_zone view name type  	add local-zone in view\n");
@@ -354,7 +354,6 @@ static void print_extended(struct ub_stats_info* s)
 	/* transport */
 	PR_UL("num.query.tcp", s->svr.qtcp);
 	PR_UL("num.query.tcpout", s->svr.qtcp_outgoing);
-	PR_UL("num.query.udpout", s->svr.qudp_outgoing);
 	PR_UL("num.query.tls", s->svr.qtls);
 	PR_UL("num.query.tls_resume", s->svr.qtls_resume);
 	PR_UL("num.query.ipv6", s->svr.qipv6);
@@ -445,7 +444,7 @@ static void do_stats_shm(struct config_file* cfg, struct ub_stats_info* stats,
 #endif /* HAVE_SHMGET */

 /** print statistics from shm memory segment */
-static void print_stats_shm(const char* cfgfile, int quiet)
+static void print_stats_shm(const char* cfgfile)
 {
 #ifdef HAVE_SHMGET
 	struct config_file* cfg;
@@ -475,11 +474,8 @@ static void print_stats_shm(const char* cfgfile, int quiet)
 		fatal_exit("shmat(%d): %s", id_arr, strerror(errno));
 	}

-
-	if(!quiet) {
-		/* print the stats */
-		do_stats_shm(cfg, stats, shm_stat);
-	}
+	/* print the stats */
+	do_stats_shm(cfg, stats, shm_stat);

 	/* shutdown */
 	shmdt(shm_stat);
@@ -487,7 +483,6 @@ static void print_stats_shm(const char* cfgfile, int quiet)
 	config_delete(cfg);
 #else
 	(void)cfgfile;
-	(void)quiet;
 #endif /* HAVE_SHMGET */
 }

@@ -504,7 +499,7 @@ static void ssl_path_err(const char* s, const char *path)
 {
 	unsigned long err;
 	err = ERR_peek_error();
-	if(ERR_GET_LIB(err) == ERR_LIB_SYS) {
+	if (ERR_GET_LIB(err) == ERR_LIB_SYS) {
 		fprintf(stderr, "error: %s\n%s: %s\n",
 			s, path, ERR_reason_error_string(err));
 		exit(1);
@@ -546,11 +541,11 @@ setup_ctx(struct config_file* cfg)
 #endif
 	if(!SSL_CTX_use_certificate_chain_file(ctx,c_cert))
 		ssl_path_err("Error setting up SSL_CTX client cert", c_cert);
-	if(!SSL_CTX_use_PrivateKey_file(ctx,c_key,SSL_FILETYPE_PEM))
+	if (!SSL_CTX_use_PrivateKey_file(ctx,c_key,SSL_FILETYPE_PEM))
 		ssl_path_err("Error setting up SSL_CTX client key", c_key);
-	if(!SSL_CTX_check_private_key(ctx))
+	if (!SSL_CTX_check_private_key(ctx))
 		ssl_err("Error setting up SSL_CTX client key");
-	if(SSL_CTX_load_verify_locations(ctx, s_cert, NULL) != 1)
+	if (SSL_CTX_load_verify_locations(ctx, s_cert, NULL) != 1)
 		ssl_path_err("Error setting up SSL_CTX verify, server cert",
 			     s_cert);
 	SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, NULL);
@@ -885,9 +880,8 @@ go_cmd(SSL* ssl, int fd, int quiet, int argc, char* argv[])
 		if(first_line && strncmp(buf, "error", 5) == 0) {
 			printf("%s", buf);
 			was_error = 1;
-		} else if(!quiet) {
+		} else if (!quiet)
 			printf("%s", buf);
-		}

 		first_line = 0;
 	}
@@ -993,7 +987,7 @@ int main(int argc, char* argv[])
 #endif
 	}
 	if(argc >= 1 && strcmp(argv[0], "stats_shm")==0) {
-		print_stats_shm(cfgfile, quiet);
+		print_stats_shm(cfgfile);
 		return 0;
 	}
 	check_args_for_listcmd(argc, argv);
@@ -97,12 +97,10 @@ void worker_sighandler(int ATTR_UNUSED(sig), void* ATTR_UNUSED(arg))
 struct outbound_entry* worker_send_query(
 	struct query_info* ATTR_UNUSED(qinfo), uint16_t ATTR_UNUSED(flags),
 	int ATTR_UNUSED(dnssec), int ATTR_UNUSED(want_dnssec),
-	int ATTR_UNUSED(nocaps), int ATTR_UNUSED(check_ratelimit),
-	struct sockaddr_storage* ATTR_UNUSED(addr),
+	int ATTR_UNUSED(nocaps), struct sockaddr_storage* ATTR_UNUSED(addr),
 	socklen_t ATTR_UNUSED(addrlen), uint8_t* ATTR_UNUSED(zone),
 	size_t ATTR_UNUSED(zonelen), int ATTR_UNUSED(tcp_upstream), int ATTR_UNUSED(ssl_upstream),
-	char* ATTR_UNUSED(tls_auth_name), struct module_qstate* ATTR_UNUSED(q),
-	int* ATTR_UNUSED(was_ratelimited))
+	char* ATTR_UNUSED(tls_auth_name), struct module_qstate* ATTR_UNUSED(q))
 {
 	log_assert(0);
 	return 0;
@@ -131,12 +129,10 @@ worker_alloc_cleanup(void* ATTR_UNUSED(arg))
 struct outbound_entry* libworker_send_query(
 	struct query_info* ATTR_UNUSED(qinfo), uint16_t ATTR_UNUSED(flags),
 	int ATTR_UNUSED(dnssec), int ATTR_UNUSED(want_dnssec),
-	int ATTR_UNUSED(nocaps), int ATTR_UNUSED(check_ratelimit),
-	struct sockaddr_storage* ATTR_UNUSED(addr),
+	int ATTR_UNUSED(nocaps), struct sockaddr_storage* ATTR_UNUSED(addr),
 	socklen_t ATTR_UNUSED(addrlen), uint8_t* ATTR_UNUSED(zone),
 	size_t ATTR_UNUSED(zonelen), int ATTR_UNUSED(tcp_upstream), int ATTR_UNUSED(ssl_upstream),
-	char* ATTR_UNUSED(tls_auth_name), struct module_qstate* ATTR_UNUSED(q),
-	int* ATTR_UNUSED(was_ratelimited))
+	char* ATTR_UNUSED(tls_auth_name), struct module_qstate* ATTR_UNUSED(q))
 {
 	log_assert(0);
 	return 0;
@@ -551,7 +551,7 @@ run(struct http2_session* h2_session, int port, int no_tls, int count, char** q)
 	if(ctx) {
 		SSL_CTX_free(ctx);
 	}
-	sock_close(fd);
+	close(fd);
 }

 /** getopt global, in case header files fail to declare it. */
@@ -1187,13 +1187,12 @@ pending_tcp_query(struct serviced_query* sq, sldns_buffer* packet,
 struct serviced_query* outnet_serviced_query(struct outside_network* outnet,
 	struct query_info* qinfo, uint16_t flags, int dnssec,
 	int ATTR_UNUSED(want_dnssec), int ATTR_UNUSED(nocaps),
-	int ATTR_UNUSED(check_ratelimit),
 	int ATTR_UNUSED(tcp_upstream), int ATTR_UNUSED(ssl_upstream),
 	char* ATTR_UNUSED(tls_auth_name), struct sockaddr_storage* addr,
 	socklen_t addrlen, uint8_t* zone, size_t zonelen,
 	struct module_qstate* qstate, comm_point_callback_type* callback,
 	void* callback_arg, sldns_buffer* ATTR_UNUSED(buff),
-	struct module_env* env, int* ATTR_UNUSED(was_ratelimited))
+	struct module_env* env)
 {
 	struct replay_runtime* runtime = (struct replay_runtime*)outnet->base;
 	struct fake_pending* pend = (struct fake_pending*)calloc(1,
@@ -1223,37 +1222,11 @@ struct serviced_query* outnet_serviced_query(struct outside_network* outnet,
 	if(1) {
 		struct edns_data edns;
 		struct edns_string_addr* client_string_addr;
-		struct edns_option* backed_up_opt_list =
-			qstate->edns_opts_back_out;
-		struct edns_option* per_upstream_opt_list = NULL;
-		/* If we have an already populated EDNS option list make a copy
-		 * since we may now add upstream specific EDNS options. */
-		if(qstate->edns_opts_back_out) {
-			per_upstream_opt_list = edns_opt_copy_region(
-				qstate->edns_opts_back_out, qstate->region);
-			if(!per_upstream_opt_list) {
-				free(pend);
-				fatal_exit("out of memory");
-			}
-			qstate->edns_opts_back_out = per_upstream_opt_list;
-		}
 		if(!inplace_cb_query_call(env, qinfo, flags, addr, addrlen,
 			zone, zonelen, qstate, qstate->region)) {
 			free(pend);
 			return NULL;
 		}
-		/* Restore the option list; we can explicitly use the copied
-		 * one from now on. */
-		per_upstream_opt_list = qstate->edns_opts_back_out;
-		qstate->edns_opts_back_out = backed_up_opt_list;
-		if((client_string_addr = edns_string_addr_lookup(
-			&env->edns_strings->client_strings,
-			addr, addrlen))) {
-			edns_opt_list_append(&per_upstream_opt_list,
-				env->edns_strings->client_string_opcode,
-				client_string_addr->string_len,
-				client_string_addr->string, qstate->region);
-		}
 		/* add edns */
 		edns.edns_present = 1;
 		edns.ext_rcode = 0;
@@ -1263,8 +1236,16 @@ struct serviced_query* outnet_serviced_query(struct outside_network* outnet,
 		if(dnssec)
 			edns.bits = EDNS_DO;
 		edns.padding_block_size = 0;
+		if((client_string_addr = edns_string_addr_lookup(
+			&env->edns_strings->client_strings,
+			addr, addrlen))) {
+			edns_opt_list_append(&qstate->edns_opts_back_out,
+				env->edns_strings->client_string_opcode,
+				client_string_addr->string_len,
+				client_string_addr->string, qstate->region);
+		}
 		edns.opt_list_in = NULL;
-		edns.opt_list_out = per_upstream_opt_list;
+		edns.opt_list_out = qstate->edns_opts_back_out;
 		edns.opt_list_inplace_cb_out = NULL;
 		attach_edns_record(pend->buffer, &edns);
 	}
@@ -1443,11 +1424,6 @@ void pending_udp_timer_cb(void *ATTR_UNUSED(arg))
 	log_assert(0);
 }

-void serviced_timer_cb(void *ATTR_UNUSED(arg))
-{
-	log_assert(0);
-}
-
 void pending_udp_timer_delay_cb(void *ATTR_UNUSED(arg))
 {
 	log_assert(0);
@@ -5,10 +5,6 @@ if test "$1" = "-a"; then
 	shift
 	shift
 fi
-
-# This will keep the temporary directory around and return 1 when the test failed.
-DEBUG=0
-
 quiet=0
 if test "$1" = "-q"; then
 	quiet=1
@@ -188,18 +184,11 @@ echo "DateRunEnd: "`date "+%s" 2>/dev/null` >> $result

 mv $result ..
 cd ..
-if test $DEBUG -eq 0; then
+rm -rf $dir
+# compat for windows where deletion may not succeed initially (files locked
+# by processes that still have to exit).
+if test $? -eq 1; then
+	echo "minitdir waiting for processes to terminate"
+	sleep 2 # some time to exit, and try again
 	rm -rf $dir
-	# compat for windows where deletion may not succeed initially (files locked
-	# by processes that still have to exit).
-	if test $? -eq 1; then
-		echo "minitdir waiting for processes to terminate"
-		sleep 2 # some time to exit, and try again
-		rm -rf $dir
-	fi
-else
-	if test $success == "no"; then
-		exit 1
-	fi
-	exit 0
 fi
@@ -582,9 +582,10 @@ do_service(char* addr, int port, char* key, char* cert)
 {
 	SSL_CTX* sslctx = setup_ctx(key, cert);
 	int fd = setup_fd(addr, port);
+	int go = 1;
 	if(fd == -1) print_exit("could not setup sockets");
 	if(verb) {printf("petal start\n"); fflush(stdout);}
-	while(1) {
+	while(go) {
 		struct sockaddr_storage from;
 		socklen_t flen = (socklen_t)sizeof(from);
 		int s;
@@ -157,14 +157,7 @@ static void matchline(char* line, struct entry* e)
 			if(*parse != '=' && *parse != ':')
 				error("expected = or : in MATCH: %s", line);
 			parse++;
-			while(isspace((unsigned char)*parse))
-				parse++;
-			if(str_keyword(&parse, "any")) {
-				e->match_ede_any = 1;
-			} else {
-				e->ede_info_code = (uint16_t)strtol(parse,
-					(char**)&parse, 10);
-			}
+			e->ede_info_code = (uint16_t)strtol(parse, (char**)&parse, 10);
 			while(isspace((unsigned char)*parse))
 				parse++;
 		} else {
@@ -290,8 +283,7 @@ static struct entry* new_entry(void)
 	e->match_serial = 0;
 	e->ixfr_soa_serial = 0;
 	e->match_ede = 0;
-	e->match_ede_any = 0;
-	e->ede_info_code = -1;
+	e->ede_info_code = 0;
 	e->match_transport = transport_any;
 	e->reply_list = NULL;
 	e->copy_id = 0;
@@ -905,34 +897,25 @@ get_do_flag(uint8_t* pkt, size_t len)
 	return (int)(edns_bits&LDNS_EDNS_MASK_DO_BIT);
 }

-/** Snips the EDE option out of the OPT record and returns the EDNS EDE
- *  INFO-CODE if found, else -1 */
+/** return the EDNS EDE INFO-CODE if found, else -1 */
 static int
-extract_ede(uint8_t* pkt, size_t len)
+get_ede_info_code(uint8_t* pkt, size_t len)
 {
-	uint8_t *rdata, *opt_position = pkt;
+	uint8_t *rdata;
 	uint16_t rdlen, optlen;
-	size_t remaining = len;
-	int ede_code;
-	if(!pkt_find_edns_opt(&opt_position, &remaining)) return -1;
-	if(remaining < 8) return -1; /* malformed */
-	rdlen = sldns_read_uint16(opt_position+6);
-	rdata = opt_position + 8;
+	/* use arguments as temporary variables */
+	if(!pkt_find_edns_opt(&pkt, &len)) return -1;
+	if(len < 8) return -1; /* malformed */
+	rdlen = sldns_read_uint16(pkt+6);
+	rdata = pkt + 8;
 	while(rdlen > 0) {
 		if(rdlen < 4) return -1; /* malformed */
-		optlen = sldns_read_uint16(rdata+2);
 		if(sldns_read_uint16(rdata) == LDNS_EDNS_EDE) {
 			if(rdlen < 6) return -1; /* malformed */
-			ede_code = sldns_read_uint16(rdata+4);
-			/* snip option from packet; assumes len is correct */
-			memmove(rdata, rdata+4+optlen,
-				(pkt+len)-(rdata+4+optlen));
-			/* update OPT size */
-			sldns_write_uint16(opt_position+6,
-				sldns_read_uint16(opt_position+6)-(4+optlen));
-			return ede_code;
+			return sldns_read_uint16(rdata+4);
 		}
-		rdlen -= 4 + optlen;
+		optlen = sldns_read_uint16(rdata+2);
+		rdlen -= optlen;
 		rdata += 4 + optlen;
 	}
 	return -1;
@@ -1350,7 +1333,7 @@ match_answer(uint8_t* q, size_t qlen, uint8_t* p, size_t plen, int mttl)
 *  zero out if at end of the string */
 static int
 ignore_edns_lines(char* str) {
-	char* edns = str, *n;
+	char* current = str, *edns = str, *n;
 	size_t str_len = strlen(str);
 	while((edns = strstr(edns, "; EDNS"))) {
 		n = strchr(edns, '\n');
@@ -1372,10 +1355,10 @@ match_all(uint8_t* q, size_t qlen, uint8_t* p, size_t plen, int mttl,
 	char* qstr, *pstr;
 	uint8_t* qb = q, *pb = p;
 	int r;
+	/* zero TTLs */
 	qb = memdup(q, qlen);
 	pb = memdup(p, plen);
 	if(!qb || !pb) error("out of memory");
-	/* zero TTLs */
 	if(!mttl) {
 		zerottls(qb, qlen);
 		zerottls(pb, plen);
@@ -1505,31 +1488,12 @@ find_match(struct entry* entries, uint8_t* query_pkt, size_t len,
 	enum transport_type transport)
 {
 	struct entry* p = entries;
-	uint8_t* reply, *query_pkt_orig;
-	size_t rlen, query_pkt_orig_len;
-	/* Keep the original packet; it may be modified */
-	query_pkt_orig = memdup(query_pkt, len);
-	query_pkt_orig_len = len;
+	uint8_t* reply;
+	size_t rlen;
 	for(p=entries; p; p=p->next) {
 		verbose(3, "comparepkt: ");
 		reply = p->reply_list->reply_pkt;
 		rlen = p->reply_list->reply_len;
-		/* Restore the original packet for each entry */
-		memcpy(query_pkt, query_pkt_orig, query_pkt_orig_len);
-		/* EDE should be first since it may modify the query_pkt */
-		if(p->match_ede) {
-			int info_code = extract_ede(query_pkt, len);
-			if(info_code == -1) {
-				verbose(3, "bad EDE. Expected but not found\n");
-				continue;
-			} else if(!p->match_ede_any &&
-				(uint16_t)info_code != p->ede_info_code) {
-				verbose(3, "bad EDE INFO-CODE. Expected: %d, "
-					"and got: %d\n", (int)p->ede_info_code,
-					info_code);
-				continue;
-			}
-		}
 		if(p->match_opcode && get_opcode(query_pkt, len) !=
 			get_opcode(reply, rlen)) {
 			verbose(3, "bad opcode\n");
@@ -1581,6 +1545,15 @@ find_match(struct entry* entries, uint8_t* query_pkt, size_t len,
 				verbose(3, "bad serial\n");
 				continue;
 		}
+		if(p->match_ede) {
+			int info_code = get_ede_info_code(query_pkt, len);
+			if(info_code == -1 ||
+				(uint16_t)info_code != p->ede_info_code) {
+				verbose(3, "bad EDE INFO-CODE. Expected: %d, and got: %d\n",
+					p->ede_info_code, info_code);
+				continue;
+			}
+		}
 		if(p->match_do && !get_do_flag(query_pkt, len)) {
 			verbose(3, "no DO bit set\n");
 			continue;
@@ -1609,14 +1582,8 @@ find_match(struct entry* entries, uint8_t* query_pkt, size_t len,
 			continue;
 		}
 		verbose(3, "match!\n");
-		/* Restore the original packet */
-		memcpy(query_pkt, query_pkt_orig, query_pkt_orig_len);
-		free(query_pkt_orig);
 		return p;
 	}
-	/* Restore the original packet */
-	memcpy(query_pkt, query_pkt_orig, query_pkt_orig_len);
-	free(query_pkt_orig);
 	return NULL;
 }

@@ -59,11 +59,6 @@ struct sldns_file_parse_state;
 	; 'UDP' matches if the transport is UDP.
 	; 'TCP' matches if the transport is TCP.
 	; 'ede=2' makes the query match if the EDNS EDE info-code is 2.
-	;	It also snips the EDE record out of the packet to facilitate
-	;	other matches.
-	; 'ede=any' makes the query match any EDNS EDE info-code.
-	;	It also snips the EDE record out of the packet to facilitate
-	;	other matches.
 	MATCH [opcode] [qtype] [qname] [serial=<value>] [all] [ttl]
 	MATCH [UDP|TCP] DO
 	MATCH ...
@@ -200,8 +195,6 @@ struct entry {
 	uint8_t match_serial;
 	/** match EDNS EDE info-code */
 	uint8_t match_ede;
-	/** match any EDNS EDE info-code */
-	uint8_t match_ede_any;
 	/** match all of the packet */
 	uint8_t match_all;
 	/** match all of the packet; ignore EDNS */
@@ -243,28 +243,28 @@ b64_test(void)

 	memset(target, 0, sizeof(target));
 	result = sldns_b64_pton(p1, (uint8_t*)target, tarsize);
-	unit_assert(result == (int)strlen("hello") && strcmp(target, "hello") == 0);
+	unit_assert(result == strlen("hello") && strcmp(target, "hello") == 0);
 	memset(target, 0, sizeof(target));
 	result = sldns_b64_pton(p2, (uint8_t*)target, tarsize);
-	unit_assert(result == (int)strlen("hello>") && strcmp(target, "hello>") == 0);
+	unit_assert(result == strlen("hello>") && strcmp(target, "hello>") == 0);
 	memset(target, 0, sizeof(target));
 	result = sldns_b64_pton(p3, (uint8_t*)target, tarsize);
-	unit_assert(result == (int)strlen("hello?!") && strcmp(target, "hello?!") == 0);
+	unit_assert(result == strlen("hello?!") && strcmp(target, "hello?!") == 0);
 	memset(target, 0, sizeof(target));
 	result = sldns_b64_pton(p4, (uint8_t*)target, tarsize);
 	/* when padding is used everything that is not a block of 4 will be
 	 * ignored */
-	unit_assert(result == (int)strlen("hel") && strcmp(target, "hel") == 0);
+	unit_assert(result == strlen("hel") && strcmp(target, "hel") == 0);

 	memset(target, 0, sizeof(target));
 	result = sldns_b64url_pton(u1, strlen(u1), (uint8_t*)target, tarsize);
-	unit_assert(result == (int)strlen("hello") && strcmp(target, "hello") == 0);
+	unit_assert(result == strlen("hello") && strcmp(target, "hello") == 0);
 	memset(target, 0, sizeof(target));
 	result = sldns_b64url_pton(u2, strlen(u2), (uint8_t*)target, tarsize);
-	unit_assert(result == (int)strlen("hello>") && strcmp(target, "hello>") == 0);
+	unit_assert(result == strlen("hello>") && strcmp(target, "hello>") == 0);
 	memset(target, 0, sizeof(target));
 	result = sldns_b64url_pton(u3, strlen(u3), (uint8_t*)target, tarsize);
-	unit_assert(result == (int)strlen("hello+/") && strcmp(target, "hello?!") == 0);
+	unit_assert(result == strlen("hello+/") && strcmp(target, "hello?!") == 0);
 	/* one item in block of four is not allowed */
 	memset(target, 0, sizeof(target));
 	result = sldns_b64url_pton(u4, strlen(u4), (uint8_t*)target, tarsize);
@@ -918,7 +918,7 @@ main(int argc, char* argv[])
 	checklock_stop();
 	printf("%d checks ok.\n", testcount);
 #ifdef HAVE_SSL
-#  if defined(USE_GOST)
+#  if defined(USE_GOST) && defined(HAVE_LDNS_KEY_EVP_UNLOAD_GOST)
 	sldns_key_EVP_unload_gost();
 #  endif
 #  ifdef HAVE_OPENSSL_CONFIG
@@ -187,7 +187,7 @@ verifytest_rrset(struct module_env* env, struct val_env* ve,
 	}
 	setup_sigalg(dnskey, sigalg); /* check all algorithms in the dnskey */
 	/* ok to give null as qstate here, won't be used for answer section. */
-	sec = dnskeyset_verify_rrset(env, ve, rrset, dnskey, sigalg, &reason, NULL,
+	sec = dnskeyset_verify_rrset(env, ve, rrset, dnskey, sigalg, &reason,
 		LDNS_SECTION_ANSWER, NULL);
 	if(vsig) {
 		printf("verify outcome is: %s %s\n", sec_status_to_string(sec),
@@ -221,10 +221,10 @@ static void zonemd_check_test(void)
 	unit_assert(result && reason == NULL);
 	result = auth_zone_generate_zonemd_check(z, 241, hashalgo,
 		hash, hashlen, region, buf, &reason);
-	unit_assert(result && strcmp(reason, "unsupported scheme")==0);
+	unit_assert(!result && strcmp(reason, "unsupported scheme")==0);
 	result = auth_zone_generate_zonemd_check(z, scheme, 242,
 		hash, hashlen, region, buf, &reason);
-	unit_assert(result && strcmp(reason, "unsupported algorithm")==0);
+	unit_assert(!result && strcmp(reason, "unsupported algorithm")==0);
 	result = auth_zone_generate_zonemd_check(z, scheme, hashalgo,
 		hash, 2, region, buf, &reason);
 	unit_assert(!result && strcmp(reason, "digest length too small, less than 12")==0);
@@ -5,7 +5,6 @@
 [ -f .tpkg.var.test ] && source .tpkg.var.test

 PRE="../.."
-. ../common.sh
 # do the test
 echo "> dig www.example.com."
 dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
@@ -49,15 +48,4 @@ else
 	exit 1
 fi

-# Test that notify is allowed from the webserver address
-get_ldns_notify
-echo "> ldns-notify -z example.com"
-$LDNS_NOTIFY -p $UNBOUND_PORT -z example.com 127.0.0.1 | tee outfile
-if grep "rcode: REFUSED"  outfile; then
-	echo "Not OK"
-	exit 1
-else
-	echo "OK"
-fi
-
 exit 0
@@ -1,184 +0,0 @@
-; config options
-server:
-	target-fetch-policy: "0 0 0 0 0"
-
-auth-zone:
-	name: "example.com."
-	## zonefile (or none).
-	## zonefile: "example.com.zone"
-	## master by IP address or hostname
-	## can list multiple masters, each on one line.
-	## master:
-	## url for http fetch
-	## url:
-	## queries from downstream clients get authoritative answers.
-	## for-downstream: yes
-	for-downstream: no
-	## queries are used to fetch authoritative answers from this zone,
-	## instead of unbound itself sending queries there.
-	## for-upstream: yes
-	for-upstream: yes
-	## on failures with for-upstream, fallback to sending queries to
-	## the authority servers
-	## fallback-enabled: no
-	zonemd-check: yes
-
-	## this line generates zonefile: \n"/tmp/xxx.example.com"\n
-	zonefile:
-TEMPFILE_NAME example.com
-	## this is the inline file /tmp/xxx.example.com
-	## the tempfiles are deleted when the testrun is over.
-TEMPFILE_CONTENTS example.com
-example.com. IN SOA ns.example.com. hostmaster.example.com. 200154054 28800 7200 604800 3600
-example.com. IN NS ns.example.com.
-example.com. IN ZONEMD 200154054 1 22 EFAA5B78B38AB1C45DE57B8167BCCE906451D0E72118E1F5E80B5F0C3CF04BFFC65D53C011185528EAD439D6F3A02F511961E090E5E4E0DFA013BD276D728B22
-example.com. IN ZONEMD 200154054 21 2 EFAA5B78B38AB1C45DE57B8167BCCE906451D0E72118E1F5E80B5F0C3CF04BFFC65D53C011185528EAD439D6F3A02F511961E090E5E4E0DFA013BD276D728B22
-www.example.com. IN A 127.0.0.1
-ns.example.com. IN A 127.0.0.1
-bar.example.com. IN A 1.2.3.4
-ding.example.com. IN A 1.2.3.4
-foo.example.com. IN A 1.2.3.4
-TEMPFILE_END
-
-stub-zone:
-	name: "."
-	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
-CONFIG_END
-
-SCENARIO_BEGIN Test authority zone with ZONEMD with unknown algo from zonefile
-
-; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 100
-	ADDRESS 193.0.14.129
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS	K.ROOT-SERVERS.NET.
-SECTION ADDITIONAL
-K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN NS
-SECTION AUTHORITY
-com.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-RANGE_END
-
-; a.gtld-servers.net.
-RANGE_BEGIN 0 100
-	ADDRESS 192.5.6.30
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN NS
-SECTION ANSWER
-com.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN NS
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com. IN A 1.2.3.44
-ENTRY_END
-RANGE_END
-
-; ns.example.net.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.44
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN NS
-SECTION ANSWER
-example.net.	IN NS	ns.example.net.
-SECTION ADDITIONAL
-ns.example.net.		IN 	A	1.2.3.44
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-ns.example.net. IN A
-SECTION ANSWER
-ns.example.net. IN A	1.2.3.44
-SECTION AUTHORITY
-example.net.	IN NS	ns.example.net.
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-ns.example.net. IN AAAA
-SECTION AUTHORITY
-example.net.	IN NS	ns.example.net.
-SECTION ADDITIONAL
-www.example.net. IN A	1.2.3.44
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN NS
-SECTION ANSWER
-example.com.	IN NS	ns.example.net.
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION ANSWER
-www.example.com. IN A	10.20.30.40
-ENTRY_END
-RANGE_END
-
-STEP 1 QUERY
-ENTRY_BEGIN
-REPLY RD
-SECTION QUESTION
-www.example.com. IN A
-ENTRY_END
-
-; recursion happens here.
-STEP 20 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION ANSWER
-www.example.com. IN A	127.0.0.1
-ENTRY_END
-
-SCENARIO_END
@@ -4,8 +4,6 @@ server:
 	log-time-ascii: yes
 	fake-sha1: yes
 	trust-anchor-signaling: no
-	ede: yes
-
 stub-zone:
 	name: "."
 	stub-addr: 193.0.14.129         # K.ROOT-SERVERS.NET.
@@ -152,7 +150,7 @@ ENTRY_END

 STEP 20 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ede=9
+MATCH all_noedns ede=9
 REPLY QR RD RA DO SERVFAIL
 SECTION QUESTION
 www.example.com. IN A
@@ -5,8 +5,6 @@ server:
 	log-time-ascii: yes
 	fake-sha1: yes
 	trust-anchor-signaling: no
-	ede: yes
-
 stub-zone:
 	name: "."
 	stub-addr: 193.0.14.129         # K.ROOT-SERVERS.NET.
@@ -140,7 +138,7 @@ ENTRY_END

 STEP 20 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ede=6
+MATCH all_noedns ede=6
 REPLY QR RD RA DO SERVFAIL
 SECTION QUESTION
 www.example.com. IN A
@@ -4,8 +4,6 @@ server:
 	log-time-ascii: yes
 	fake-sha1: yes
 	trust-anchor-signaling: no
-	ede: yes
-
 stub-zone:
 	name: "."
 	stub-addr: 193.0.14.129         # K.ROOT-SERVERS.NET.
@@ -157,7 +155,7 @@ ENTRY_END

 STEP 30 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ede=9
+MATCH all_noedns ede=9
 REPLY QR RD RA DO SERVFAIL
 SECTION QUESTION
 www.example.com. IN A
@@ -4,8 +4,6 @@ server:
 	log-time-ascii: yes
 	fake-sha1: yes
 	trust-anchor-signaling: no
-	ede: yes
-
 stub-zone:
 	name: "."
 	stub-addr: 193.0.14.129         # K.ROOT-SERVERS.NET.
@@ -157,7 +155,7 @@ ENTRY_END

 STEP 30 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ede=6
+MATCH all_noedns ede=6
 REPLY QR RD RA DO SERVFAIL
 SECTION QUESTION
 www.example.com. IN A
@@ -6,7 +6,6 @@ server:
 	target-fetch-policy: "0 0 0 0 0"
 	fake-sha1: yes
 	trust-anchor-signaling: no
-	ede: yes

 stub-zone:
 	name: "."
@@ -579,7 +578,7 @@ ENTRY_END
 ; recursion happens here.
 STEP 10 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ede=7
+MATCH all_noedns ede=7
 REPLY QR RD RA DO SERVFAIL
 SECTION QUESTION
 www.sub.example.com. IN A
@@ -596,7 +595,7 @@ ENTRY_END

 STEP 120 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ede=7
+MATCH all_noedns ede=6
 REPLY QR RD RA DO SERVFAIL
 SECTION QUESTION
 ftp.sub.example.com. IN A
@@ -6,7 +6,6 @@ server:
 	target-fetch-policy: "0 0 0 0 0"
 	fake-sha1: yes
 	trust-anchor-signaling: no
-	ede: yes

 stub-zone:
 	name: "."
@@ -561,7 +560,7 @@ ENTRY_END
 ; recursion happens here.
 STEP 10 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ede=7
+MATCH all_noedns ede=7
 REPLY QR RD RA DO SERVFAIL
 SECTION QUESTION
 www.sub.example.com. IN A
@@ -578,7 +577,7 @@ ENTRY_END

 STEP 120 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ede=7
+MATCH all_noedns ede=6
 REPLY QR RD RA DO SERVFAIL
 SECTION QUESTION
 ftp.sub.example.com. IN A
@@ -7,7 +7,6 @@ server:
 	qname-minimisation: "no"
 	fake-sha1: yes
 	trust-anchor-signaling: no
-	ede: yes

 stub-zone:
 	name: "."
@@ -286,7 +285,7 @@ ENTRY_END
 ; recursion happens here.
 STEP 10 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ede=7
+MATCH all_noedns ede=7
 REPLY QR RD RA DO SERVFAIL
 SECTION QUESTION
 www.example.com. IN A
@@ -305,7 +304,7 @@ ENTRY_END
 ; recursion happens here.
 STEP 120 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ede=7
+MATCH all_noedns ede=6
 REPLY QR RD RA DO SERVFAIL
 SECTION QUESTION
 ftp.example.com. IN A
@@ -1,23 +0,0 @@
-; Test if the zone parser accepts various blank lines
-@		IN	SOA	ns1.example.com dnsmaster.example.com. (
-				1	; Serial
-				      7200	; Refresh 2 hours
-				      3600	; Retry   1 hour
-				   2419200	; expire - 4 weeks
-				      3600	; Minimum 1 hour     
-)
-		7200	IN	NS      ns1
-ns1			IN	A	192.0.2.1
-			IN	AAAA	2001:dbb::1
-; completely blank line
-
-; line with one space
- 
-; line with one tab
-	
-; line with spaces followed by comment
-  ; test comment
-; line with tabs followed by comment
-		; test comment
-; Final line with spaces, tabs and comment
- 	 	; test comment
@@ -1,20 +0,0 @@
-server:
-	verbosity: 7
-	# num-threads: 1
-	interface: 127.0.0.1
-	port: @PORT@
-	use-syslog: no
-	directory: ""
-	pidfile: "unbound.pid"
-	chroot: ""
-	username: ""
-	do-not-query-localhost: no
-	use-caps-for-id: yes
-	module-config: "respip validator iterator"
-
-auth-zone:
-        name: blanks.example.com
-        zonefile: "blanks.example.com.zone"
-	url: "https://127.0.0.1:@TOPORT@/blanks.example.com.zone"
-	for-upstream: yes
-	for-downstream: yes
@@ -1,16 +0,0 @@
-BaseName: blanks_cached_zone
-Version: 1.0
-Description: Check if a cached zone with blank line can be loaded
-CreationDate: Wed 08 Jun 2022 11:16:25 AM CEST
-Maintainer: Philip Homburg
-Category: 
-Component:
-CmdDepends: 
-Depends: 
-Help:
-Pre: blanks_cached_zone.pre
-Post: blanks_cached_zone.post
-Test: blanks_cached_zone.test
-AuxFiles: 
-Passed:
-Failure:
@@ -1,10 +0,0 @@
-# #-- blanks_cached_zone.post --#
-# source the master var file when it's there
-[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
-# source the test var file when it's there
-[ -f .tpkg.var.test ] && source .tpkg.var.test
-#
-# do your teardown here
-PRE="../.."
-. ../common.sh
-kill_pid $UNBOUND_PID
@@ -1,23 +0,0 @@
-# #-- blanks_cached_zone.pre--#
-# source the master var file when it's there
-[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
-# use .tpkg.var.test for in test variable passing
-[ -f .tpkg.var.test ] && source .tpkg.var.test
-
-PRE="../.."
-. ../common.sh
-get_random_port 2
-UNBOUND_PORT=$RND_PORT
-UNUSED_PORT=$(($RND_PORT + 1))
-echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
-
-# make config file
-sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$UNUSED_PORT'/' < blanks_cached_zone.conf > ub.conf
-# start unbound in the background
-$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
-UNBOUND_PID=$!
-echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
-
-cat .tpkg.var.test
-wait_unbound_up unbound.log
-
@@ -1,51 +0,0 @@
-# #-- blanks_cached_zone.test --#
-# source the master var file when it's there
-[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
-# use .tpkg.var.test for in test variable passing
-[ -f .tpkg.var.test ] && source .tpkg.var.test
-
-PRE="../.."
-# do the test
-TARGET=ns1.blanks.example.com.
-echo "> dig $TARGET"
-dig @localhost -p $UNBOUND_PORT $TARGET | tee outfile
-if grep SERVFAIL outfile; then
-	echo "> try again"
-	dig @localhost -p $UNBOUND_PORT $TARGET | tee outfile
-fi
-if grep SERVFAIL outfile; then
-	echo "> try again"
-	sleep 1
-	dig @localhost -p $UNBOUND_PORT $TARGET | tee outfile
-fi
-if grep SERVFAIL outfile; then
-	echo "> try again"
-	sleep 1
-	dig @localhost -p $UNBOUND_PORT $TARGET | tee outfile
-fi
-if grep SERVFAIL outfile; then
-	echo "> try again"
-	sleep 1
-	dig @localhost -p $UNBOUND_PORT $TARGET | tee outfile
-fi
-if grep SERVFAIL outfile; then
-	echo "> try again"
-	sleep 10
-	dig @localhost -p $UNBOUND_PORT $TARGET | tee outfile
-fi
-if grep SERVFAIL outfile; then
-	echo "> try again"
-	sleep 10
-	dig @localhost -p $UNBOUND_PORT $TARGET | tee outfile
-fi
-echo "> cat logfiles"
-cat unbound.log
-echo "> check answer"
-if grep "192.0.2.1" outfile; then
-	echo "OK"
-else
-	echo "Not OK"
-	exit 1
-fi
-
-exit 0
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
TCY16	8c96e26074	modify tdir to ignore localzone tests	2022-01-13 14:50:43 +01:00
Willem Toorop	9ae988cea6	Merge branch 'master' into review-rfc8914-ede	2022-01-11 09:26:49 +01:00
TCY16	80957b6da3	remove debug line	2022-01-10 16:28:54 +01:00
TCY16	69e188b5cf	fix missing disable in remote-control local_zone do_ede and typos	2021-12-22 15:47:50 +01:00
TCY16	49f2960089	add remote control options for local-zone and RPZ do_ede	2021-12-22 14:39:06 +01:00
TCY16	94f04a77d9	remove superfluous linebreaks	2021-12-21 13:17:57 +01:00
TCY16	fe8ef6e53d	add logic for per zone EDE for RPZ and configurable rpz-do-ede	2021-12-21 13:17:07 +01:00
TCY16	79024484a7	Document how the log-val-level: config options influences the returned EDE option text	2021-12-16 11:45:18 +01:00
TCY16	05e06fdcf5	fix rpl tests	2021-12-15 14:59:45 +01:00
tcarpayandGitHub	df229db074	Merge branch 'master' into features/rfc8914-ede	2021-12-15 13:07:01 +01:00
TCY16	4f37d6489e	fix DNSSEC nsec-failure test	2021-12-15 12:49:54 +01:00
TCY16	ea1a5f35e4	add todo for tests and fix EDE codes for DNSKEY missing	2021-12-15 12:29:11 +01:00
Tom Carpay	dc38aacefc	expand ede.tdir to do validator test for DNSKEY, RRSIG and NSEC missing	2021-12-15 11:05:45 +00:00
TCY16	63e6604b2a	add config options to test conf, fix local-zone EDE printing logic, and fix typo in the unbound.conf	2021-12-07 13:25:32 +01:00
TCY16	65ee2f2c39	finish up adding validator EDEs and other TODOs and fix tests with more specific EDE codes	2021-12-06 14:19:28 +01:00
TCY16	db98a8b825	add ede-local-zones in the manpage and update the iana_ports.inc for some reason	2021-11-30 12:12:57 +01:00
TCY16	3ccb4c6c26	change local-zone-default-ede keywords to '-', add missing {}, and add manpage entry for local-zone-do-ede, local-zone-default-ede, and ede-local-zones	2021-11-30 11:32:01 +01:00
TCY16	ff356b940b	add error in case of incorrect string for local-zone-default-ede	2021-11-26 15:35:53 +01:00
TCY16	7926874669	add config option for global EDE flag, local-zone specific EDE flag and default EDE code for a zone	2021-11-26 15:12:56 +01:00
TCY16	575a6865be	add forgotten autogenerated files	2021-11-19 11:55:13 +01:00
TCY16	0572870592	change do_ede to be local-zone specific and add places for more EDE codes	2021-11-19 11:27:13 +01:00
Tom Carpay	0747d016e4	add missing parsing	2021-11-16 13:21:03 +00:00
TCY16	4a43aee99e	setup for configurable EDEs for local-zone	2021-11-16 11:25:58 +01:00
Tom Carpay	a3171a1d48	remove superfluous EDE left over from merge	2021-11-16 08:25:53 +00:00
Tom Carpay	f22e42f554	Fix merge bugs	2021-11-15 15:00:35 +00:00
Tom Carpay	787d7a5952	Merge branch 'master' into features/rfc8914-ede	2021-11-15 14:48:35 +00:00
TCY16	0eba781ed3	make local_data ede inclusion configurable, rewrite local_error_encode to include this logic, and remove superfluous msgparse_check_edns_in_packet function	2021-11-10 16:58:54 +01:00
TCY16	df984d9c6f	add dnssec ede tests	2021-10-18 16:45:42 +02:00
George Thessalonikefs	fed0fb42dd	- Fix testcode, 0 is a valid EDE INFO-CODE.	2021-10-14 14:01:39 +02:00
TCY16	abd948f3d7	change unittests to match just the ede code	2021-10-13 15:28:10 +02:00
George Thessalonikefs	f7bb7f2a94	Merge branch 'features/rfc8914-ede' of github.com:NLnetLabs/unbound into features/rfc8914-ede	2021-10-13 12:02:29 +02:00
George Thessalonikefs	9bff0b94dd	- Introduce 'ede=<info-code>' and 'all_noedns' as options in the MATCH line for replay test packets.	2021-10-13 12:01:36 +02:00
TCY16	d2a719f606	add test setup for DNSSEC EDEs	2021-10-13 11:17:42 +02:00
TCY16	b825bb668d	add more tests	2021-10-08 15:55:40 +02:00
TCY16	8a6b3f088b	add DNSKEY EDE code	2021-10-08 15:54:10 +02:00
TCY16	86e8050352	add EDE responses to unittests	2021-10-01 14:46:29 +02:00
TCY16	c42c2cbbff	add EDE response to autotrust_init_failsig test	2021-09-30 16:56:50 +02:00
TCY16	7df2df0fc9	add EDE response to autotrust_init_fail test	2021-09-30 16:39:40 +02:00
TCY16	320aa64d18	add QDCOUNT=0 to CHAOS query in ACL	2021-09-29 12:54:41 +02:00
TCY16	3ba8ea321a	fix CH class response	2021-09-28 16:35:50 +02:00
TCY16	42ba5ae4a2	process @wcawijngaards' comments v2	2021-09-28 13:48:36 +02:00
TCY16	732ad94729	process @wcawijngaards' comments	2021-09-28 13:28:25 +02:00
TCY16	84da2409b3	change strncpy to memmove at @wcawijngaards' suggestion	2021-09-28 10:05:47 +02:00
Tom Carpay	0b376cc42f	add routine to add EDE to ACL:refused at correct location	2021-09-27 14:17:21 +00:00
Tom Carpay	b606c8273d	Merge branch 'features/rfc8914-ede' of github.com:NLnetLabs/unbound into features/rfc8914-ede	2021-09-20 09:42:47 +00:00
TCY16	4df2965459	add forgotten compile error fixes from previous commit	2021-09-20 11:42:39 +02:00
Tom Carpay	65852bcbc4	Merge branch 'features/rfc8914-ede' of github.com:NLnetLabs/unbound into features/rfc8914-ede	2021-09-20 09:35:30 +00:00
TCY16	4d15603a8c	add routine to do EDE on ACL blocked messages	2021-09-20 11:35:00 +02:00
Tom Carpay	5617de6867	Answer LDNS_EDE_RRSIGS_MISSING for normal answers with missing signatures	2021-09-15 10:15:35 +00:00
TCY16	3576033b62	add possible EDE spots	2021-09-15 11:17:04 +02:00
Tom Carpay	a664e8cec4	First step towards specific EDE DNSSEC errors	2021-09-14 07:45:51 +00:00
TCY16	2360120562	add mesh bogus test, possible locations for more EDE and remove superfluous todo comments	2021-09-13 13:25:17 +02:00
TCY16	9df75a842b	add DNSSEC indeterminate EDE and DNAME expansion test	2021-09-08 16:38:33 +02:00
Tom Carpay	7079f0b5aa	add ede to always_refuse and always_null	2021-09-06 13:13:49 +00:00
tcarpay	33445be8df	add setup of RPZ and full tests of earlier implemented EDEs	2021-08-31 15:22:44 +02:00
tcarpay	fba1c302ac	add localzones test	2021-08-23 14:26:32 +02:00
tcarpay	ec4cf69eb7	set up for tpkg test	2021-08-23 14:00:04 +02:00
tcarpay	d9a947f267	Merge branch 'master' into features/rfc8914-ede	2021-08-20 16:28:27 +02:00
Tom Carpay	a98659791e	EDE Blocked with local-zone refused answers	2021-08-19 14:31:03 +00:00
Tom Carpay	5fff0f7e30	Fix dont echo edns0 option list ... when refusing to answer authoritatively. Also remove TODO comments that were already done	2021-08-19 14:28:26 +00:00
Tom Carpay	935634dcae	Revert "add local anwser blocked" This reverts commit `b3f60db184`.	2021-08-19 14:21:10 +00:00
tcarpay	b3f60db184	add local anwser blocked	2021-08-19 14:01:14 +02:00
Tom Carpay	a9e6f6bc23	add variable bogus reason	2021-08-17 14:10:48 +00:00
Tom Carpay	6b5f314a3a	Show reason when returning EDE_DNSSEC_BOGUS	2021-08-16 13:36:45 +00:00
Tom Carpay	eac4eb3a9e	Return EDE_DNSSEC_BOGUS when returning bogus answers	2021-08-16 12:46:24 +00:00
Tom Carpay	0703a38243	Fix: use EDE codes with EDNS_OPT_APPEND_EDE + complete EDE codes	2021-08-16 09:59:13 +00:00
tcarpay	4049885da2	add locations for EDE errors	2021-08-13 12:01:28 +02:00
Willem Toorop	a8d78b2083	Simple EDE example	2021-06-24 12:55:46 +02:00
Willem Toorop	285f93ff82	Add EDE EDNS0 Option code	2021-06-24 11:20:58 +02:00